Restoring deleted items

[Paul_E]

To cut a long story short I have a situation where a Users Archive has been deleted by accident. The user still has all their EV stubs within Outlook but opening produces the expected

GetOnlineAttachmentFileSize 0xC00420C8

Luckily we also have a Journal Archive from which I can restore the missing items. The problem I have is several hundred restored items with no quick way of getting them back into the folders they belong.

I could just import these all in bulk to the users newly created Archive but that isnt ideal. Before I resort is to that is there a way  (EWS / Powershell perhaps) that I could scan the mailbox for IPM.Note.Enterprise.Vault Shortcut and match to to the IPM.Note that I have restored from the Journal and copy it to the same folder ?

EV Version is 9.02

[Rob_Wilcox1]

There isn't currently a way that you can what you're asking... but what version of Enterprise Vault are you on?

If recent, there might be a way for to recover the deleted items from their vault (and then the existing shortcuts will still work)

[GabeV]

Hi Paul,

I think you need to perform a DR process to recover the user's archive, export the archive from the DR environment to a PST file, and import the PST to the newly user's archive creating the shortcuts in the mailbox. Using a PS script to match the EV shortcuts from the user's mailbox with the journal archive, I think it wouldn't work since each archived item has a different SSID and you might need to use the EV API for that.

I hope this helps.

[Paul_E]

Thanks ROB & Gabev,

EV Version is 9.02

I had thought DR might be the only way, the issue with DR is having to find space to restore the entire environment before I can extract the PST.

[Rob_Wilcox1]

Ahhhh okay 'whole archive'. Sorry missed that part.

Your only solution is disaster recovery, export that archive to PST. Delete the users current shortcuts, and reimport everything - creating shortcuts along the way.

[GabeV]

For the DR process in Enterprise Vault 9.0.2, you need this technote and PDF:

Symantec Enterprise Vault 9.0.2 - Administrator's Guide
http://www.symantec.com/docs/DOC4675 (Page 335, Chapter 24 - Recovery)

[Paul_E]

Thanks All. 

In regard to DR, we have 1 EV Server and 1 SQL. 

If I were to restore the SQL as is, could I get away with restoring the EV Server with only the drives that contain User Archives ? I only say that as the Journal Drives are very large and if I dont need to restore those it'd cut down on time and space !

The other thing I'm not quite certain on is whether I need to present both Servers to the network in order to restore an Archive do they just need to be able to talk to each other ? I ask as we have no test environment and I would have to restore the VM's into a live environment but renamed with different ip's or on a different subnet.

[GabeV]

Paul,

What's the Vault Stores sharing level? If you are sharing at the Vault Store Group level, you need to restore everything; if you are sharing at the Vault Store level, you could restore the mailbox partitions and remove the Vault Store information related to the Journal archives from the Directory database. Of course, I am assuming that the mailbox archives and journal archives are in separates vault stores. Otherwise, the Storage Service will not start in the DR.

If you restore the VMs in a different subnet, you just need to update the local hosts file in the EV server and SQL to reflect the correct IPs and make sure both servers can communicate with the DCs for authentication, etc. Also, remember to disable the archiving tasks in the DR.

[Paul_E]

Ah ok yes they are set to Share as Group level so its going to need to be the lot. 

I guess even though they are in Group level there is no way of getting those stubs to point to the items in the Journal Partition ?

[GabeV]

Paul,

Unfortunately, you can't because you might have cross references between the Vault Stores: archived data in one Vault Store and archives from another Vault Store pointing to that data.

[Paul_E]

Thanks Gabev,

I think DR is going to be the only realistic option we are just trying to work out how we are going to write back our EV backups from Netbackup to servers on a different subnet.

The only way I think we can do it is to Clone both VM's (EV and SQL) as they are, then organise some EV downtime over a weekend and restore back to the Clones, export the PST's and shut them down before Monday morning.

[GabeV]

You're very welcome. If you have a VM snapshot where the archive still exists, that would be the easiest (and fastest) way to do it. And remember to disable the archiving tasks in this EV & SQL cloned environment. You really don't want data being archived on this temporary system :)

[A_J1]

Hello Paul,

You can also have Look on the article About disaster recovery of an Enterprise Vault site - http://www.symantec.com/docs/HOWTO54564 

[GabeV]

Hi Paul,

Do you have any updates on this thread? Do you need more assistance regarding this topic? If not, please mark the post that best solves your problem as the answer to this thread.

[Paul_E]

Thanks for the replies. I think I need to log a post within the Netbackup forums now with a bit of assistant in restoring a Enterprise Vault policy backup.