HOWTO: Read unmounted Exchange EDB files.


I was recently asked this question similar to this:

 

How can we search on unmounted EDB files?  Are there any API’s that I can use to access the mails in unmounted EDB?

 

There are two answers: 

 

“No” and “It’s a bad idea”.

 

Further:

 

There is no support for accessing unmounted EDB files. There are no Microsoft APIs for doing this. There are third-party APIs on the web.  The format for these files is not really documented and thus is not something you should depend-upon.  If you use a third-party application to access an EDB which is mounted, you may cause corruption or potentially take down Exchange.  Any API which alters data in an EDB is risking causing corruption.  If you choose to still try to read the unmounted EDB file, you should note that you may not get all of the data you are seeking – remember that information may be in the STM file and not the EDB until its data is promoted to the EDB file. 

 

What about recovery of an EDB?

 

There are some third-party applications which do fixes against an EDB.  These are not supported by Microsoft.  Remember that Exchange 2000 and 2003 have two data stores and not just one. Information is sync’d between the two based upon need.    The process of syncing the data between both databases does cause a performance hit, so only what’s needed is synchronized.  Because of this, the EDB file may not (most likely will not) have all the data needed for a full restore.  Please read the links below and fully understand how the database files which Exchange is driven off of work together.

 

In a production environment, nobody should be attempting to repair an EDB file.  Thats what backup software is for.  Brick-level (item & property) backups are not supported by Microsoft.  Exchange is supported with backup software which uses VSS or the older Exchange Backup API. Also remember that Exchange integrates heavily with AD, so AD should always have its data backed-up.

 

I know that there are a number of third party APIs, backup and recovery programs out there which may work where you have no other path forward.  However, such software/APIs should only be used as a last resort.  Its best to use supported soltuions – which you know will work now and in the future.

 

Microsoft Support can assist with recovering data with supported tools.  So, if you need to recover data, please contact them.

 

How about ESE.DLL or anything else people try to use to get at EDB content:

 

Developers sometimes try to use the ese.dll in order to get at EDB content.  It’s clearly spelled-out in MSDN that it’s not supported to do this.

 

Microsoft support policy for third-party products that modify or extract Exchange database contents

https://support.microsoft.com/en-us/kb/904845

 

I know that one section of the article indicates that you “might” be able to access the store in a read-only mode but there are some major differences in the different implementations of the ESE engine that can get you into some real problems.

Although this is a documented API and is very similar to ESE used with Exchange, it is not designed for use with Exchange and has limitations/differences that can result in problems with the Exchange store. I also suspect that the ESE functionality is going to be newer than the ESENT functionality since ESE/Exchange is continuing to be updated. It would not be surprised if any ESENT based apps that you get to work, fail with future releases since we have no commitment to ensure that ESENT works with Exchange.

The third-party tools and APIs mentioned above may use ese.dll to accomplish what they are doing.  However, it’s not supported or recommended by Microsoft at all. 

 

Here is some homework if you wish to know more:

 

Exchange Storage Architecture

http://technet.microsoft.com/en-us/library/bb124808.aspx 

 

Exchange Transactions and the Exchange Database Overview

http://technet.microsoft.com/en-us/library/aa996118(EXCHG.65).aspx#TheEdbFile 

 

Also see:

About: Exchange APIs to backup and restore data
http://blogs.msdn.com/b/webdav_101/archive/2015/06/01/about-exchange-apis-to-backup-and-restore.aspx

Please note (11/4/2013):  In the past 20 days there have been eight comment postings by entities portraying themselves as separate companies with Exchange recovery tools which directly read Exchange’s EDB files. This is a lot since I’ve only seen two such comment posts on since I wrote this article five years ago.  Further, two those comments were posted early last Saturday morning for different products which seem to do the same thing.  I can only assume that were all posted by people trying to spread malicious software.  So, I’m going to need to approve all comments on this post from here on. 

 

 

Comments (13)

  1. int19h says:

    > There are no Microsoft APIs for doing this

    Actually, yes, there are – it’s called ese.dll, and the APIs are documented on MSDN.

    (Yes, I did wrote some code that worked on detouched .edb files in the past, for an Exchange backup solution. Apparently, customers really want to be able to browse their Exchange backups and view individual emails without a live Exchange instance).

