Exchange 2013 - User deleted all emails - recovery options
-
We had a user delete all their emails and then purged everything from the recover deleted items option in Outlook. When a user purges, does that remove them permanently from the server or can I still recover them from Exchange Shell?
Or do I have to restore the database and recover from there?
Thanks
-
This is going to be feature sensitive based on what was setup, I'd start here.
-
The retain deleted items is set for 23000.00:00:00
Not sure I follow all the different litigation hold settings and singleitemrecovery options. -
I think recovering the purged items is not going to be an option. While I had the retention for 23000 days, the singleitemrecoveryenabled was set to false.
So best bet I guess is restore the EDB and mount it as a recovery database and restore the whole user mailbox.
-
Just another thought, I backup the server with Veeam Agent for Windows (free). If I installed Veeam Backup and Recovery, can I read the contents of my Agent backups? Then I could potentially use Veeam Explorer for Exchange to extract the contents?
-
@syko24 said in Exchange 2013 - User deleted all emails - recovery options:
Just another thought, I backup the server with Veeam Agent for Windows (free). If I installed Veeam Backup and Recovery, can I read the contents of my Agent backups? Then I could potentially use Veeam Explorer for Exchange to extract the contents?
that should work.
-
@syko24 No, Veeam Agent free does not do Application aware backups of Exchange or SQL. You would need to restore the Exchange Server or Mailbox Database from your backups to be able to get that data.
If you do litigation hold however the items are still there, just the user can't see that they are there.
-
@syko24 said in Exchange 2013 - User deleted all emails - recovery options:
I think recovering the purged items is not going to be an option. While I had the retention for 23000 days, the singleitemrecoveryenabled was set to false.
So best bet I guess is restore the EDB and mount it as a recovery database and restore the whole user mailbox.
That is the best way but I would try to recover on another lab server instead.
-
@dbeato - Dumb question but if I enable litigation hold now it won't do me any good for this situation right? The retention period is set for 23,000 days. Does the retention period just say how long it will remain in recoverable items unless removed?
-
@syko24 said in Exchange 2013 - User deleted all emails - recovery options:
t if I enable litigation hold now it won't do me any good for this situation right? The retention period is set for 23,000 days. Does the retention period just say how long it will rema
I mean it is only after enabled so right not it won't be any help. Retention policy applies to the items that have been deleted but are still on the recoverable deleted items. Otherwise once purged, they are gone.
-
@dbeato - Got it, makes sense. I'm going to give the Veeam Backup and Replication a shot just to see. Otherwise, I am going to have to restore the system to another VM and recover that way.
Appreciate the feedback
-
@scottalanmiller said in Exchange 2013 - User deleted all emails - recovery options:
@syko24 said in Exchange 2013 - User deleted all emails - recovery options:
Just another thought, I backup the server with Veeam Agent for Windows (free). If I installed Veeam Backup and Recovery, can I read the contents of my Agent backups? Then I could potentially use Veeam Explorer for Exchange to extract the contents?
that should work.
Just a follow up, I was able to install Veeam Backup and Replication (Community) and imported my Veeam Agent for Windows (Free) in to it. I was then able to use Explorer for Exchange to mount the backup file and export the emails from the user to a PST.
