Case #08071333 - Disaster Recovery Point in Time Restore for Mailbox

[troll]

Hi.
I opened a case for clarify how to do Disaster Recovery restores.

I did some tests and noted that not all mails were recovered after doing an Express restore.
Steps I did:
3:30PM Removed all mails from folder calls (oldest mail = 2 years old (so mails between 04.2024-04.2026) around 11000 mails.
Waited for total deletion (in Outlook Web you can see the number of items which are already deleted).
3:40PM Removed all mails from „deleted items“, same procedure. Waiting for the progress bar to be sure all are gone.
4:06PM Started Express job (Same date / timestamp 2:00 PM)

The result was that only the mails between 04.2024 - 11.2024 were back again, the other mails were still not restored.

Simple question:
How do I get a state in time restore for the mailbox which would fulfil my expectations for a disaster recovery (the loss of 1 or 2 hours incoming mail would be ok)

Thanks!

[bill.weidenborner]

So for clarification, you choose a restore point that was approximately a couple of hours before you actually deleted the emails?

[troll]

Correct.
And also removed all items from deleted items.

[bill.weidenborner]

I believe the reason it is not working is the choice of Restore Point being two hours before the actual mass deletion event. If you choose a restore point that is nearest one preceding the deletion event, it should restore all the emails that were deleted.

From the description, it appears the emails from 04.2024 - 11.2024 had already been deleted at the time of the backup of the restore point you chose.

[troll]

Hi Bill,

thanks for your reply, but when the restore point is from 2PM and I deleted all items in the folder at 3.30PM, I assume the items should be in the 2PM restore point, otherwise the restore time Veeam shows is not correct and should be fixed.
And no, the mails between 04.2024-11.2024 were not removed earlier than 3.30PM.

In case of DR I will of course use the nearest restore point to the Desaster time, and in my understanding the Microsoft Backup (Rapid Recovery) (which should be Veeam Express) is able to do this, according to the information I get about:
Microsoft 365 Backup (Rapid Recovery)
For comprehensive data recovery against ransomware or mass deletion, Microsoft offers a dedicated backup service.
Frequency: Backups for Exchange, SharePoint, and OneDrive are captured as frequently as every 10 minutes.

https://techcommunity.microsoft.com/blo ... ry/4456639

So the question is still. How can I get a state in time restore with Veeam in case of DR (ransomware or any other worse-case-scenario)?
When I select 2PM, I want the exact mailbox content of 2PM and not run any additional Flex jobs afterwards.

BR
Sascha