Exchange Mailbox Archive manually deleted

[DelphineFR]

Hi all,

it's not a issu, it's a question.

During some of my test, I manually delete an test archive on the "exchange mailbox" tab.

the warning was "deleting an archive permanently removes the archive adn all items stored in it. This action will override any from of deletation protection applied to items or retention categorie.

Once you click "yes" you cannot cancel the deletion.

Are you sure you want to delete "test account"

Here my 2 question :

1- if I understand the warning, there no option to put a deletation security like in exchange for exemple "keep the delete mailbox during XX day before delete it"

And second and most important.

What's happends if I made this hudge error ? and delete an archive mailbox... No way to restore it ? I backup the entiere enterprise vault archicture with netbackup, but I dont see any way to restore an full archive?

Is it possible? or I miss something?

thanks for you help.

[JesusWept3 · Accepted solution]

When you delete the archive from the Vault Admin Console it goes ahead and deletes the mailbox straight away. The only thing that prevents an archive from fully being deleted is if its items are in a retention category that says users are not allowed to delete items, or if its items are on legal hold (through discovery accelerator) There unfortunately is no archive dumpster for full archives. The only dumpster functionality is for individual items that the user deletes, but when you delete an archive through the VAC, the dumpster is bypassed and items are deleted there and then. There was talk at one time about having this option so when you set an archive for deletion it would keep it for 30 days and then you could recover it, but I haven't heard about this in a while. As for restoring an individual archive, you have really only one option And that is to set up a DR environment, with SQL Databases and Vault Store Partitions, then export out the Archive to PST then import it in to production. There is one other option though, you could use Quadrotech's EV Near Sync as this has the kind of functionality you may be looking for where if you accidentally delete an archive, you can recover it from EV Near Sync It also would serve another purpose by replicating your data for events such as DR. You can find more information about the product here: http://www.quadrotech-it.com/products/evnearsync/

[GertjanA]

Hello Delphine,

Deleting an archive is a one way operation. As soon as you click yes, and EV is not in backup mode, it will start deleting the items in the archive. As you have seen, the Archive will be 'marked for deletion'.

The only way I know to revert this is to change a column in SQL:

find the row in SQL, in the Directory database, table Archive with ArchiveStatus column = 4, and change the value back to 1

This will 'return' the archive status to 'available'. Items that have been deleted will be deleted...

Now, if you find out a day later, and the archive is gone, the only option you have (as far as I know) is to do a full recovery of the backups (to a DR setup) and then export the archive from there, then import it back into the 'live' EV.

The 'safe' way could be to first export the full archive to PST's, delete the archive from EV, and if it was removed correct, delete the PST's, or, when it was removed in error, create a new archive, import the PST.

I think....

[Rob_Wilcox1]

You are correct, the items and the archive will be deleted by the storage service starting straight away after you click on the 'yes' to confirm the operation.

If you do a 'huge error' then you'd have to either :-

a/ Restore the entire environment to an off-network lab, and then export the archive you have deleted to PST, and then re-import that in to your production environment.

b/ Investigate / Purchase additional helpful technology like EVnearSync from QUADROtech.  That can keep deleted data on a replica of your storage, for a period of time, allowing for recovery to take place in the situation you mentioned.

[JesusWept3]

More can be read about recovering an individual archive here: http://www.symantec.com/business/support/index?page=content&id=TECH48829 Also another thing, when in doubt of deleting an archive, export it to PST first and then do a delete

[DelphineFR]

thanks all for your feedback, the restore to another EV seems to be a safer solution, maybe a little hard, but in case of emergency could it be done with a pst extract. If I want to do a backup on another "architecture" Shall I have to restore both SQL and Enterprise vault archicteture? For now we have 1 server SQL, and 1 Enterprise vault server. And we use the agent of netbackup to save all the package. So it's mean, at least one server with both SQL role and EV role?

[Rob_Wilcox1]

In a lab environment sure they can be on the same server..  I mean you're asking if for your recovery exercise can SQL and EV be together on one machine?  Yes.  I wrote an article about labs, take a peek that it might be interesting.