  2. JSanders4243 says:

    I’m going to have to 2nd int19h — I had a customer with an Exchange 2003 store and AD on the same box (it was a SMB that didn’t know better). AD became corrupted and was unrecoverable. The EDB contained over 4 years worth of e-mails. I used http://www.officerecovery.com/exchangeserver/index.htm for the recovery, and it worked perfect. The tight-coupling between AD and Exchange is a double-edged sword.

  3. packiyanathsk says:

    Hello int19h

    Thats what my question was to Dann yesterday. You can check my query to Dan in this link

    http://blogs.msdn.com/webdav_101/archive/2008/07/18/my-edb-file-grows-when-i-search.aspx?CommentPosted=true#commentmessage

    Its good to hear that you developed something on this issue.

    Could you please give me some pointers on how to do this? Some basic information/resources I can find to do this?

    Thanks for your time.

    And Thanks Dan… For putting up the article after I raised the question. I know Im one of the guys who bugged you with that question.. but even then.. Happy to see the article next day I raised the question. Thanks..:)

    -Packy

  4. int19h says:

    Sorry for a delayed reply. I’ve posted the comment with details at the post you’ve linked to.

  5. ChrisLamont says:

    Does the store always take responsibility for synching the streams in the EDB and STM?  I read somewhere in the SDK that there are cases when a stream’s properties may not be auto-promoted to fields in the EDB, and it is up to the developer to re-write the fields.

    It’s been a few months since I opened the ‘SRZ’ case with PSS (and got no results), but I do remember that it dealt with a WEBDAV POST, and there is similar documentation in the Exchange SDK in the CDO section.  I’ll dig this up if you need me to…

  6. danba says:

    Hello Chris;

    The store will sync info between these stores on an as-needed basis.  Syncing data is very expensive performance wise, so the store only does this when it really needs to. These stores are the backend database and your code should not need to worry about the syncing. However, I have seen a bug in the past where properties were not promoted to the mapi store and a proppatch had to be done to help force the syncing of some properties  – it was a very specific issue though. It sounds like you had run into a similar issue – either that or you were working with some properties which don’t get promoted for some reason.  

    In Exchange 2007, there is just one store – MIME would be generated on the fly as needed and is not kept.

    Please let me know where you read that you had to update properties because they were not promoted.

    Thanks,

    Dan

  7. Michael Collazo says:

    In regards to the post left by  int19h, I've checked the link and your post is not there. Would you be so kind as to share the details once again?

    Thanks in advance

  8. Ray says:

    The fact that you cannot pull in an exchange database from a crashed server tells me that Exchange is CRAP.

  9. danba says:

    Sorry Allenseikh, but please don't post advertisements.

  10. Thanks for informative stuff!!

    Read unmounted, corrupted, unmounted and offline EDB files using PCVITA EDB Converter. It deeply scans the EDB files and then displays all mailboxes, folders & sub folders in hierarchy. From here, click to expand all items from EDB file.  As well as, if you really need to recover all mailboxes, then Save mailboxes into PST format. Get the complete details from: http://www.pcvita.com/edb-converter.html

  11. carterjohn says:

    Now it’s too simple to read unmounted or corrupted EDB file by using a THIRD PARTY TOOL. This Enstella EDB to PST Converter Tool is the perfect solution which elegantly helps you to convert EDB file to PST format without losing a single data of EDB. So if you want to convert unmounted Exchange EDB file into readable mode (.PST) then get it from here- http://www.edbtopsts.com/

  12. alberyherry says:

    Desiring best EDB recovery software for quick recovery of EDB database then I suggest you to use Enstella fabulous Exchange EDB to PST recovery software that perfectly manage EDB file to PST and save EDB file into PST format with all complete mailbox

    For more info

    code.google.com/…/microsoft-edb-to-pst

    http://www.edbtopsts.com/

  13. Jelli Smith says:

    Advance Exchange EDB to PST conversion software is an ideal tool, perfectly convert EDB file to PST. Quick EDB file extractor software is an amazing technology which enable fast recovery of EDB file and transfer EDB to PST. It is the best tool ever, smoothly migrate EDB to PST with complete Exchange Database. It superbly convert EDB file to PST format and save all EDB emails into PST format with whole EDB emails Meta data. Safe and sound solution for converting EDB file as PST.

    Get it from: http://www.exchange2010serverrecovery.microsoftedbtopst.org