Data Request for Emails

JG 1 Reputation point
2020-09-02T13:06:47.163+00:00

We had a request for data come in and I am wondering how I complete the following

We need to pull all emails from a certain time frame that are to/from six of our staff and are from anyone at a certain domain.

What is the correct syntax in exchange 2013 to get this completed and stored in a certain file location?

Thanks in advance,

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
6,085 questions
No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 109.6K Reputation points Microsoft MVP
    2020-09-02T13:59:45.617+00:00
    No comments

  2. KyleXu-MSFT 25,616 Reputation points
    2020-09-03T06:28:57.5+00:00

    >pull all emails from a certain time frame that are to/from six of our staff and are from anyone at a certain domain

    When create the eDiscovery search request, you could enter the ”domain name“ into the from or to list directly. You don't need to click "add users" and choose from the given list.

    22277-1.png
    22404-2.png

    You need to create two eDiscovery search requests, one for From domain.com, another for To domain.com

    If you are familiar with PowerShell, you can also use Search-Mailbox command to do this job, it could export the result to a specific mailbox:
    22346-3.png
    For more detailed information, have a look about those articles:
    Search-Mailbox
    SearchQuery parameter


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.