Restore of a users deleted archive

[bjorn_b]

I have a scenario from an EV server that looks like this:

Someone - 

1. re-imported user's archived data back to the exchange server
2. Deleted the user's archive in Enterprise Vault
3. Found out that the user's archive wasn't successfully imported back in Exchange

At the same time, archiving has NOT been turned off, so for the days (now weeks) after this import was done, the server has still archived other user's data.

Is it possible to get hold of this user's archive somehow, without destroying everything that has been archived after that point of time?

/bjorn

[Simon_B_ · Accepted solution]

Ok this is probably not the easiest way but it should work:

• Restore your EV environment from the last Backup before deleting the User data into an isolated environment not connected to your production network
• Export the user's archive into one or more PST files in this restore environment
• Import the PST files into your production ev system. You can choose to import them into a specific subfolder in his mailbox, e.g. called old-archive which then would contain his old archive structure and shortcuts to the old elements

[bjorn_b]

So what you actually mean is: Install a second EV server with its own Site and with it's own SQL and export to this server?

[Simon_B_]

Yes you would need a second server and then perform the desaster recovery process to recover the ev state from your backup where the archive was not yet deleted. You then can export the archive from this isolated ev environment into PST files, and import these pst files directly into the archive on your production ev system.

So basically you are getting the old archive out of your backup and import the elements into the new archive on the production system.

[bjorn_b]

I thought about that solution. 

Wonder if there is any documentation on such a scenario... 

[Simon_B_]

Sure, just look into the documentation folder of you EV installation sources into the administrators guide, there is a recovery section which should explain such scenarios.

[MarkBarefoot]

As Simon said, this is the only way to resurrect a deleted archive - not great. You could also look in the Utilities Guide and read about EVSVR as that may help fill in any gaps. I say "may" as there are some instances where the current version of EVSVR won't be able to fill in the gaps - this is something that is being looked at currently.

[FreKac2]

Would still be an issue if the archive contained items that was unique for the user archive, since as far as I know it will then be deleted from the partition/s (no one left that share that item). So I would at least do as Simon suggest and restore/create a "dummy" environment and pull the data out.

[AndrewB]

i've been there before, frekac...you're only option is to restore your full ev environment (databases, indexes, vault stores) to another server (lab, offline vm, or something) and then export the data you need.