Restore messages in root of Exchange Mailbox

[Mr_Bill250]

I am trying to restore some messages kept in the root of a shared (secondary) mailbox. This is at the very top level of the mailbox where the Inbox, Sent, Deleted Items, and other top level folders are listed. They currently have over 3,600 messages there. 

I checked the last several full backups we have and there are no messages at the top level showing in the restore selections, only top level folders are visible. Messages under Inbox, Deleted, etc. all show up OK. 

How can I recover these messages? Is there some filter preventing me from seeing the 3,600+ messages in the root of this mailbox?  

We are using Backup Exec 2012 (v.14.0 1798.1244) to backup an Exchange 2010 SP2 server with DAG (2 mailbox servers in a DAG cluster).  There is no Mail Archive of any kind setup. All servers run Windows Server 2008. We use the Exchange Agent and have GRT enabled. 

The messages are missing for a few weeks, we are past being able to use the Outlook/Exchange undelete feature to get them back. Tape is our only hope.  

Thanks

[lmosla]

Since you are restoring from tape make sure you have enough space to stage the whole Backup set on the temp drive of the Media Server.  Please see this document on restoring Exchange GRT to a PST file http://www.symantec.com/docs/TECH191622 

hope this helps

[Colin_Weaver]

I think we may need to know what sort of e-mail messages these are and I think you may have to log a formal support call so that we can look into it further and perhaps bring your seemingly unique requirement to our engineering team's attention.

We had a change in ethos in BE 2012 as we realized that exposing the hidden mail messages that are used for control functions (either of Exchange or Outlook themselves, or 3rd party Exchange aware apps)  was causing confusion to the individual members of staff attempting to restore Exchange data. When we looked at the types of message involved we realized that for the most part they did not need restoring and that most customers only wanted to restore what was normally visible to an end user in Outlook. Hence the restore view is now limited to the mail messages that end users see (in their own mailbox). As end users do not normally see above the Inbox my guess is anything in there is now hidden from the restore view. This may well have had an effect on your shared mailbox setup.

It is possible that a restore of the complete mailbox might still bring them back (suggest a redirection of the mailbox to a new empty mailbox or perhaps to a PST as mentioned above) and a restore of the whole information store will almost certainly work (perhaps to an Recovery Database)

Going forwards I would suugest you should move the data in the shared mailbox into the Inbox of that mailbox.

EDIT: I am currently trying to find out if there is a way to disable this feature, will update when I have more info.

[Mr_Bill250]

Hi lmosla, Disk space is not a problem. I have many TB available and the edb is less than 400GB. 

[Mr_Bill250]

Thank you Colin. The data in the root folder are messages received at the shared mailbox and moved from the Inbox to the root folder of this same mailbox. Most, perhaps all messages are internal. Some have attachments, some do not. 

This is a shared mailbox used by a few people; it is no one's primary mailbox. Once a message is responded to, they move it to the root folder. Unlike the users primary mailbox, the secondary mailbox has the root folder clearly visible and moving messages there is permitted in Outlook. If users can do something, they surely will. This company has over a hundred shared mailboxes, 

I restored the entire database and used the "Kernel for Exchange Server" Utility by Lepide to extract the entire mailbox to a PST. The hidden mailbox fodlers are visible with this utility and I did find the items I believe the user deleted under the hidden folder "\Recoverable Items\Deletions". The immediate problem may be resolved. I am waiting for confirmation from the user. This utility found no data in the root folder of the mailbox.

My concern now is can I restore all of the data if I ever need to do a full restore of a mailbox from tape? I compared some sizes of the data have. The PST Kernel Tools created is 6,217 KB. The mailbox on the mail server is 123,292 KB. 

I'm wondering if the data in the mailbox root folder is being backed up at all? Or is the utility also not able to see the root data? 

[Colin_Weaver]

A DR Restore of a complete information store will restore all of the content.

The GRT element that allows individual message restore is only really intended for actual e-mails to users - although your interesting use of this shared mailbox with moving to root would appear to have an issue with this design. You might be better off creating a "Dealt with" Subfolder inside the Inbox and move the items to that instead of root, although please review the info I sent you by PM.

BTW if you did restore what you needed from Recovered Items\Deletions and this is the location used by Exchange to retain deletions then I believe that means the end user (or users) had deleted the e-mails well before the backup took place,  unless your end users have manually created a folder with this name anyway.

We do not expose the content of the Exchange deleted items retention area because the end user is meant to use options inside of Outlook to recover those and from our point of view they should be part of an older backup set that was taken before the end user deleted the e-mails and therefore in the Inbox of that older backup set. Yes in the past we did expose that sort of thing (although I can't confirm if the delete retention area was ever exposed) but then received support calls asking for advice on what all the weird folder names meant when all they wanted was one e-mail message from the Inbox.

[Mr_Bill250]

Thanks Colin. I suggested makign a folder and not storing data in the root folder as a policy to the customer and am waiting to hear back. 

I will try what you sugested in PM after our weekly backups complete. I did resotre the entire datastore to a drive to use the Kernel utility. I'm thinking the Kernel utility would have shown this data in the root if it was present in the restored edb file as other hidden folders are visible.