Exchange 2003 Mailbox Recovery

Posted by on September 1, 2006

Today I recovered a single mailbox from backup tapes on an Exchange 2003 server. The user had been deleted from Active Directory. The mailbox had passed the retention time on the server and been purged from the Exchange database.

I found very very minimal documentation on how to do this, it was so sketchy that I was almost afraid to try this.
We only have a single Exchange 2003 Standard server, and I believe that its a little bit simpler if you have Enterprise or more Exchange servers. So, for those of you in the same boat, here’s how to do it.

First, and I cannot stress this enough, make sure that your Mailbox Store is such that “This database can be overwritten by a restore” is NOT checked. You should probably make sure that your Public Folder Store is set the same. Just in case.

Now, right click on the server and select New -> Recovery Storage Group. Create the logs and system paths in locations that have sufficient space to hold the .edb and .stm files for your restore.

Right click on the Recovery Storage Group (RSG) and select “Add Database to Recover”. Select the Mailbox store.
Make sure that this store is not mounted (not your live store – you can leave that running), and that it is set to allow overwrites by restores. I believe this is the default.

Now, on your Backup software (we use Veritas BackupExec), browse to the Information Store and select only the mailbox store to be recovered, not the Public Folder Store. Make sure that in your options you select that this is the last backup to restore and not to mount the store when finished. Run the restore. For me this was the scary bit. The documentation was lacking the phrase “Don’t worry, Exchange knows to make sure the restore will go to the Recovery Storage Group, NOT the live Mailbox Store”

Once the restore is complete, mount the store in the RSG. If Exchange thinks that there are still further restores to occur, you can use eseutil /cc to finalise the store and allow it to be mounted.

Now you can use exmerge to dump out the mailbox(es) from the RSG to a PST file. Unless the useraccount has been removed from AD.
If the user account has been removed, then you have to recreate the account. Before you do that, check the exmerge.log file as it will tell you the GUID of the mailboxes that it can’t find accounts for. You have to go through to the point of selecting mailboxes to action for that information to be written.

The lines in Exmerge.log will appear something like this:
[11:39:13] Error! Cannot identify the user with the msExchMailboxGuid \C1\A7\98\CE\B8\CF5J\99\E1\B1\28\8C\7D\EFj. The legacyExchangeDN is /O=COMPANY/OU=EXCHANGE ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=AUSER.

Note the almost but not quite hex pattern listed. This is the important bit.
Each mailbox has a hex guid. Each mail enabled user has a property which gives their mailbox guid. You need to convert this to proper hex.

 \\C1\\A7\\98\\CE\\B8\\CF5J\\99\\E1\\B1\\28\\8C\\7D\\EFj

First, break out the couplets from each group

 C1 A7 98 CE B8 CF  5  J 99 E1 B1 28 8C 7D EF  j

Only the first two characters in any grouping are Hex, any following characters should be treated individually (Note that the 5 and J (case IS important) have been split.)
Now, take any non-hex characters and get the hex value for that ASCII character from http://www.asciitable.com/ :

 C1 A7 98 CE B8 CF  5  J 99 E1 B1 28 8C 7D EF  j
 C1 A7 98 CE B8 CF 35 4A 99 E1 B1 28 8C 7D EF 6A

UPDATE: If the leading \ is missing, treat the first group as individual ascii characters!
UPDATE2: I’ve written a tool to do this for you!

Now you need to use a tool such as ADSIEdit.msc to change the msExchMailboxGuid property on the recreated user account. Synchronise your domain controllers and run ExMerge again, this time the mailbox should be available to dump out, complete with the items from the Dumpster (if the user killed everything in their mailbox before leaving the company).

Tags: , , , , , , ,

Comments (131)

  • I’ve trying to convert this for 2 days. Can you help?
    \B0\FAYA\3B\28\81F\85\EBE\81\D8bq\F3

  • Thanks a lot man,
    I got to the point where I read the guid from the exmerge log, but I was stuck with the format, it didn’t fit the pattern.
    I really appreciate your guide on this, and your hex-tool is a welcome helping hand in a scenario like this!
    Keep up the good work !!

  • Fantastic work…helped me immensely….was finding the steps to do this difficult to find anywhere else!!

