Retrieving Specific Emails - Powershell

[BKGarry]

Dear All,

 

I need to retrieve emails sent from and to a specific email address. I am hoping someone knows of a way to do this through powershell rather than opening up every mailbox. I have been requested for actual copies of the emails not just a log of them being sent and received.

 

Any help on this would be greatly appreciated. Also, just in case, do I need my mailbox to have any specific permissions to do this?

 

Thank you so much in advance

[Davit2005]

Does below work??

 

 

Get-MessageTrackingLog -ResultSize Unlimited -Start "11/3/2014" -End "18/3/2014" | where{$_.sender -like *@example.com;$_.recipients -like "*[email protected]"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv C:\ExchangeLogResults.txt

[BKGarry]

just to check, do I run two different commands one for from the email address and one to it?

[BKGarry]

The term 'Get-MessageTrackingLog' is not recognized as the name of a cmdlet

 

Boo!!!!!!

[BKGarry]

OK it seems I cannot do it through any tracking log due to time restrictions, I need to actually search mailboxes for a specific email address

[sonofsanta]

Simple answer: give yourself full control over the mailbox and open it as a shared folder and just look. Always easier.

 

Powershell method: if you want to do this for a single mailbox, and take copies into another mailbox of yours for review, the PowerShell you need is Search-Mailbox. Use something along the lines of:

Get-Mailbox -Identity [testuser] | Search-Mailbox -SearchQuery subject:"email subject" -TargetMailbox [yourMailbox] -TargetFolder SearchLogs -LogLevel Full

 

Replace [testuser] with the username (not the full email address, just what they use to log on to a domain PC) and [yourMailbox] with the mailbox you want the copy creating in. It'll make a folder called SearchLogs and (IIRC) a folder beneath that named for the user, and then the relevant items underneath.

 

If you need to search all mailboxes, use Get-Mailbox -ResultSize unlimited before the pipe instead.

 

-SearchQuery accepts all sorts of stuff:

-SearchQuery body:"Here is a sentence from the email"
-SearchQuery attachment:"invoice.pdf.zip"
-SearchQuery from:"[email protected]"
-SearchQuery received:"11/17/2014..11/18/2014"    # [uses American MM/DD/YYYY]

 

and you can mix and match parameters by enclosing everything in single quotes and using an AND operator

Search-Mailbox -SearchQuery 'subject:"email subject" AND from:"[email protected]" AND received:"11/17/2014..11/18/2014"'

[BKGarry]

Thank you @sonofsanta it is working now, slow process though :-)

 

I take it for emails to this person I need to replace from with a to in the search parameters (I really need to learn how to use powershell)

[sonofsanta]

Thank you @sonofsanta it is working now, slow process though :-)

 

I take it for emails to this person I need to replace from with a to in the search parameters (I really need to learn how to use powershell)

 

If you specify a mailbox in the Get-Mailbox command, it's only searching that mailbox, so you don't need to worry about To:

 

If you also want to see messages they've sent, then it might turn up results from their sent folder (never tried--I always just grant permissions and check the mailbox), but if not then search all mailboxes and use from:[email protected]

[BKGarry]

Just to confirm the to working using to works to. Need to make sure I put all the commands in the Knowledge Base of our new helpdesk :-)

[sonofsanta]

Glad it worked out for you

 

I have this script on hand constantly, ever since someone accidentally emailed something private to All Staff and needed it definitively removing from mailboxes. You can use the commands above to search, but instead of all the -TargetMailbox stuff and everything after, you can just use -DeleteContent and it'll delete it forcibly--much more certain than Recall Message.

[BKGarry]

I have added it to our KB on the helpdesk :-)

 

It's good to have it on here for people like me as well :-)