ngallman Posted February 13, 2009 Report Share Posted February 13, 2009 We have a forensics situation where I really need to simply EXTRACT the PRIV.EDB files from our Exchange Server 5.5 backup sessions! Is there ANY way; through the use of Retrospect OR a 3rd party utility? Here's more info: Retrospect 7.0 Multi-Server Edition w/Exchange opt Exchange Server 5.5 No individual mailbox backups (hind-site is 20/20) I can browse the sessions in the backup set, choose the "Information Store", see the 15.5Gb Information Store file, but the "retrieve" button in the backup-set properties box remains greyed out; unlike performing the same steps above when choosing a document simply backed up on a particular volume. I can't bring down our mail server, restoring it's entire state for each day in question, for the sake of obtaining the contents of ONE mailbox for a range of days. Help! How can I simply extract the Exchange 5.5 EDB files from the exchange backups and place them in another folder in order to read the EDB files using my Ontrack Tools?? Thanks, Nicholas Quote Link to comment Share on other sites More sharing options...
Mayoff Posted February 13, 2009 Report Share Posted February 13, 2009 If you used the Exchange Add-on for backup, then it uses a Microsoft API for the backup and restore of exchange. The individual .edb files can not be restored. To do a restore, you must do a full restore of the storage groups. Quote Link to comment Share on other sites More sharing options...
ngallman Posted February 13, 2009 Author Report Share Posted February 13, 2009 This is what I was afraid of. Are there ANY utilities that can read the Retrospect RDB files directly in order to perform this extraction? Or is through Retrospect the ONLY way? I'd like to remove the burden from myself and simply hand our tape libraries (14 members per tape backup set) over to our lawyers. Is this pointless, or could they have any success getting the Exchange data directly from tape? Or... am I stuck having to restore the entire server one instance at a time? Does DANTZ by chance sell a tool that I/our lawyers could use to read the RDB files directly? Thanks, Nicholas Quote Link to comment Share on other sites More sharing options...
Mayoff Posted February 13, 2009 Report Share Posted February 13, 2009 Only Retrospect can read the backup data. You may need to setup an identical parallel exchange environment and do a restore of the exchange server. If you do mailbox level backup, you can easily restore mailbox data to any mailbox. Quote Link to comment Share on other sites More sharing options...
ngallman Posted February 13, 2009 Author Report Share Posted February 13, 2009 OK. Thanks for your help. I already have a parallel Exchange Server that I run in a VMWare environment. I'll use this server to run full-system-state restores to. Thanks again, Nicholas Quote Link to comment Share on other sites More sharing options...
ngallman Posted February 16, 2009 Author Report Share Posted February 16, 2009 You may need to setup an identical parallel exchange environment and do a restore of the exchange server.quote] Hi. I tried restoring to a parallel system and received the following error: + Executing Restore database from Backup at 2/16/2009 1:10 PM (Execution unit 1) 2/16/2009 1:10:04 PM: Connected to billing_mail To volume Information Store on billing_mail... - 2/16/2009 1:10:04 PM: Restoring from Mail Servers Restore type: Full T-7: MapError: unknown Windows error -1,073,741,819 T-7: TWDBExchangeServer55::StopRestore: HrRestoreRegister failed, winerr -1073741819, error -1001 T-7: MapError: unknown Windows error -1,073,741,819 T-7: TWDBExchangeServer55::StopRestore: pHrRestoreRegisterComplete failed, winerr -1073741819, error -1001 2/16/2009 1:10:45 PM: Execution completed successfully Duration: 00:00:35 (00:00:31 idle/loading/preparing) Any ideas??? Does Retrospect require that the physical server name be the same as well? Thanks, Nicholas Quote Link to comment Share on other sites More sharing options...
Mayoff Posted February 17, 2009 Report Share Posted February 17, 2009 Everything about the server must be the same. That is a Microsoft requirement, not a Retrospect requirement. Quote Link to comment Share on other sites More sharing options...
ngallman Posted February 20, 2009 Author Report Share Posted February 20, 2009 Decided to add a backup routine for Mailboxes as well, however I get an error stating "Exchange Mailboxes was Empty". This has me baffled because I'm using an account that: a. Has an active exchange account b. Has logon as service rights c. Is a member of User, Domain Admins, Administrators, backup Operators, Enterprise Users d. Has 'Services account' permissions AND 'Admin Permissions' permission in Exchange 5.5 administrator c. Can logon to ANY mailbox via OWA d. Can browse all mailboxes from the Volumes Database window in the Retrospect. Any ideas?? Thanks, Nick Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.