MS Exchange 2010 Public Folder missing emails
Hi,
Please bear with me as this is the first time I have posted on here and I am relatively new to Exchange Server:
Last week (7th of August at 2am) I received an email from the Exchange Server stating that one of our public email folders was reaching its size limit. From memory later that day I went onto the Exchange Server and changed the properties of the specific
public folder not to have any limits. Public Folder Management Console/ browsed to specific public folder/ went into the properties and then the limits tab and unchecked the tick boxes.
This morning a user has alerted me to the fact that there are only a handful of emails in that folder now which start from early morning on the 7th of August. Everything before this has disappeared. I have gone onto the main users of this public folder to
see if I could recover any possible deleted items but no joy there. I have opened the 2 backups I have of the server and the public folder is the same on there (the backups are too recent to show the public folder before the 7th). I have also tried to open
the .edb file in some external software and have used ExFolders but no joy there either. I am now left with hardly any emails in that folder and not knowing A) How it happened and more importantly B) If I could get them back.
Any help will be extremely welcome!
Running: MS Server 2008 R2 with Exchange 2010
August 14th, 2012 8:00am
Maybe when you were on that limits tab, you accidentally configured an age limit for the items in the folder:
http://technet.microsoft.com/en-us/library/bb124450.aspx
I'm not sure if you can get them back, or not. If you have deleted item retention configured for the folder or store, you could use the DumpsterAlwaysOn registry value in Outlook, and see if you can recover them that way.Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
Free Windows Admin Tool Kit Click here and download it now
August 14th, 2012 9:10am
Lee is on point and to get back the missing items you would need to recover a previous copy of the database
A: to a fenced off Exchange 2007 server and a recovered DC as pre-migration and then recover via Outlook
B: to disk and then use a 3rd party product like Lucid8's DigiScope
http://www.lucid8.com/product/digiscope.asp that can open the offline EDB so that you can then Browse, Search, Export to PST & MSG or to recover directly from the offline into the production server.Troy Werelius
www.Lucid8.com
Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope
August 14th, 2012 1:35pm
Hello,
If you have backup for public folder database and you cannot find the items with Exfolders, you can create one new server, restore the public folder, then use outlook export the old items and copy that to your public folder in production environment.
Here is one related thread for you, hope can give you some help:
Public Folder Restore
http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/e8a1b12e-266c-4e9c-85a8-2766bdb26f3b/
Thanks,
Evan Liu
TechNet Subscriber Supportin
forum
If you have any feedback on our support, please contact
tngfb@microsoft.com Evan Liu
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
August 15th, 2012 4:05am
Hi,
Any updates on this issue?
Thanks,
Evan Liu
TechNet Subscriber Supportin
forum
If you have any feedback on our support, please contacttngfb@microsoft.com
Evan Liu
TechNet Community Support
August 16th, 2012 1:56am
Hi,
Sorry for the late reply!
I have checked on the users machines and they actually don't have permissions to delete emails that they didn't file in there and as there are a few users that file into the same public folder the emails couldn't have been deleted or moved from that public
folder. It looks to be more something with the Exchange that has caused it.
Unfortunately the backup isn't an option either as we only have a 2 day retention on our server backups at present, so the oldest backup I can get is actually days after the problem seemed to have occurred.
When I was looking at the limits tab for that public folder I didn't enter any limits that I recall, I'm sure I just unticked the limits completely.
As far as I am aware the retention period is 14 days. I went into EMC and wen onto the public folder database and under 'limits' its set as 14 days. I just don't understand what has happened to them? As the 14 days hasn't come around yet does this mean I
should be able to recover them?
Also just to be clear we haven't made any changes/upgrade recently so we have had this environment for a while.
Thanks very much for your help! :D
Free Windows Admin Tool Kit Click here and download it now
August 16th, 2012 12:17pm
I would try the DumpsterAlwaysOn thing as time is of the essence with deleted item retention:
http://support.microsoft.com/kb/246153
This will enable the Recover Deleted Items menu that normally only appears for the Deleted Items folder to be available for all other folders.
Then worry about the limits settings later. It may not be immediately obvious what values you are configuring, since there is inheritance from the database.Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
August 16th, 2012 12:52pm
Just to confirm would I need to run this on the actually machine that potentially deleted the items? The problem I have is all our users have access to these folders so it could be anyone so would I need to run it on every machine?
Thanks again!
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2012 3:52am
Good question - I'm not sure if this allows users to see only the items they deleted, or all of them. My guess is that you'd be able to see them all from a single PC, but I'm only 50% sure of that. You'd need to do some tests to find
out. Try it on your own first, and see if you can recover anything.Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
August 17th, 2012 8:25am
By the way, since the clock is ticking on those deleted items, I would go and increase the retention time on the PF store before doing anything else.Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2012 8:49am
I have just changed the retention from 14 to 30 days. I have performed a quick test and this shows up all deleted items for any user, so when I check it should show all deleted items no matter who deleted them. Unfortunately it is empty which means either
no user deleted the items or they are no longer available.
I think it may be a case of they are gone forever, if that is the case I can deal with that as the vast majority if not all the email that was in there exists in the individual users mailboxes. The more important question now is what on earth happened to
it to cause the email to disappear!?
Thanks!
August 17th, 2012 9:12am
Well, it's always very hard, if not impossible, to find out what went wrong when things disappear without a trace. I know everything's unchecked now (you mentioned doing so in an earlier post), but do you remember if the Age Limit was checked, either
on the DB itself, or on any individual folders, before you did all that unchecking? That is the only thing I can think of that would make them disappear with no error messages appearing. You might also try running some of the DB integrity tools
to see if there is a problem. If there is, then that might explain it - maybe an area of the disk became unreadable, and Exchange is just carrying on with what it can. Although if this were the case, you'd probably see something in the Event
Logs. If integrity checks reveal no apparent problem, then the item loss is a mystery.
Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2012 9:32am
You are 100% sure that no user deleted the mails?
Also those deleted emails do not show up in exfolders? Its diffiicult to find out now as I assume no auditing was on?
aSukh
August 17th, 2012 9:33am
Nothing shows up in ExFolders and the users can only delete items they filed there and due to there being at least 4 different users that file emails into that folder I can't see how one user has deleted them.
It must be related to the public folder reaching its size as its too coincidental to be anything else.
Unless auditing is on 24/7 then I haven't changed any settings since taking over from the previous IT Manager. Is there anywhere in particular I could look to give me any clues to what happened? Just trawl through the logs?
Cheers
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2012 9:48am
Yes, you might try looking in the Event Logs (the Application one), but the amount of trivial logging that goes in there these days will probably make it a tiresome task. You might also try ESEUTIL /g when things are quiet. Just to see if something's been
lost due to corruption. But I think you'd already know if it had - there would surely be other indications of this (backups refusing to complete, etc.).
Anyone else having problems posting today? I'm getting lots of 'Unexpected Errors' when I click that Submit button.Mobile OWA For Smartphone
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
August 17th, 2012 10:04am
Did you get any clue in app logs?
Since you cannot see items with Exfolders and don't have backup for public folder, it is hard to get items back with routine method, maybe you need use other third-party tool to help getting them back.
Thanks,
Evan Liu
TechNet Subscriber Supportin
forum
If you have any feedback on our support, please contacttngfb@microsoft.com
Evan Liu
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
August 22nd, 2012 6:06am