- dirty shutdown of .edb

- non victimized recovery of exchange server

- esetutil /ml of log file folder show all headers of logs to replayed intacts

- eseutil mh shows dirty shutdown

relevant powershell or admin prompts commands:

Eseutil /mh "D:\Program Files\Exchange\database\RSG20110601135953\mailbox database.edb"

Eseutil /ml "D:\Program Files\Exchange"

Eseutil /ml "D:\Program Files\Exchange\E0000074A00.log"

eseutil /ml E00

ESEUTIL /R E00 /l "D:\Program Files\Exchange" /d "D:\Program Files\Exchange\database\RSG20110601135953\mailbox database.edb" /a /i

other links:




helpful note: can't hurt to copy your good logs into various directories you think might help with the recovery. depending on a few factors it will try to replay logs if they are there, give it every opportunity.  START early - takes a long time to move, copy and prep data. Then recover and move it around again

example of a healthy pre-swap dial-tone and recovered first storage group

Inline image 1

order of recovery steps IMPORTANT:

as soon as you find out its dirty, stop all services, rename the storage group folder the .edb file is in and mount the database creating a dialtone temp database - let people work in outlook with new mail 

1) identify shutdown state (clean vs dirty)

2) if dirty and you have a backup and clean logs to replay don't bother with a repair (/p) time and resource intensive

3) clear space on exchange partition to accommodate 110% of database size

4) restore from backup into a folder you create

5) in recovery folder with .env file copy the good log files form the dirty databaes in to be replayed

6) on the backup check the last 2 options (logs and mount after recovery)

7) now create a RSG in exchange 2007 tools, it will give you directory. when the group is created, move the recovered .edb into the folder 

8) run the merge/copy wizard in exchange 2007 and swap databases,

9) close outlook on client machines re-open to success

more notes and screesnhots:

Inline image 2

ignore repairs and soft recoveries

Inline image 3

finding the dirty shutdown

Inline image 4




1) first run eseutil to find if the shutdown is dirty, if so immediately rename the folder the database is in 

(D:\Program Files\Exchange\database\RSG20110601135953\RSG20141031054804)

and create a dialtone database so people can continue using outlook

2) then follow instructions above (restore from backup, copy logs into restore directory for replay command and create RSG in EMC)

Inline image 1

NOTES/TAGS: hybrid exchange recovery using RSG logs and current backup