Exchange 2010 - Restoring mailbox from Recovery Database

I recently had a user who hard deleted a folder from their Outlook and was unable to recover the folder using the Recover Deleted Items option in Outlook which meant I was required to recover from backup. As I haven’t had to do a restore for some time, I found that I had to do a bit of digging into my old notes to find all the cmdlets so after completing the restore I thought it would be a good idea to blog the process so I have something to reference to in the future.

Begin by creating a new recovery database in your Exchange organization with the New-MailboxDatabase cmdlet. The TechNet article for this cmdlet in Exchange 2010 can be found here:

http://technet.microsoft.com/en-us/library/ee332321(v=exchg.141).aspx

… and for Exchange 2013 can be found here:

http://technet.microsoft.com/en-us/library/ee332321(v=exchg.150).aspx

From what I can tell, the cmdlet hasn’t changed for 2013 so the cmdlet would look something like the following:

New-MailboxDatabase -Recovery -Name Recovery –Server <serverName> -EdbFilePath <databasePath\databaseName.edb> -LogFolderPath <logPath>

… or:

New-MailboxDatabase -Recovery -Name Recovery -Server EXCH01 -EdbFilePath "M:\Mailbox\D
atabase\Recovery.EDB" -LogFolderPath "M:\Mailbox\Logs\Recovery"

Once the cmdlet executes successfully, executing the cmdlet Get-MailboxDatabase cmdlet should display something similar to the following:

Notice how the Recovery field for the recovery database is set to True in the screenshot above. You should also notice a new dismounted mailbox database created from within the Exchange Management Console:

With the recovery database created, proceed with the restore from your backup application (BackupExec, CommVault, etc) and once the restore is complete, ensure that the mailbox database is mounted:

With the new recovery mailbox store mounted, ensure that the mounted store contains mailboxes by executing the cmdlet:

Get-MailboxStatistics -database RDB

… where RDB is the name of the recovery mailbox database. If the recovery mailbox contains mailboxes, you should see output that is similar to the following:

The output above from the recovery database should look pretty much the same as the production database so if you were to execute Get-MailboxStatistics -database ProductionDB, you should see a similar output.

Now that we’ve confirmed that the restored mailbox database contains mailbox, the next step is to extract the mailbox contents and either place it into a new temporary mailbox or back into the actual user’s mailbox. I personally prefer to extract the contents to a temporary mailbox so what I do is create a mailboxrecovery account as such:

Then user the following cmdlet to restore the user’s mailbox into the temporary account:

Restore-Mailbox -Identity myTemporaryAccount -RecoveryDatabase RDB -RecoveryMailbox "Some UserName" -TargetFolder Recovery

… or the following that has actual parameters:

Restore-Mailbox -Identity mailboxrecovery -RecoveryDatabase RDB -RecoveryMailbox "Kathleen Smith" -TargetFolder Recovery

Note that there are times when the recovery database may contain corrupted items so if the restore fails with a exceeded corrupted item count, add the following switch:

Restore-Mailbox -Identity mailboxrecovery -RecoveryDatabase RDB -RecoveryMailbox "Kathleen Rear
don" -TargetFolder Recovery -BadItemLimit 10

Once the cmdlet above executes, you should be able to log into the mailboxrecovery account and see a Recovery folder listed in in the root of the mailbox:

What I usually do is use Outlook to open both mailboxes, then export the folder the user deleted into a PST and reimport it back into the user’s mailbox. If the folder to be recovered does not have sub folders then you can simply click and drag but if it has sub folders then you won’t be able to because Outlook would prompt you with the message:

Cannot move the items. Cannot copy this folder because it may contain private items.