Search for emails in mailbox

Question

Search for emails in mailbox

lalajee 1,431

Hi, I need to search for emails in an user mailbox and then export these emails into pst file

It needs to have following

search of emails to be as follows,

All emails between User 1 and User 2

That include either in the subject, attachment name or body of the email the following names/terms
Word 1
Word 2

Between 02 Feb 2022 and 05 Mar 2022

What is the best way to do this, Do I need to use powershell to search mailbox or attached it to my outlook. (This mailbox is over 1.5TB)

I did try to use the search function but i'm not sure if this is the correct way or not

Search-mailbox -Identity User2022@Domain.com -SearchQuery '(  
(BODY:"Word 1" OR "Word 2" OR "Word 3")   
OR  
(Subject:"Word 1" OR "Word 2" OR "Word 3")   
OR  
(attachment:"Word 1" OR "Word 2" OR "Word 3")  
)  
AND   
(  
(FROM:User 1 OR User 2 OR User 3)  
OR   
(TO:User 1 OR User 2 OR User 3)  
)   
AND   
(SENT:05/02/2022..07/03/2022)  
' -TargetMailbox "User@domain.com" -TargetFolder "ProjectHamilton" -LogLevel Full -whatif

Nasra Abdo Ibrahim Eldgagati 91 Reputation points

2022-06-30T17:45:28.01+00:00

very thanks

Nasra Abdo Ibrahim Eldgagati 91 Reputation points

2022-06-30T17:45:28.01+00:00

very thanks

Answer 1

Michel de Rooij 1,521 MVP

If this is on-prem, you can directly export to ST using New-MailboxExportRequest.
If this is online, you can use Search-Mailbox as indicated. However, Search-Mailbox will be deprecated in favor of New-ComplianceSearch. Using ExchangeLocation, and when search is finished, you can export results to a PST. Easiest is through the Purview (compliance) portal, or use New-ComplianceSearchAction -SearchName ... -Export -Format FxStream -ArchiveFormat SinglePst. Need to retrieve the exported PST through portal though.

lalajee 1,431 Reputation points

2022-06-28T11:32:20.09+00:00

Mailbox is on-prem

What query do i need to use to get the correct information with New-MailboxExportRequest

lalajee 1,431

How can i search everything rather then tell where to search.

I created the query below

New-MailboxExportRequest -Mailbox "User@domain.com" -FilePath "\\PC01\PST\Result.pst" -ContentFilter {  
(Received -gt '01/02/2022') -AND (Received -lt '06/03/2022')  
-AND (body -like '*Word 1*') -OR (body -like '*word 2 & word )word*') -OR (body -like '*Word 3*')  
-OR (subject -like '*Word 1*') -OR (subject -like '*word 2 & word )word*') -OR (subject -like '*Word 3*')  
}

I'm not getting correct result, its only showing result for Jun 2022

Also how do I makee sure the message are only between user 1 and user 2. if message are send anyone else with same body or subject then i'm not interested

Answer 2

KyleXu-MSFT 25,746

@lalajee

Based on my testing, there exist some issue when use "Subject" and "Body" in the same search. So, I would suggest you create two search for them:

New-MailboxExportRequest -Mailbox UserA -ContentFilter "(Received -Gt '05/01/2018') -and (Received -lt '06/30/2022') -and ((Subject -like '*sub*') -or (Subject -like '*Test*'))" -FilePath "\\EXCH\Shared\1.pst"  

New-MailboxExportRequest -Mailbox UserA -ContentFilter "(Received -Gt '05/01/2018') -and (Received -lt '06/30/2022') -and ((Body -like '*body*') -or (Body -like '*test*'))" -FilePath "\\EXCH\Shared\2.pst"

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

lalajee 1,431

What about making sure that sender and receiver are only User 1 and User 2.

I try this but its not getting anything into pst file

New-MailboxExportRequest -Mailbox mailboxName -FilePath "\\server\G$\PST\Result2.pst" -ContentFilter "(Received -lt '01/03/2022') -and (Received -gt '01/02/2022') -and (Sender -eq 'User1') -and (To -eq 'User 2') -and (body -like '*Test*' -or Attachment -like '*Test*' -or Subject -like '*Test*' )"

It creates the pst file but when I open the pst file its empty

KyleXu-MSFT 25,746 Reputation points

2022-06-30T06:03:22.893+00:00
If you wan to make sure the receiver is User1, you just need to search in User 1 mailbox for emails which sent from User2. Such as (It is same for emails that send from User 2 to User 1):

New-MailboxExportRequest -Mailbox User1 -ContentFilter "(Sender -eq 'User2') -and (Received -Gt '05/01/2018') -and (Received -lt '06/30/2022') -and ((Body -like '*body*') -or (Body -like '*test*'))" -FilePath "\\EXCH\Shared\2.pst"

As I said above, don't use the "Subject" and "Body" in the one search. It will cause an unknown issue.

lalajee 1,431

@KyleXu-MSFT

I cant use user mailbox as some of the email will be deleted.
I'm running this on an mailbox which records all of the emails

I'm doing this as part of an audit

I know you said use body and subject in different search but can use multiple senders and to address in same search see example below

New-MailboxExportRequest -Mailbox mailbox-2022 -FilePath "\\server\G$\PST\All2.pst" -ContentFilter "((Received -lt '04/04/2022') -and (Received -gt '01/02/2022'))   
-and   
(  
    (  
    Sender -eq 'User1@domian.com' -or  
    Sender -eq 'User2@domian.com' -or  
    Sender -eq 'User2@domian.com' -or  
    Sender -eq 'User3@domian.com'  
    )  
-and  
    (  
    To -eq 'User1@domian.com' -or  
    To -eq 'User2@domian.com' -or  
    To -eq 'User2@domian.com' -or  
    To -eq 'User3@domian.com'  
    )  
)  
-and   
(   
    body -like '*Search word*' -or  
    body -like '*Word and (or &) Word 2*' -or  
    body -like '*Test*' -or  
    body -like '*Test word-Name*' -or  
    body -like '*Testy*' -or  
      
 )"

KyleXu-MSFT 25,746 Reputation points

2022-07-01T06:11:07.557+00:00

Do you mean that you've got the search results you want?

Answer 3

Hi Lalajee,

Greetings for the day! We are happy to help you regarding handling emails in user mailboxes.

Kindly try following options.

Option 1: The standard way to handle this is to allow a service to watch for the specific emails in the Mailbox.

Please try following steps.

Create a console application which can read user mailboxes and watch for emails with specific condition. https://learn.microsoft.com/en-us/visualstudio/vsto/how-to-programmatically-search-within-a- specific-folder?view=vs-2022
Host this stand alone exe in a windows scheduler job and have it to monitor the user mailboxes
Once specific emails are received in user outlook, service can handle it and move it specific folder in an common mailbox that can be configured.

Option 2: If its an on premises exchange, please try using PowerShell scripts to handle this.

Try using "Search-Mailbox" command to move emails with specific condition.

Kindly verify details from below link,

https://learn.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps

Option 3: If you are trying to handle theses within your own mail box, try using "rules" part of outlook.

Outlook rule will have all the options you have requested and it can scan the emails which have already received in your mailbox.

Kindly look into following link,

https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59

Incase you need detailed steps with images, kindly verify this link -

https://www.vishalon.net/blog/move-outlook-emails-of-specific-date-range-to-a-folder

---------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer. --

Search for emails in mailbox

3 answers

Activity