Problem solve Get help with specific problems with your technologies, process and projects.

How can I restore only selected deleted emails?

SearchExchange expert David Sengupta explains how to restore only selected emails that have been deleted in Exchange 2000 Server Standard Edition.

We are using Exchange 2000 Server Standard Edition with about 150 mailboxes. Three days ago almost all the attachments on all mailboxes were deleted and an error message was inserted. This was done by an antispam program. If I restore from backup, I will lose mail from the past few days. How can I restore selected mail messages that have important attachments? Of the 30,000 deleted emails, I estimate that about 500 are very important.
There is no easy way to do that. Here are your options:

  1. Build a recovery environment. Rebuild the server from backup. Use Microsoft's ExMerge tool to extract messages of interest (you'd have to confirm whether ExMerge will let you find the messages with attachments based on some criteria that defines "important") into .PST files. Then use ExMerge to import those into your production server. Test in a lab first.
  2. Find a third-party utility that let's you do item-level recovery from regular backups. Search for "Exchange recovery item-level" using your favorite search engine. That would save on having to build the recovery environment and would give you more criteria to choose from in extracting messages and attachments from the backup.

Unfortunately there is no other easier way.

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from SearchExchange.com:

  • FAQ: Exchange Server backup and recovery
  • Learning Center: Exchange Server archiving essentials
  • Learning Guide: An admin's guide to Exchange backup and recovery
  • Reference Center: Exchange backup and recovery tips and resources
  • Dig Deeper on Exchange Server setup and troubleshooting

    Start the conversation

    Send me notifications when other members comment.

    Please create a username to comment.