This article discusses a typical issue you might encounter during an eDiscovery process that is caused by corrupted (bad) items in your Exchange database.
Profile gravatar of Aaron Denton

Aaron Denton

Aaron Denton has been working in IT for 10 years.He is a CCNP, MCITP, Enterprise Admin and Enterprise Messaging Administrator on Exchange 2007. Follow his blog itprostuff.
Profile gravatar of Aaron Denton
Contents of this article

As a follow up to the five part eDiscoveryinExchange series, I thought it might be helpful to provide some information for a couple of troubleshooting tips that may come in handy while working through the eDiscovery process. An issue you may run into could be due to corrupted items in your Exchange database. The corresponding error message is "This mailbox exceeded the maximum number of corrupted items." For legal inquiry, you’ll want to do what you can to ensure all possible results are included.

As before I’ll address the Exchange 2007 method of fixing as well as the improved methods in Exchange 2010.

Exchange 2007 ^

In Exchange 2007, the Export-Mailbox cmdlet will fail to execute due to bad items in the mailbox. Isinteg, can help with corrupted Exchange items by logically repairing the database.

isinteg

Isinteg is used to logically repair a database. This is most likely the cause of the corrupted items. Run isinteg -s ServerName -fix -test alltests multiple times until all bad items are repaired. The utility needs to run multiple times to take care of all items.

ServerName should be the name of your mailbox server. If you are in a CCR environment, the cluster name should be used. A list of databases on the server will be displayed, type in the number of the corresponding database you need to check and press Enter. When isinteg is finished, look for rows where the number of fixes is greater than zero. If any are not zero, run isinteg again until it does not result in any more fixes.

isinteg

isinteg

-BadItemLimit

Even after all that, you may still be getting an error about bad items when attempting to run the Export-Mailbox cmdlet. In this case, it may be necessary to include the -BadItemLimit parameter. For example, adding -BadItemLimit 10 to the end of the Export-Mailbox cmdlet would allow up to 10 bad items and still export all other items.

Get-Mailbox -Database “Ex2007MB\First Storage Group\Mailbox Database” | Export-Mailbox -PSTFolderPath C:\Temp\export.pst -TargetFolder Results -AllContentKeywords “keyword” -BadItemLimit 10

Exchange 2010 ^

There should not be a reason in Exchange 2010 to use the Export-Mailbox cmdlet for eDiscovery. Exchange 2010 fundamentally changed the way mailbox information is stored. Exchange 2007 used a schema where tables worked across an entire database. This necessitated repairing an entire database when corruption may only be related to a single mailbox. Exchange 2010 now uses tables that are specific to each mailbox.

Because of this change in architecture, repairing a mailbox is much less time consuming. New-MailboxRepairRequest cmdlet (see alsoNew-PublicFolderDatabaseRepairRequest for Public Folder specific options). This one cmdlet replaces the need to run isinteg. The new cmdlet also does not require that the database be dismounted and taken offline. This tool can be run while user’s are still using their mailboxes. As with every cmdlet in EMS, there are many parameters that can be used to control the scope. You could repair a certain type of error on one mailbox or repair all error types for an entire database.

To repair all search folders for an entire database use the –Database and –CorruptionType parameters:

New-MailboxRepairRequest -Database “Accounting Dept” -CorruptionType SearchFolder

Exchange 2010 - 1 New-MailboxRepairRequest Fix Search Folder Corruption One Database

Exchange 2010 - 1 New-MailboxRepairRequest Fix Search Folder Corruption One Database

To repair all corruption for a mailbox use the –Mailbox and –CorruptionType parameters:

New-MailboxRepairRequest -Mailbox JohnDoe -CorruptionType AggregateCounts, FolderView, ProvisionedFolder, SearchFolder

Exchange 2010 - 2 New-MailboxRepairRequest Fix All One Mailbox

Exchange 2010 - 2 New-MailboxRepairRequest Fix All One Mailbox

To see the results of the repair request, look in the Application Event Log for event 10047 (initiated), 10059 (complete database repair), and 10048 (successful completion with no corruptions remain).

Exchange 2010 - 3 Application Events 10047,10048,10059

Exchange 2010 - 3 Application Events 10047,10048,10059

Take part in our competition and win $100!

Share
0

Related Posts

0 Comments

Leave a reply

Your email address will not be published. Required fields are marked *

*

CONTACT US

Please ask IT administration questions in the forum. Any other messages are welcome.

Sending
© 4sysops 2006 - 2017

Log in with your credentials

or    

Forgot your details?

Create Account