  • Thank you very much for this utility and the onfirmation on here. It has helped us trememndously when we had problems with our CEO’s mailbox.

    Keep up the good work

  • YOU ROCK!!!! I CAN’T SAY IT ENOUGH! With an ill timed server upgrade to new hardware and then suddenly deciding to also change to VMWare ESXi and Server 2008/Exchange 2007, I have been basically down for about 2 weeks now. The catalyst to cause all of this was that my old server took a massive dump and would no longer let me log in. All I had was a backup of the RAW DB files. To make a long story hopefully shorter, it was looking like my only option was to spend hundreds of dollars to purchase software to convert the RAW DB files from 2003 to Exchange 2007 OR lose all my e-mails, contacts, hundreds of tasks, calendar appointments, etc.

    Thanks for saving my @** with your article and this time saving tool! I owe you one big time.

  • Excellent work!! I’ve been busting my a** to recover an old mailbox, this worked like a charm πŸ™‚

  • Great stuff.
    Saved my arse when trying to restore some 20 odd mailboxes deleted 2 years previously which were needed for legal reasons.
    Never listen to helpdesk when they say they export emails accounts to pst before deletion..

  • hi,

    thanks!, I had to recover deleted AD accounts on a separate domain mounting backup as regular database and reconnecting mailbox to any user, then dumping with exmerge.
    With this I can go faster, thanks!

  • Very nice work, helped me recover several boxes that were deleted months ago. I ran this several times without issue but all of a sudden I can’t do this anymore. I can get the user’s mailbox to show up in exmerge using the guid trick but when I try to export the data to a PST I get the following error:

    “Error opening message store (MSEMS). Verify that the Microsoft Exchange Information Store service is running and that you have the correct permissions to log on. (0x8004011d)”

    Any idea’s?

    I checked all my permissions and that doesn’t seem to be an issue.

  • The RSG is referenced totally seperately from the main store – a user will still connect to their mbox on the main store.

    Does this mean that when I edit the GUID using the AD editing tool, I’m only editing it *for the RSG* and not for the main store? I have a situation where a server had to be rebuilt from scratch and users have been using the new system for several weeks. I have a backup from before the crash (from the OLD server) and want to extract mail from it, but I don’t want to break the new server and the accounts on it (and I really don’t want to lose all their new email that has come in during the last few weeks). Can I do this? (Sorry to ask general help questions here, just hoping someone will stumble upon it as this is the best information I’ve found online about actually using exmerge!)

  • The msExchMailboxGuid that is attached to a user object is the same for the main store and the RSG. If you edit msExchMailboxGuid, then the user will become detached from their mailbox – IIRC Exchange will just create a new empty mailbox next time it should be accessed using the whatever msExchMailboxGuid is set to as a reference.

    Restoring a store to the RSG will not overwrite the main store. Users will continue to access the main store. What I would suggest is that you take all the msExchMailboxGuid exmerge doesn’t recognise from the RSG and create dummy accounts so you can dump the mail out then re-import it to the actual accounts.

  • You’re a legend, I want your baby.

  • I had all this info from various websites and combined it for use myself, but it’s nice to see that someone has compiled into a web page for everyone’s use.

    Good stuff you are a legend !!!!!

  • I made the old Hex according to what is explained above, but the Hex var. that is now (the new account) active, is way much shorter then the one I get from converting the old one from the Recovery Storage Group. When I look it’s an Octet String.

    Can this be right, I’m not sure. Can anybody help me out?

  • I had used your GUID trick 2 years ago but had forgotten about it until I saw those familiar backslashes in my exmerge log. Then it all came rushing back. Saved me AGAIN! This information is indeed priceless.
    I love you man!

  • Amazing! I could not find anything quite as helpful as this page! Thank you πŸ˜€

    I have been working non stop the past 48 hours (ok I slept 5 hours last night) as one of my client’s SBS servers died… Suffice to say, when I found out there was no system restore backup, I literally spat the dummy… It’s been screw around followed by screw around, and if it wasn’t for people like yourself, I would not have had the success I have had so far! Thankyou – and everyone else who has contributed here πŸ™‚

  • Excellent article, thanks very much! Definitely the most useful page on the web for people in my unfortunate situation.

