How to Run Eseutil /R in Recovery Mode


Recovery refers to the process of playing transaction log files into a database. There are two kinds of recovery: Hard and Soft recovery. Hard recovery can be done with Eseutil by using the Restore mode (/C). For more information about understanding Eseutil recovery, see Eseutil /R Recovery Mode.

Command Line Syntax for Running Eseutil /R

To Run Eseutil /R

  • The basic command line syntax to run soft recovery with Eseutil is:

    ESEUTIL /R Enn
  • For example:

    ESEUTIL /R E00


    The Enn specifies the log file prefix of the transaction logs you intend to play into the database. This command line will work only when run from the folder in which the transaction log files exist, and only when the databases to be recovered are in their original path locations. The log prefix specifier is a required parameter for Eseutil /R.

Command Line Syntax for More Complex Recovery Scenarios

Transaction log files are not in the current folder

As a general rule, you should always run Eseutil /R from the folder where the transaction log files to be replayed exist. This is because the default soft recovery process looks in the transaction log files to find the path to the databases. If you run recovery from a folder where no log files exist, a new transaction log file will be generated, and this log file will not know where the databases are. If you wish to run recovery from outside the transaction logs folder, add this switch to the command:


For example:

ESEUTIL /R E00 /Ld:\exchsrvr\logfiles

Controlling the checkpoint file

In most cases where you manually run soft recovery, you will want to either delete or hide the checkpoint file, because you will typically wish to replay all available transaction logs rather than start from the middle of an available sequence.

If you are running recovery from a folder where a valid checkpoint file exists, and you do not wish to have that file affect recovery, you must define a different path for a checkpoint file to be created during recovery. This might be required after restoring an offline backup into a storage group where databases are running

If you are running recovery from a different folder, and wish to use the checkpoint file to control recovery, you must point to the path for the checkpoint file.

If you wish to control the use of the checkpoint file during recovery, add this switch to the recovery command:


For example:

ESEUTIL /R E00 /Sd:\

Recovering a storage group with a missing database

If a storage group is unexpectedly stopped, and one of the Inconsistent databases is removed or unavailable, you will be unable to mount any of the databases in the storage group until you restore the missing database or until you run manual recovery with the /I switch.


Before recovering while ignoring the missing database, you should make a backup copy of all transaction log files, including the current log file (Enn.log). Once Enn.log has been changed by recovering the other databases, it may not be useable for recovering the missing database if it is once again made available.

Recovering a database “out of place”

This method of recovery completely isolates the recovery process from the running storage group. It is also the way you should recover an offline backup in a Recovery Storage Group, if you intend to play any log files into the backup.

To prepare to do this, you should move the database files (.edb and .stm) and all transaction logs you intend to play into a single temporary folder.

To run Eseutil out of place

  • From this folder, you can run the following command:

    ESEUTIL /R Enn /I /D
  • For example:

    ESEUTIL /R E00 /I /D

The /I switch may or may not be necessary, depending on whether there are Clean Shutdown records in the transaction logs for other databases that were attached to the logs. Using the switch in this circumstance is recommended so that you do not have to start recovery again if there is a “hanging attachment” somewhere in a log file.

The behavior of the /D switch deserves more explanation. If the /D switch is not present at all, then the database paths recorded in the transaction log files will be used to locate the databases. This is the only behavior available in Eseutil for Exchange 2000 and previous versions. If the /D switch is used without a path, then the current directory will be used as the path for the database files. If the /D switch is immediately followed (with no intervening space) by a file path, then that path will be used to locate the database files. For more information about using the /D switch to resolve issues with transaction logs while moving an Exchange database, see Issues with Transaction Log Files When Moving an Exchange Mailbox Database.

Because of the possibility of typing errors, it is strongly recommended that you eliminate the need for using paths with Eseutil switches by running Eseutil from a folder where all data files already exist.

After recovery finishes and the database files are in Clean Shutdown state, they may be moved into place in the appropriate storage group, and attached to the log files there by mounting the databases.


It will usually be necessary to mark the checkbox for “This database can be overwritten by a restore” on the database object properties in Exchange System Manager before the database will mount.

Command line reference

This is the command line reference that can be seen by typing eseutil ./? at the command prompt in the Exchsrvr\Bin folder, and the selecting R for restore.

    DESCRIPTION:  Performs recovery, bringing all databases to a
                  clean-shutdown state.
         SYNTAX:  ESEUTIL /r <3-character logfile base name> [options]
        OPTIONS:  zero or more of the following switches, separated by a space:
                  /l<path>          - location of log files
                                      (default: current directory)
                  /s<path>          - location of system files (eg. checkpoint file)
                                      (default: current directory)
                  /i                - ignore mismatched/missing database attachments
                  /t                - on successful recovery, truncate log files
                  /u[log]           - stop recovery when the Undo phase is reached with the option
                                      to stop when a certain log generation is recovered.
                                      [log] is the log generation number and if not specified
                                      the replay will go to the end of the existing logs.
                  /d[path]          - location of database files, or current directory
                                      if [path] not specified (default: directory
                                      originally logged in log files)
                  /n<path1[:path2]> - new location of database file and optional old location
                                      if the database file location changed.
                                      Can be specified for each database file.
                                      If a certain database is not in the list,it won't get recovered.
                                      To allow recovery in the original location
 for all other database, use /n*.
                                      (not valid with /d switch, not valid with
/b switch)
                  /8                - set 8k database page size (default: 4k)
                  /o                - suppress logo

For More Information

For more information, see the following topics in the Exchange Server Database Utility Guide: