Single Exchange 2000 Mailbox Recovery

We fired an employee yesterday. She wasn't happy. This morning we figured
out that between her firing and being walked out the door, management had to
rework the termination letter. During that few minutes she went to her desk
to clean it out. Unbeknowst to us, she also deleted 200MB of her emails --
some of which were important (I know: we should have locked her out before
the termination).

I have full information store backups (veritas 9.1) from 7:05 am and from
12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.

Unfortunately, all our Exchange backups are FULL store backups, not mailbox
level. For reasons too complex to go into, we immediately delete 'deleted'
emails, so overnight Exchange maintenance wiped the emails and online-defrag
cleaned up pretty good :)

Does anyone know an easy way to recover this ex-employee's emails to her
email account (or a .pst?) without having to recover the entire info store?

Thanks,
John

Dave
Thu Jan 05 10:59:29 CST 2006

If deleted item recovery is enabled on the server, you should be able to use
Outlook to recover the items. Log in as the terminated user and open the
Deleted Items folder. Click Tools -> Recover Deleted Items.

Here's something that works if she did shift+del. FYI, this works equally
well in Exchange 2003 although the KB doesn't say so:
How to use Exchange Server 5.5 or Exchange 2000 Server to recover items that
are not first transferred to the Deleted Items folder in Outlook
http://support.microsoft.com/default.aspx?scid=kb;en-us;178630

This might be a reason to use brick level backups if your software supports
it. I don't like brick level (for one thing they take forever), but I do
them just in case. Saved me with a public folder once big time. And, it's
a reason to upgrade to SBS 2003. Exchange 2003 has Recovery Storage
Groups - you'd simply restore to the recovery group and exmerge out the
mailbox.



"John B" <john.baccellieri@texstyleco.com> wrote in message
news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
> We fired an employee yesterday. She wasn't happy. This morning we
> figured
> out that between her firing and being walked out the door, management had
> to
> rework the termination letter. During that few minutes she went to her
> desk
> to clean it out. Unbeknowst to us, she also deleted 200MB of her
> emails --
> some of which were important (I know: we should have locked her out
> before
> the termination).
>
> I have full information store backups (veritas 9.1) from 7:05 am and from
> 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
>
> Unfortunately, all our Exchange backups are FULL store backups, not
> mailbox
> level. For reasons too complex to go into, we immediately delete
> 'deleted'
> emails, so overnight Exchange maintenance wiped the emails and
> online-defrag
> cleaned up pretty good :)
>
> Does anyone know an easy way to recover this ex-employee's emails to her
> email account (or a .pst?) without having to recover the entire info
> store?
>
> Thanks,
> John
>
>

John
Thu Jan 05 11:15:42 CST 2006

Item recovery was not able to see anything before the 12:45PM full infostore
backup. But I did recover 10 or so emails from after 12:45PM using this
technique.

The KB is applicable going forward..thanks.

Not having the brick-level is definitely my problem. Anybody know any
Veritas recovery tricks for a single mailbox from a full infostore backup?

Thanks
JohnB



"Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in message
news:uqc9llhEGHA.1088@TK2MSFTNGP10.phx.gbl...
> If deleted item recovery is enabled on the server, you should be able to
use
> Outlook to recover the items. Log in as the terminated user and open the
> Deleted Items folder. Click Tools -> Recover Deleted Items.
>
> Here's something that works if she did shift+del. FYI, this works equally
> well in Exchange 2003 although the KB doesn't say so:
> How to use Exchange Server 5.5 or Exchange 2000 Server to recover items
that
> are not first transferred to the Deleted Items folder in Outlook
> http://support.microsoft.com/default.aspx?scid=kb;en-us;178630
>
> This might be a reason to use brick level backups if your software
supports
> it. I don't like brick level (for one thing they take forever), but I do
> them just in case. Saved me with a public folder once big time. And,
it's
> a reason to upgrade to SBS 2003. Exchange 2003 has Recovery Storage
> Groups - you'd simply restore to the recovery group and exmerge out the
> mailbox.
>
>
>
> "John B" <john.baccellieri@texstyleco.com> wrote in message
> news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
> > We fired an employee yesterday. She wasn't happy. This morning we
> > figured
> > out that between her firing and being walked out the door, management
had
> > to
> > rework the termination letter. During that few minutes she went to her
> > desk
> > to clean it out. Unbeknowst to us, she also deleted 200MB of her
> > emails --
> > some of which were important (I know: we should have locked her out
> > before
> > the termination).
> >
> > I have full information store backups (veritas 9.1) from 7:05 am and
from
> > 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
> >
> > Unfortunately, all our Exchange backups are FULL store backups, not
> > mailbox
> > level. For reasons too complex to go into, we immediately delete
> > 'deleted'
> > emails, so overnight Exchange maintenance wiped the emails and
> > online-defrag
> > cleaned up pretty good :)
> >
> > Does anyone know an easy way to recover this ex-employee's emails to her
> > email account (or a .pst?) without having to recover the entire info
> > store?
> >
> > Thanks,
> > John
> >
> >
>
>

