How to recover an archive after it has been deleted in an Enterprise Vault site.

Article:TECH48829  |  Created: 2009-01-04  |  Updated: 2013-10-24  |  Article URL
Article Type
Technical Solution


There are instances when an archive has been deleted by the administrator and it needs to be restored. This article covers how to restore an archive after it has been deleted in Enterprise Vault (EV) for Microsoft Exchange in a small Enterprise Vault site with a single Enterprise Vault server running the Storage Service.  If the site has more than one Storage Service running in the environment, it will be necessary to follow HOWTO93201 instead.


If the archived content has indeed been deleted from the archive, there is no way to retrieve the data apart from performing a full disaster recovery as outlined in the Recovery section in the EV Administrator's Guide.

All of the steps following step 2 should be performed on the local isolated machine.

1. Note the EV Site Alias, EV Server Alias and Computer Name for the production server running the Storage Service.

2. Bring up a new server running the same version of Windows in an isolated network or VM environment. This server must not be able to communicate with the production environment over the network, due to a risk in contaminating the production environment.

3. Install the Enterprise Vault pre-requisites.
4. Install the same version of SQL Server that is running in the production environment.

5. Edit the c:\windows\system32\drivers\etc\hosts file and point the EV Site, EV Server Alias, EV Server Machine Name, and SQL Server names both with and without FQDN to localhost as follows:

6. Install the same version of Enterprise Vault that was running at the time the backup was taken.  For example, if the backup that contains the data was taken when running Enterprise Vault 9.0.2, but you are now running Enterprise Vault 9.0.3, install Enterprise Vault 9.0.2 in order to be compatible with the backups.
7. Restore all of the Enterprise Vault SQL Databases to the SQL Server running on the local machine.
8. Restore all of the Enterprise Vault Vault Store Partitions to a drive or share accessible by the local machine.

9. Open the EnterpriseVaultDirectory database on the local SQL Server.  Edit the PartitionEntry table and change the PartitionRootPath for each Partition to the local path. For example, if Vault Store 1 Partition 1 was located at \\mySANServer\Vault Store 1\Partition1, but is now located at d:\vault store 1\partition 1, update that partition’s PartitionRootPath to the new location. For more information on this, refer to TECH35742, step 3 for updating the PartitionEntry table. 

10. Run the Enterprise Vault Configuration Wizard. Select ‘Yes’ to create a new Vault Directory on this computer and select Next.   Enter the Vault Service Account credentials and select Next. Enter the name of the SQL server and select Next. Re-enter the Vault Service Account password and select Ok.

11. It will then say that it found the computer in the database and ran repairs.

12. Start the Enterprise Vault Admin, Directory and Storage Services.

13. Stop the Enterprise Vault Shopping, Indexing and Task Controller Services if started.

14. Put the Vault Stores in to read-only or backup mode.

15. Export the deleted archive from the Vault Administration Console to PST for import into your production Enterprise Vault environment.

Legacy ID


Article URL

Terms of use for this information are found in Legal Notices