Content Search Query (Compliance Search & Attachments)

Question

The Compliance Search "ContentMatchQuery" property can search for whether emails have attachments (hasattachment:true) and the names of attachments (attachmentnames:annualreport.ppt), but is there a way in which it can search the content inside of email attachments?

Answer 1

Hi IG-4542,

This is possible. First, you will need to find the name of your DiscoveryMailbox:

Get-Mailbox –RecipientTypeDetails DiscoveryMailbox | export-csv c:\temp\disc.csv

Then run the below PowerShell code:

$UserCredential = Get-Credential

$exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/" -Credential $UserCredential -Authentication "Basic" -AllowRedirection

Import-PSSession $exchangeSession -DisableNameChecking

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Body:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

You then need to add the DiscoverySearchMailbox to your Outlook to see the results.

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hi @IG

According to this link: Keyword queries and search conditions for eDiscovery
There isn't a property which can be used for attachment contents.

Thus I am afraid it is not possible.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.