Content Search Query (Compliance Search & Attachments)

IG 6 Reputation points
2022-05-04T18:51:04.43+00:00

The Compliance Search "ContentMatchQuery" property can search for whether emails have attachments (hasattachment:true) and the names of attachments (attachmentnames:annualreport.ppt), but is there a way in which it can search the content inside of email attachments?

Exchange | Exchange Server | Management
Windows for business | Windows Server | User experience | PowerShell
Microsoft Security | Microsoft Graph
0 comments No comments
{count} vote

2 answers

Sort by: Most helpful
  1. Limitless Technology 39,926 Reputation points
    2022-05-10T07:33:40.747+00:00

    Hi IG-4542,

    This is possible. First, you will need to find the name of your DiscoveryMailbox:

    Get-Mailbox –RecipientTypeDetails DiscoveryMailbox | export-csv c:\temp\disc.csv

    Then run the below PowerShell code:

    $UserCredential = Get-Credential

    $exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/" -Credential $UserCredential -Authentication "Basic" -AllowRedirection

    Import-PSSession $exchangeSession -DisableNameChecking

    Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

    Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Body:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

    You then need to add the DiscoverySearchMailbox to your Outlook to see the results.


    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

  2. Kael Yao 37,746 Reputation points Moderator
    2022-05-11T08:41:45.537+00:00

    Hi @IG

    According to this link: Keyword queries and search conditions for eDiscovery
    There isn't a property which can be used for attachment contents.

    Thus I am afraid it is not possible.


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.