Merv
Thu Jan 05 14:42:13 CST 2006

Maybe... Ontrack PowerControls

It's expensive ($950)

Mailbox Recovery - Standard License Option
http://www.ontrack.com/powercontrols/
http://buyonline.ontrack.com/ecom/catalog.asp

PowerControls v1.1 Exchange Restoration And Admin (earlier version)
http://www.msexchange.org/pages/article_p.asp?id=542

--
Merv Porter [SBS MVP]
===================================

"John B" <john.baccellieri@texstyleco.com> wrote in message
news:%23pfZfvhEGHA.1240@TK2MSFTNGP09.phx.gbl...
> Item recovery was not able to see anything before the 12:45PM full
> infostore
> backup. But I did recover 10 or so emails from after 12:45PM using this
> technique.
>
> The KB is applicable going forward..thanks.
>
> Not having the brick-level is definitely my problem. Anybody know any
> Veritas recovery tricks for a single mailbox from a full infostore backup?
>
> Thanks
> JohnB
>
>
>
> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
> message
> news:uqc9llhEGHA.1088@TK2MSFTNGP10.phx.gbl...
>> If deleted item recovery is enabled on the server, you should be able to
> use
>> Outlook to recover the items. Log in as the terminated user and open the
>> Deleted Items folder. Click Tools -> Recover Deleted Items.
>>
>> Here's something that works if she did shift+del. FYI, this works
>> equally
>> well in Exchange 2003 although the KB doesn't say so:
>> How to use Exchange Server 5.5 or Exchange 2000 Server to recover items
> that
>> are not first transferred to the Deleted Items folder in Outlook
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;178630
>>
>> This might be a reason to use brick level backups if your software
> supports
>> it. I don't like brick level (for one thing they take forever), but I do
>> them just in case. Saved me with a public folder once big time. And,
> it's
>> a reason to upgrade to SBS 2003. Exchange 2003 has Recovery Storage
>> Groups - you'd simply restore to the recovery group and exmerge out the
>> mailbox.
>>
>>
>>
>> "John B" <john.baccellieri@texstyleco.com> wrote in message
>> news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
>> > We fired an employee yesterday. She wasn't happy. This morning we
>> > figured
>> > out that between her firing and being walked out the door, management
> had
>> > to
>> > rework the termination letter. During that few minutes she went to her
>> > desk
>> > to clean it out. Unbeknowst to us, she also deleted 200MB of her
>> > emails --
>> > some of which were important (I know: we should have locked her out
>> > before
>> > the termination).
>> >
>> > I have full information store backups (veritas 9.1) from 7:05 am and
> from
>> > 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
>> >
>> > Unfortunately, all our Exchange backups are FULL store backups, not
>> > mailbox
>> > level. For reasons too complex to go into, we immediately delete
>> > 'deleted'
>> > emails, so overnight Exchange maintenance wiped the emails and
>> > online-defrag
>> > cleaned up pretty good :)
>> >
>> > Does anyone know an easy way to recover this ex-employee's emails to
>> > her
>> > email account (or a .pst?) without having to recover the entire info
>> > store?
>> >
>> > Thanks,
>> > John
>> >
>> >
>>
>>
>
>

John
Thu Jan 05 21:34:56 CST 2006

If you cannot get the mail back with DIR then Ontrack Powertools if you have
the money as suggested or simply build a recovery server to save the money.