    I am comparitively new to Exchange 2003 restores, and was shocked by how complicated and poorly documented it is. I was recovering a mailbox from backup for a user whose mailbox had been deleted several months previously. All exchange attributes had been removed from the user. With the help of your guide I managed to get it out to a PST!

    For anyone who is as clueless as me, here are some additional tips:
    Make sure the account (either the user’s original account or a dummy account you create) has a mailbox
    Ensure the mailbox is in the same mailbox database as the one the backup was taken from

    Thanks Again!

  • Sure am glad I ran accross your article. I have been backing up my Exchange server for years and never had to restore it until today. I had a single mailbox that got waxed and had it not been for your article I believe the mail would have been lost.

    I looked for an hour through microsoft mumbo jumbo and couldn’t make heads or tails of the instructions. Then I came across your site. Your instructions were concise and understandable. Thanks a million! If the girl who lost her mailbox knew what I am writing here I am sure she would say thank you too!

    Keep those how-to’s coming.

  • After scavenging the web for hours upon hours, I found your article. You literally saved my a**. Thanks so much. Is the Paypal link above still valid? If so, I plan to buy you that beer πŸ™‚

    Thanks again!

  • Youe are my hero.. I like the converter, it safes a lot of brainpower πŸ˜‰

  • Thanks so much for these instructions. You saved my ass.

  • Outstanding! This guide saved me a lot of time. MS should use this in their documentation, as this is a *real* help.

    Thx!

  • My good sir, you are a true Hero!

  • Thanks, your online converter saved the day. I had gotten to that point from deciphering various Microsoft KB articles, but I’ve never been good at math, and that had me perplexed. Your online hex converter was a life saver.

  • Thanks, a “beer” is on the way. Microsoft’s answer was to use ADSIEDIT to make the RSG a “regular” information store, then create a user account. Mount the RSG, and associate the disconnected mailbox with the user you created. They didn’t mention, however, that any delayed mail users had created will send again. That little surprise was scary…

    Thanks, you are a lifesaver.

  • I just used this and while i had to make a few tweaks here and there, this worked insanely well, i cant give you enough kudos right now man..

    legendary, i felt so badass converting the hex and editing the guid with adsiedit! haha

  • The “UPDATE: If the leading \ is missing, treat the first group as individual ascii characters!” absolutely saved me. I was banging my head against the wall for hours trying to get 16 pairs out of a GUID and couldn’t until we found this.

    Thank you!!!

  • Tell me where to send a crate of beer…this really has saved us a world of pain..there are some releived people here at the moment. Fantastic easy to follow instructions. Our scenario was to restore from 4 -5 years ago off LTO1 tapes, users long since moved on. Thanks

  • Hey Guys. Procedure works great and now ExMerge exports the required purged Mailbox to PST but my only problem is that the 1.25Gb PST file is not recognized by outlook. I get the message “user.PST is not an Outlook data file (.PST)”. I tried Scan PST but same error. This is happening only for mailboxes that were purged. Any help would be greatly appreciated.

  • Thanks for the conversion tool, it worked perfectly.

    But my problem has still not resolved.
    Created a new account and edited the MsExchGuid after converting and ran exmerge,it now says legacyexchnageDN error and nothing happens.

    Any suggestions??

  • (From the future 2017AD) This is STILL a killer trick to add to the bag. Well played, sir. The I.T. Gods have you on the list. Thank You.

  • Hi Mike, first thanks for the work aruond , still dont understand why Microsoft didnt change it , because your are able to select domain local security groups when grant send-as permissions.But i got a small other issue with exchange 2010, i am using the domain local security group to set grant permissions to a shared mailbox. for a unknow reason the attribute msExchDelegateListLink of the shared mailbox does not get filled in. so users who are member of that group does not get the shared mailbox automatically in their outlook 2010. if i add the permissions per user the attribute get filledin within a few minutes and trhe users sees the shared mailbox in their outlook after 3 min. any help is greatley appriciated

Do you have anything to say?

Powered by Wordpress and Stripes Theme Entries (RSS) | Comments (RSS)