- Top 10 new features in Windows Server 2012 R2 - Mon, Jun 10 2013
- FREE: Unitrends Enterprise Backup Free Edition – Hyper-V and VMware backup - Tue, Nov 6 2012
- FREE: Remote Desktop Manager – A powerful RDP client - Wed, Sep 19 2012
If your inquiry will be done on a live database, this step of the process is not necessary. However; there are several scenarios where you’d want to perform the inquiry on a snapshot of the mailbox database from a previous point in time.
Exchange 2007
Create Recovery Storage Group
The first step is to use the Database Recovery Assistant to create a recovery storage group. This will provide a place to restore the database from DPM.
In Exchange Management Console (EMC) click Tools, Database Recovery Assistant, and Open Tool. If you have clustered mailbox servers, this should be done from the active node. Click Create Recovery Storage Group and then select a database to associate with and click Next. Specify appropriate file paths for the restored database and click Create the Recovery Storage Group. Review the details and click Go back to task center. There will now be new options available in the Manage Recovery Storage Group category.
Exchange 2007 - Create Recovery Storage Group
Exchange 2007 - Troubleshooting Assistant with additional options in Manage Recovery Storage Group
Restore Database to Recovery Storage Group from DPM
Next, the database with the appropriate information should be restored. In DPM, this can be done by opening DPM Administrator Console and clicking Recovery. Locate the appropriate date and source by selecting the calendar date and backup medium. Right click the database and select Recover. In the Recovery Wizard, choose the option Recover to Recovery Storage Group. Click Browse to select the mailbox server. Type in the name of the storage group and database. Storage group name by default is Recovery Storage Group. Database name will vary but should match the associated database name. On the next screen, disable Mount Database when recovery completes and click next. On the Summary screen click Recover. Recovery time will depend on the size the database.
Use Database Recovery Assistant to mount restored database
At this point the database has been restored to the Recovery Storage Group and is ready to be mounted. In Database Recovery Assistant, click Mount or Dismount Databases in the Recovery Storage Group. Select the dismounted database and then click Mount Selected Database. Click Go Back to Task Center.
Create mailbox for the search results
At this point, you’re nearly ready to begin searching the database to move email based on keywords. Prior to doing so, we need to complete the final preparation of designating which mailbox will contain the results of the search. I’ve seen some literature in the past that suggests a folder be created in the designated user’s mailbox that will be reviewing the results. This would be appropriate for internal investigations that may not lead to the need for eDiscovery. However; when legal discovery is necessary, I feel it’s best to have a dedicated mailbox and possibly even a dedicated mailbox database for storing nothing else.
Exchange 2010
Create Recovery Database
Similar to Exchange 2007, a place needs to be prepared to restore the database from DPM. Creating the recovery database can be done through Exchange Management Shell (EMS). Type in the following command all on one line to create a place for the recovered database.
New-MailboxDatabase -Recovery -Name RDB2 -Server vEx2010 -EdbFilePath "E:\Recovery\RDB2\RDB2.EDB" -LogFolderPath "E:\Recovery\RDB2"
Restore Database to Recovery Database from DPM
Restoring the Exchange 2010 database as a Recovery Database is nearly identical to the process described earlier for Exchange 2007. The wizard in DPM only has different labeling of options. Choose Recovery Database as the restore option and otherwise follow the same directions and discussed earlier for Exchange 2007.
DPM 2010 Recovery Wizard
DPM Mailbox Server and Database Name specification
Mailbox for Search Results
Exchange 2010 has a built in Discovery Mailbox meant for doing legal discovery. It is no longer necessary to create a special mailbox to act as a secure place to store email matching eDiscovery search parameters.
At this point, the recovered database is ready to be searched. In the next post I’ll discuss how to perform the search by keyword and ultimately provide those search results to another party.