--
John Oliver, Jr
MCSE, MCT, CCNA
Exchange MVP 2006
Microsoft Certified Partner

"John B" <john.baccellieri@texstyleco.com> wrote in message
news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
> We fired an employee yesterday. She wasn't happy. This morning we
> figured
> out that between her firing and being walked out the door, management had
> to
> rework the termination letter. During that few minutes she went to her
> desk
> to clean it out. Unbeknowst to us, she also deleted 200MB of her
> emails --
> some of which were important (I know: we should have locked her out
> before
> the termination).
>
> I have full information store backups (veritas 9.1) from 7:05 am and from
> 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
>
> Unfortunately, all our Exchange backups are FULL store backups, not
> mailbox
> level. For reasons too complex to go into, we immediately delete
> 'deleted'
> emails, so overnight Exchange maintenance wiped the emails and
> online-defrag
> cleaned up pretty good :)
>
> Does anyone know an easy way to recover this ex-employee's emails to her
> email account (or a .pst?) without having to recover the entire info
> store?
>
> Thanks,
> John
>
>

John
Fri Jan 06 10:22:40 CST 2006

John,

I don't have a recovery server, but that sounds best. Is there a SBS
whitepaper on how I would go about building a bare-bones recovery server?
Must I buy new licenses for W2k Server? Exchg 2k Server? etc.??

[I permanently saved the last Veritas backup of the information store
containing that has the ex-employees so when the 'recovery server' is
available....]

Thanks,
JohnB


"John Oliver, Jr. [MVP]" <jcoliverjr@hotmail.com> wrote in message
news:edIWpInEGHA.472@TK2MSFTNGP12.phx.gbl...
> If you cannot get the mail back with DIR then Ontrack Powertools if you
have
> the money as suggested or simply build a recovery server to save the
money.
>
> --
> John Oliver, Jr
> MCSE, MCT, CCNA
> Exchange MVP 2006
> Microsoft Certified Partner
>
> "John B" <john.baccellieri@texstyleco.com> wrote in message
> news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
> > We fired an employee yesterday. She wasn't happy. This morning we
> > figured
> > out that between her firing and being walked out the door, management
had
> > to
> > rework the termination letter. During that few minutes she went to her
> > desk
> > to clean it out. Unbeknowst to us, she also deleted 200MB of her
> > emails --
> > some of which were important (I know: we should have locked her out
> > before
> > the termination).
> >
> > I have full information store backups (veritas 9.1) from 7:05 am and
from
> > 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
> >
> > Unfortunately, all our Exchange backups are FULL store backups, not
> > mailbox
> > level. For reasons too complex to go into, we immediately delete
> > 'deleted'
> > emails, so overnight Exchange maintenance wiped the emails and
> > online-defrag
> > cleaned up pretty good :)
> >
> > Does anyone know an easy way to recover this ex-employee's emails to her
> > email account (or a .pst?) without having to recover the entire info
> > store?
> >
> > Thanks,
> > John
> >
> >
>
>

Merv
Fri Jan 06 11:08:36 CST 2006

Exchange Security Best Practices
http://groups.google.com/group/microsoft.public.backoffice.smallbiz2000/browse_thread/thread/25cda64e34dde6f9/f49debc8b4434ab6?lnk=st&q=sbs+2000+recovery+server+for+exchange&rnum=14&hl=en#f49debc8b4434ab6

Specifically,

(White Paper for) Disaster Recovery for Microsoft Exchange 2000 Server
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=6E55DD49-8A6C-4F30-947E-BDE95917F585

Also,

Mailbox Recovery for Microsoft Exchange 2000 Server
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9E52BAFC-5C33-46B9-AF14-04E4D989EF6B

Setting aside any legal aspects of temporarily putting the SBS 2000 OS and
apps on alternate hardware ( do not connect it to your network, you may have
to determine whether the original SBS 2000 server was an upgrade from SBS
4.5 or a fresh install. The alternate server must be identical to the SBS
2000 (domain name, org name, server name, etc.) and at the same SP levels.

NOTE: You should have 2 free support calls to MS Product Support Services
that came with the price of your SBS 2000 software (at least in the US). So
giving them a call may save a lot of time and headaches. (800) 936-4400

