Restore Those Lost E-Mails

Recovery Manager lets you do large-scale, store-level Exchange backups, while still helping locate and restore individual messages.

• By Chad Todd
• May 01, 2005

Indeed, backup and recovery are a fact of life for the Exchange administrator. There are two types of Exchange backups, store-level and message-level (a.k.a. brick-level), each with their benefits and drawbacks. Store-level backups back up the database and message logs while brick-level backups back up each individual message.

Quest Recovery Manager (QRM) gives you the best of both worlds. It works with your backup software to give you quicker store-level backups, while still being able to easily restore individual messages. QRM can recover selected messages, files attached to selected messages or a folder and all the messages it contains. It supports full, differential and incremental backups. The software you use to back up your Exchange Server will dictate which method you should choose.

Recovery in Store
Store-level backups are much quicker than brick-level backups. They're great for recovering a failed Exchange Server, but not so great for individual messages. To recover an individual message in Exchange 5.5 or Exchange 2000, you have to build a recovery server to mimic your production server.

This means installing Exchange and its service packs, restoring the database and logs to the recovery server, then using a tool like Exmerge or Outlook to connect to the recovery server to export the mail to personal storage (PST) files. This is a time-consuming process to say the least.

Thankfully, recovery is greatly improved in Exchange 2003. You can use a Recovery Storage Group on your production server instead of building a recovery server. However, you still have to use a tool like Exmerge to retrieve the missing mail. Exchange 2003 Service Pack 1 lets you restore an entire mailbox without Exmerge, but not an individual message.

Brick-level backups avoid all of this. Open your backup software, choose the message to restore and voila—the message is back. Brick-level backups use the Messaging API (MAPI) interface to log on to each mailbox, so each message is enumerated, read and backed up. The downside is, by independently backing up each message, brick-level backups lose the single instant storage that Exchange provides. Consequently, the backup takes a lot longer and uses a lot more disk space than just backing up the store itself.

You can also use QRM to work from an off-line copy of your database. The program can access backup media from Windows Backup (NT 4.0, 2000 or 2003) or Veritas Backup Exec (7.3, 8.6, 9.0 or 9.1). QRM catalogs the tape and restores the database to a specified folder. This method doesn't require that you use backup software for recovery.

Figure 1. Quest Recovery Manager walks you through the process of restoring messages on your Exchange Server. (Click image to view larger version.)

I used QRM to restore mail from an Exchange 2003 server using Windows Backup. It took about 20 minutes to extract the 3GB database and restore the mail. I also used QRM against a copy of my database restored to an Exchange 2003 Recovery Group. In both cases, QRM performed flawlessly on the first try.

Another approach is to copy the Exchange message files from your production server. You would do this when using QRM to restore messages from a failed server. Then you would have QRM perform a hard recovery on the .edb file if the log files or .stm files are missing.

If you're using a backup utility other than Windows Backup or Veritas Backup Exec, this is the preferred recovery method. Have QRM access a database restored to an Exchange 2003 Recovery Storage Group, add the database to the recovery group and then restore it with your backup software.

If you're not using Windows Backup or Veritas Backup Exec and you don't have Exchange 2003, then you'll have to use a recovery server to restore your mail. This is because Exchange 5.5 and Exchange 2000 don't provide Recovery Storage Groups. To account for this, QRM provides a feature called Exchange Server emulation. It makes a server other than your real Exchange Server appear to be your Exchange Server. You can then restore your Exchange backups to this server and use QRM to retrieve your mail. However, you can't use Exchange Server emulation on a machine that already has Exchange installed.

The QRM Exchange Server emulation supports backup products from Veritas, HP, Legato, IBM, CommVault and CA.

I highly recommend QRM as a replacement for brick-level backups and as a disaster recovery tool. Quest provides great documentation, but you probably won't need it. I found QRM to be easy and intuitive.

QRM makes it easy to search for missing mail without having to know its precise location. All in all, QRM is a helpful addition to any Exchange administrator's toolbox.