Restore single users deleted items whenrecovery of deleted items is not enabled

[matshako]

Hi
Recovery off deleted items was not enabled, and a user deleted 3 gb of mails from the archive. Is it possible to recover these mails without setting up a complete EV-installation side by side with the production one.

I found this is an old case: "Simplest solution is to connect to the users Vault Store database, go to the JournalDelete table and restore the items listed in JournalDelete back to their original locations from backup and then run a storage tool such as DVSChecker against it."

However that doesn't help me much with further details. Does anyone know how to do this?

Thanks

[JesusWept3 · Accepted solution]

Run a SQL query against the journaldelete table and filter it by the users archive I'd and it will list out all the savesetid's deleted In the last month or so, get them from backup then use EVSVR with the repair option

[Maverik]

Hi, was this resolved? Were you able to write the sql query OK? One thing as well you need to be aware of with EVSVR is that it only repairs the Vault Store Database. So if any folder references were also removed by the deletion of items EVSVR will not fix up everything. 

[matshako]

Hi

What if the mails aren't in the journaldelete still? As this table only keep 30 days of deletion.

[Percy_Vere]

If the data is no longer in the Journal Archive then you have no other alternative than building a test environment that has the same ev servers naming convention and then restore the users mailbox from backup. Export the archive to PST and then import it into the live environment.