Replay only particular logs (before a certain date) to restored Exchange 2010 database?

Question

Hello,
I'm doing Exchange 2010 database full backup using windows server backup (windows 2008 R2) every weekend. I have a Mac user which Mac Outlook 2011 which somehow managed to corrupt his mailbox. I.e. on Wednesday many messages and contacts disappeared (all
contact gone) after his Outlook told his something about "corrupted database". I'm not sure what Mac Outlook did, but fact is that his mailbox has zero contacts and many inbox message are gone. Hard deleted items don't contain lost messages. 
So I have DB backup from weekend before and weekend after. No circular logging, so all logs in place.
Is there a way how I can restore his mailbox back to the point in time? I want to restore his mailbox how it was on Wednesday morning. For it looks obvious that since I have log files from Monday to Friday, it should be possible to replay logs until certain
time. 
I tried to did thick trick by removing Friday and Thursday logs and doing soft recovery, but got Operation terminated with error -543 (JET_errRequiredLogFilesMissing, The required log files for recovery is missing.) They indeed missing:
         dbtime: 2221857861 (0x846edc45)
          State: Dirty Shutdown
   Log Required: 2895446-2895464 (0x2c2e56-0x2c2e68)
  Log Committed: 0-2895465 (0x0-0x2c2e69)
 Log Recovering: 2838005 (0x2b4df5)
Log required are logs from they day of backup, so they are really missed in that case, but that's what I want - restore DB with less/older logs to get back in time, when mailbox was not corrupted.
Is that possible? 
Thanks

Answer 1

ok so the problem is you have the dreaded  -1018 error and this is a very serious issue. -1018 is not a good deal at all, in short your DB has corruption within it
and it is usually caused by a hardware or firmware related issue. Most of the time these occur somewhere within the storage subsystem, i.e. firmware upgrade or lack of firmware upgrade, Controller issue, cabling, disk, disk arrays, etc, however they can
also be caused by memory upgrades or failures, Motherboard issues etc.   The -1018 tells you the DB is already damaged and if you see these its very bad and needs to be addressed ASAP else the DB's are sure to fail and the more stress you put on
them the faster the chance of failure, i.e. database backups, defrag;s and repairs etc are not recommended at all until you solve the hardware issue.  So here is what I would recommend:
A: Lets try to ensure the box is stable and whatever caused the DB to get the -1018's is solved before we do anything else.
General Review:  Whats changed recently?  i.e. any hardware, memory, motherboard, any firmware updates on anything at all?
Event Log Review: Look at your Application Log, how long have these 1018's been occurring?   Look at your System event log for errors and pay close attention to any errors regarding disk, memory or MB and report back
Protect: I would dismount the database & copy it and any others off to a secure, safe drive that is NOT connected to this system
Action:  Depending on what you find in your review there are really two options
     i: If you had a recent change that is easily identifiable you may be able to correct it and then we can look at finding a clean copy of the EDB and rolling up the logs OR we opt to repair the DB you have
     ii: if you cannot find the issue in short order then I would suggest that you build a new Exchange Server on new hardware and migrate your mailboxes immediately.
B: Once you have addressed the -1018 issue then;
1. We need to find a database from your backups that does NOT have the -1018 result code when attempting a rollup.
2. Once you have a non -1018 result you can then grab a fresh copy of the EDB along with all logs from that point forward and make a consistent DB via rollup up to the 18th as desired.
3. If you cannot find a good copy of the EDB then you are stuck with the latest data you have and should either move all mailboxes to a new EDB on that server but ONLY IF the source of the -1018 is found and resolved, else you will just be making thing s
worse.  IF you CANNOT resolve the issue that causes the -1018 then build a brand new server and move all users over to it ASAP, else you are headed for a major failure on all users.
Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline Exchange Mailbox and Public Folder EDB's and Live Exchange Servers or Import/Migrate direct from Offline EDB to Any Production Exchange Server, even cross version i.e. 2003 -->
2007 --> 2010 --> 2013 with Lucid8's
DigiScope