--
Merv Porter [SBS MVP]
===================================
"John B" <johnb@nomail.com> wrote in message
news:uz7c91tEGHA.2292@tk2msftngp13.phx.gbl...
> John,
>
> I don't have a recovery server, but that sounds best. Is there a SBS
> whitepaper on how I would go about building a bare-bones recovery server?
> Must I buy new licenses for W2k Server? Exchg 2k Server? etc.??
>
> [I permanently saved the last Veritas backup of the information store
> containing that has the ex-employees so when the 'recovery server' is
> available....]
>
> Thanks,
> JohnB
>
>
> "John Oliver, Jr. [MVP]" <jcoliverjr@hotmail.com> wrote in message
> news:edIWpInEGHA.472@TK2MSFTNGP12.phx.gbl...
>> If you cannot get the mail back with DIR then Ontrack Powertools if you
> have
>> the money as suggested or simply build a recovery server to save the
> money.
>>
>> --
>> John Oliver, Jr
>> MCSE, MCT, CCNA
>> Exchange MVP 2006
>> Microsoft Certified Partner
>>
>> "John B" <john.baccellieri@texstyleco.com> wrote in message
>> news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
>> > We fired an employee yesterday. She wasn't happy. This morning we
>> > figured
>> > out that between her firing and being walked out the door, management
> had
>> > to
>> > rework the termination letter. During that few minutes she went to her
>> > desk
>> > to clean it out. Unbeknowst to us, she also deleted 200MB of her
>> > emails --
>> > some of which were important (I know: we should have locked her out
>> > before
>> > the termination).
>> >
>> > I have full information store backups (veritas 9.1) from 7:05 am and
> from
>> > 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
>> >
>> > Unfortunately, all our Exchange backups are FULL store backups, not
>> > mailbox
>> > level. For reasons too complex to go into, we immediately delete
>> > 'deleted'
>> > emails, so overnight Exchange maintenance wiped the emails and
>> > online-defrag
>> > cleaned up pretty good :)
>> >
>> > Does anyone know an easy way to recover this ex-employee's emails to
>> > her
>> > email account (or a .pst?) without having to recover the entire info
>> > store?
>> >
>> > Thanks,
>> > John
>> >
>> >
>>
>>
>
>

Pat
Tue Jan 10 05:17:52 CST 2006

Here's an idea:
Needs doing out of hours but should work.

Do a full exchange backup of what you have.
Then restore the full exchange backup just prior to the mass deleteion.
Logon as that user and copy allt he e-mails to a PST folder.
Restore your first backup to get you back to current position.

"John B" <john.baccellieri@texstyleco.com> wrote in message
news:%23pfZfvhEGHA.1240@TK2MSFTNGP09.phx.gbl...
> Item recovery was not able to see anything before the 12:45PM full
> infostore
> backup. But I did recover 10 or so emails from after 12:45PM using this
> technique.
>
> The KB is applicable going forward..thanks.
>
> Not having the brick-level is definitely my problem. Anybody know any
> Veritas recovery tricks for a single mailbox from a full infostore backup?
>
> Thanks
> JohnB
>
>
>
> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
> message
> news:uqc9llhEGHA.1088@TK2MSFTNGP10.phx.gbl...
>> If deleted item recovery is enabled on the server, you should be able to
> use
>> Outlook to recover the items. Log in as the terminated user and open the
>> Deleted Items folder. Click Tools -> Recover Deleted Items.
>>
>> Here's something that works if she did shift+del. FYI, this works
>> equally
>> well in Exchange 2003 although the KB doesn't say so:
>> How to use Exchange Server 5.5 or Exchange 2000 Server to recover items
> that
>> are not first transferred to the Deleted Items folder in Outlook
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;178630
>>
>> This might be a reason to use brick level backups if your software
> supports
>> it. I don't like brick level (for one thing they take forever), but I do
>> them just in case. Saved me with a public folder once big time. And,
> it's
>> a reason to upgrade to SBS 2003. Exchange 2003 has Recovery Storage
>> Groups - you'd simply restore to the recovery group and exmerge out the
>> mailbox.
>>
>>
>>
>> "John B" <john.baccellieri@texstyleco.com> wrote in message
>> news:etHHmMhEGHA.344@TK2MSFTNGP11.phx.gbl...
>> > We fired an employee yesterday. She wasn't happy. This morning we
>> > figured
>> > out that between her firing and being walked out the door, management
> had
>> > to
>> > rework the termination letter. During that few minutes she went to her
>> > desk
>> > to clean it out. Unbeknowst to us, she also deleted 200MB of her
>> > emails --
>> > some of which were important (I know: we should have locked her out
>> > before
>> > the termination).
>> >
>> > I have full information store backups (veritas 9.1) from 7:05 am and
> from
>> > 12:45 pm yesterday (she was terminated at 4:30PM), so I have the data.
>> >
>> > Unfortunately, all our Exchange backups are FULL store backups, not
>> > mailbox
>> > level. For reasons too complex to go into, we immediately delete
>> > 'deleted'
>> > emails, so overnight Exchange maintenance wiped the emails and
>> > online-defrag
>> > cleaned up pretty good :)
>> >
>> > Does anyone know an easy way to recover this ex-employee's emails to
>> > her
>> > email account (or a .pst?) without having to recover the entire info
>> > store?
>> >
>> > Thanks,
>> > John
>> >
>> >
>>
>>
>
>