Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Exchange Mailbox Archive manually deleted

Created: 28 Jan 2013 • Updated: 05 Feb 2013 | 6 comments
This issue has been solved. See solution.

Hi all,

it's not a issu, it's a question.

During some of my test, I manually delete an test archive on the "exchange mailbox" tab.

the warning was "deleting an archive permanently removes the archive adn all items stored in it. This action will override any from of deletation protection applied to items or retention categorie.

Once you click "yes" you cannot cancel the deletion.

Are you sure you want to delete "test account"

 

Here my 2 question :

1- if I understand the warning, there no option to put a deletation security like in exchange for exemple "keep the delete mailbox during XX day before delete it"

And second and most important.

What's happends if I made this hudge error ? and delete an archive mailbox... No way to restore it ? I backup the entiere enterprise vault archicture with netbackup, but I dont see any way to restore an full archive?

Is it possible? or I miss something?

thanks for you help.

Discussion Filed Under:

Comments 6 CommentsJump to latest comment

JesusWept3's picture

When you delete the archive from the Vault Admin Console it goes ahead and deletes the mailbox straight away.

The only thing that prevents an archive from fully being deleted is if its items are in a retention category that says users are not allowed to delete items, or if its items are on legal hold (through discovery accelerator)

There unfortunately is no archive dumpster for full archives.
The only dumpster functionality is for individual items that the user deletes, but when you delete an archive through the VAC, the dumpster is bypassed and items are deleted there and then.

There was talk at one time about having this option so when you set an archive for deletion it would keep it for 30 days and then you could recover it, but I haven't heard about this in a while.

As for restoring an individual archive, you have really only one option
And that is to set up a DR environment, with SQL Databases and Vault Store Partitions, then export out the Archive to PST then import it in to production.

There is one other option though, you could use Quadrotech's EV Near Sync as this has the kind of functionality you may be looking for where if you accidentally delete an archive, you can recover it from EV Near Sync

It also would serve another purpose by replicating your data for events such as DR.

You can find more information about the product here:
http://www.quadrotech-it.com/products/evnearsync/

SOLUTION
GertjanA's picture

Hello Delphine,

Deleting an archive is a one way operation. As soon as you click yes, and EV is not in backup mode, it will start deleting the items in the archive. As you have seen, the Archive will be 'marked for deletion'.

The only way I know to revert this is to change a column in SQL:

find the row in SQL, in the Directory database, table Archive with ArchiveStatus column = 4, and change the value back to 1

This will 'return' the archive status to 'available'. Items that have been deleted will be deleted...

Now, if you find out a day later, and the archive is gone, the only option you have (as far as I know) is to do a full recovery of the backups (to a DR setup) and then export the archive from there, then import it back into the 'live' EV.

The 'safe' way could be to first export the full archive to PST's, delete the archive from EV, and if it was removed correct, delete the PST's, or, when it was removed in error, create a new archive, import the PST.

I think....

 

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

Rob.Wilcox's picture

You are correct, the items and the archive will be deleted by the storage service starting straight away after you click on the 'yes' to confirm the operation.

 

If you do a 'huge error' then you'd have to either :-

 

a/ Restore the entire environment to an off-network lab, and then export the archive you have deleted to PST, and then re-import that in to your production environment.

b/ Investigate / Purchase additional helpful technology like EVnearSync from QUADROtech.  That can keep deleted data on a replica of your storage, for a period of time, allowing for recovery to take place in the situation you mentioned.

JesusWept3's picture

More can be read about recovering an individual archive here:
http://www.symantec.com/business/support/index?pag...

Also another thing, when in doubt of deleting an archive, export it to PST first and then do a delete

DelphineFR's picture

thanks all for your feedback,

the restore to another EV seems to be a safer solution, maybe a little hard, but in case of emergency could it be done with a pst extract.

If I want to do a backup on another "architecture" Shall I have to restore both SQL and Enterprise vault archicteture?

For now we have 1 server SQL, and 1 Enterprise vault server. And we use the agent of netbackup to save all the package.

So it's mean, at least one server with both SQL role and EV role?

Rob.Wilcox's picture

In a lab environment sure they can be on the same server..  I mean you're asking if for your recovery exercise can SQL and EV be together on one machine?  Yes.  I wrote an article about labs, take a peek that it might be interesting.