Today I was asked to help find missing email in Small Business Server 2008, in other words Exchange 2007. Somehow, thousands of emails had disappeared from a user’s mailbox. They were there a couple of days earlier, so we restored a backup. The procedure is nicely explained by John Bay. You restore the Exchange database to a temporary directory, leaving Exchange up and running. Then you mount the restored backup into a “recovery storage group”, from where you can merge items from the recovered mailbox into the live one.

All went well, until the point where you mount the restored backup. The database would not mount. The event viewer said it was in an inconsistent state. Bay anticipates this, and suggests using the Exchange Troubleshooting Assistant to repair the database. The repair chugged away and completed; but the database still would not mount. I tried again, same result.

I gave up on the Assistant and reverted to the traditional command-line tools. I used the sequence:

ESEUTIL /P

ESEUTIL /D

ISINTEG

running against the recovered database. The first does a repair; the second defragments; and the third runs integrity checks and applies fixes.

Now, you would have thought that the Troubleshooting Assistant would use these very same tools underneath its pretty GUI, but that cannot be the case. Apart from anything else, ESEUTIL /P took much longer than the Assistant. In particular, it appeared to hang while doing something mysterious called Deleting Unicode fixup table.

It carried on saying this for around 7 hours. There was evidence that the process was still alive though, so I left it be.

It worked. I ran the other two commands, mounted the database, and merged the mailbox to recover about 4,000 emails.

The question remains: where did the emails go? All I know is that the problem coincided with a newly installed Windows and Outlook, which I’m guessing is significant.