Restoring Emails to a PST File

Modified on Wed, Jul 21, 2021 at 6:21 PM

Sometimes for e-discovery or legal reasons we will need to restore emails from the MailArchive to a PST file so that outside parties can review. This article will explain the steps for doing that.

1. Choose or create a test account with a working inbox
Confirm that the test accounts mailbox can be logged into though https://outlook.office.com and delete any emails that are currently in it.
2. RDP to MailArchiver64
For simplicity you should login with an account that is a member of the MailArchiveAdmins AD group
3. Run GFI Archiver Impor and Export Tool (64 bit)
4. Select Export Data from GFI Archiver
Login as Current User or other credentials that are a member of MailArchiverAdmins and click on Verify Connection then Next
5. Under search options select "Emails with specific search criteria"
6. Select the search criteria
Be sure to note the difference between "all of the following criteria" and "any of the following criteria" on the Include and Exclude tabs
7. Click on Find to verify that the search criteria is working properly
The results pane will not list all of the emails that were found but it should give you an idea of whether or not it is finding what you are looking for
8. Click on Next when satisfied
9. Select the "Restore to the following email address" Option
Enter the email address for the test account from step #1 and click Next
10. Monitor the progress to verify all emails are restored
Note how many items were successfully restored.
11. Login to the test account to verify that the emails have been restored
There will be a delay between when MailArchiver says it has restored the emails and they actually show up in the mailbox so you will need to wait until the Inbox item account matches what was supposed to be restored. That is why you need to start with an empty mailbox. Also, some items may end up in the Junk folder so you may need to move them back to the Inbox from there. There may be a discrepancy of 1 or 2 items which is typically calendar appointments.
12. Move the test account to the NoGPO* OU
Don't do this until after all of the emails have been restored to the Inbox. Once done, the test account will need to be logged off and back onto a machine (virtual or physical) for the OU change to take affect.
*As of July 2021, the NOGPO OU has been retired. Instead, use the FMHC --> IT --> Users --> TestOU OU.
13. Create the PST file
Once the PST file is created move all of the emails from the Inbox to the PST file
14. Deliver the PST file
Depending on the size of the PST file this may require MoveIT. A secure method should be used regardless.
15. Move the test account back to its original OU

Restoring Emails to a PST File

1. Choose or create a test account with a working inbox

2. RDP to MailArchiver64

3. Run GFI Archiver Impor and Export Tool (64 bit)

4. Select Export Data from GFI Archiver

5. Under search options select "Emails with specific search criteria"

6. Select the search criteria

7. Click on Find to verify that the search criteria is working properly

8. Click on Next when satisfied

9. Select the "Restore to the following email address" Option

10. Monitor the progress to verify all emails are restored

11. Login to the test account to verify that the emails have been restored

12. Move the test account to the NoGPO* OU

13. Create the PST file

14. Deliver the PST file

15. Move the test account back to its original OU