Data Request for Emails

Question

We had a request for data come in and I am wondering how I complete the following

We need to pull all emails from a certain time frame that are to/from six of our staff and are from anyone at a certain domain.

What is the correct syntax in exchange 2013 to get this completed and stored in a certain file location?

Thanks in advance,

Answer 1

I would use EDiscovery and walk through the steps, apply the required keywords and run the search:
https://learn.microsoft.com/en-us/exchange/create-in-place-ediscovery-search-exchange-2013-help

You can then copy to a mailbox:
https://learn.microsoft.com/en-us/exchange/copy-ediscovery-search-results-to-a-discovery-mailbox-exchange-2013-help

and export to a pst if needed

https://learn.microsoft.com/en-us/exchange/export-search-results-exchange-2013-help

Make sure you have the correct permissions:

https://learn.microsoft.com/en-us/exchange/assign-ediscovery-permissions-exchange-2013-help

Answer 2

>pull all emails from a certain time frame that are to/from six of our staff and are from anyone at a certain domain

When create the eDiscovery search request, you could enter the ”domain name“ into the from or to list directly. You don't need to click "add users" and choose from the given list.

You need to create two eDiscovery search requests, one for From domain.com, another for To domain.com

If you are familiar with PowerShell, you can also use Search-Mailbox command to do this job, it could export the result to a specific mailbox:

For more detailed information, have a look about those articles:
Search-Mailbox
SearchQuery parameter

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.