Ridiculous Exchange database restore scenario

Question

Okay, so I have a little bit of a challenge for the Exchange pros.

I am looking for the mailbox database that a specific user was on... Before their account (and mailbox) was destroyed, around 7 months ago.

I have backups from this time period, however the way the backups are configured is to backup by database, and I can't seem to think of a way to find the database this user was on without guessing which database their data was living on. Anybody have thoughts on how to proceed?

TL;DR - User no longer with company, need to get files from backup but have no idea which mailbox database their files were stored on.

You can't fire up an Exchange VM, start mounting databases and searching through them? — HopelessN00b, Mar 07 '13 at 19:48
I can, and that's what I've been doing. However we have a huge Exchange environment with waaay too many mailbox db's. It's more about saving time of having to look through all of them. — jmreicha, Mar 07 '13 at 19:51
I have a suggestion but... in order not to make me sound ridiculous, could you add whether you have the AD Recycle Bin feature, and for how long; if not, what is Forest Functional Level and when it was last raised? — Mathias R. Jessen, Mar 07 '13 at 20:07
AD Domain and Forest functional level are 2008 R2. Not sure on the AD recycle bin feature, will have to get back to you on that. — jmreicha, Mar 07 '13 at 20:20
@jmreicha Ugh, well, sounds like it might be time to a) tell the bosses it'll take you 4 weeks to sort through all the Exchange data to find this mailbox and b) propose some sort of process to archive employee data (like mail) as part of the separation procedure. I don't think there's a good way to do this after the fact, but you can certainly put things in place to make life better for next time. — HopelessN00b, Mar 07 '13 at 20:25
@HopelessN00b Yes this is a real headache. Thanks for the suggestion, I will see if the higher ups will go for it. — jmreicha, Mar 07 '13 at 20:31
@MathiasR.Jessen R. Jessen Just double checked, this user was deleted before we enable AD Recycle Bin feature. Ugh. — jmreicha, Mar 07 '13 at 20:32

score 7 · Accepted Answer · answered Mar 07 '13 at 20:20

7

It sounds like it might be worth it to perform a System State restore of a DC contemporaneous to the Exchange backups, find the user object, and examine the homeMDB attribute. That's going to give you the mailbox database name for sure, but you'll have to deal with putting up a DC "under glass" (don't connect it to your network at all after you perform the system state restore) to get at the data you're looking for.

answered Mar 07 '13 at 20:20

Evan Anderson

141,071
19
191
328

It might prove to be difficult but I will give it a try. Is there a way to grab an Active Directory database from say an old backup and look at it somehow? – jmreicha Mar 07 '13 at 21:16
Do you have a link or can you point me in the right direction for doing the System State restore? – jmreicha Mar 07 '13 at 22:20
Depends on your backup software – Mathias R. Jessen Mar 08 '13 at 02:50
@MathiasR.Jessen We are using HP Data Protector, to backup the full mailbox databases and using filesystem level and DR options on all other backups. – jmreicha Mar 08 '13 at 15:15

score 0 · Answer 2 · answered Apr 10 '13 at 12:48

This is a little exploitative.

Use the free trial period on a paid archiving tool to extract and archive the email, then just search through it that way.

At the end of the trial, just tell them you don't want to buy it.

Exclaimer might be good for this, but bonus points for using some SaaS solution and having someone actually do all of that for you.

If it saves 4 weeks of work...

Ridiculous Exchange database restore scenario

2 Answers2