Recover deleted emails from a database-level backup

[albracco]

The Situation: Anti-Apam software for some reason identified some legitimate emails (payroll stubs) as a SPAM outbreak and went through the INF Store and deleted all of the attachments on these emails. Arcserve document-level backup is run every Friday, but they weren't rotating tapes so the last doc-level backup with the original emails has been overwritten. They do have database-level backups, so I can restore the edb, but we can't put them back to 2 weeks ago and lose all their current emails.

The Questions: Never had to do this so bear with me... I know I can restore the .edb files - what do I then need to do to access the individual mailboxes to hopefully be able to export those specific emails to a .pst for each user? Do I have to go through the whole process of setting up Exchange on a server and replicating the domain/AD/Exchange environment? Are there tools to access the mailboxes directly from the .EDB file, output to a .pst and then pull the emails I need out of the .psts? Is there some better way or some utility to make this less painful?

Any suggestions will be greatly appreciated...

 

[ntinlin]

2 options

1. Create a recovery storage group and restore each database in turn to it then use exmerge to dump out what you need. This is free but tedious and you will need to have enough space somewhere on your exchange server to restore the database and logs. Exmerge isn't installed by default if memory serves, it is part of EXAllTools or can be downloaded separately.

2. Use something like Kroll Ontrack Powercontrols or Quest Recovery Manager for Exchange. There are others but these are the only two I have used. Expensive but can get straight into the EDB's and dump out the entire mailbox or individual messages to PST as required.

Neill