How to restore a single archive after it has been deleted in an Enterprise Vault site.

Description

There are instances when an archive has been deleted by the administrator and it needs to be restored. This article covers how to restore an archive after it has been deleted in Enterprise Vault (EV) for Microsoft Exchange in a small Enterprise Vault site with a single Enterprise Vault server running the Storage Service. If the site has more than one Storage Service running in the environment, it will be necessary to follow 000074304 instead.

If the archived content has indeed been deleted from the archive, there is no way to retrieve the data apart from performing a full disaster recovery as outlined in the Recovery section in the EV Administrator's Guide.

All of the steps following step 2 should be performed on the local isolated machine.

1. Note the EV Site Alias, EV Server Alias and Computer Name for the production server running the Storage Service.
2. Bring up a new server running the same version of Windows in an isolated network or VM environment. This server must not be able to communicate with the production environment over the network, due to a risk in contaminating the production environment.
3. Install the Enterprise Vault pre-requisites.
4. Install the same version of SQL Server that is running in the production environment.
5. Edit the %systemroot%\system32\drivers\etc\hosts file and point the EV Site, EV Server Alias, EV Server Machine Name, and SQL Server names both with and without FQDN to localhost(127.0.0.1).
6. Install the same version of Enterprise Vault that was running at the time the backup was taken. For example, if the backup that contains the data was taken when running Enterprise Vault 9.0.2, but you are now running Enterprise Vault 9.0.3, install Enterprise Vault 9.0.2 in order to be compatible with the backup’s database version.
7. Restore all of the Enterprise Vault SQL Databases to the SQL Server running on the local machine.
8. Restore all of the Enterprise Vault Vault Store Partitions to a drive or share accessible by the local machine.
9. Update the location of the Vault Store Partition(s) in the EnterpriseVaultDirectory database:
   1. Open SQL Server Management Studio
   2. Expand Databases
   3. Expand EnterpriseVaultDirectory
   4. Expand Tables
   5. Right-click the VaultStoreEntry table then select Open Table
   6. Search the VaultStoreName column for the VaultStore that contains the partition that has been restored, and take note of the corresponding VaultStoreEntryId
   7. Close the VaultStoreEntry table
   8. Right click the PartitionEntry table then select Open
   9. In the VaultStoreEntryId column, locate the VaultStoreEntryId from step 5 that corresponds to the Partition that has been restored
   10. Modify the In the PartitionRootPath column to indicate the new location of the Partition
   11. Repeat for each Partition that has been restored
   12. Note: If the location is a NAS device and not a local drive, simply update the PartitionRootPath to the new UNC path rather than using a local file path
10. Run the Enterprise Vault Configuration Wizard. Select Yes to create a new Vault Directory on this computer and select Next. Enter the Vault Service Account credentials and select Next. Enter the name of the SQL server and select Next. Re-enter the Vault Service Account password and select Ok.
11. It will then say that it found the computer in the database and ran repairs.
12. Start the Enterprise Vault Admin, Directory and Storage Services.
13. Stop the Enterprise Vault Shopping, Indexing and Task Controller Services if started.
14. Put the Vault Stores in to read-only or backup mode.
15. Export the deleted archive from the Vault Administration Console to PST and then import it into your production Enterprise Vault environment.