Locating a missing e-mail

Is there a way of searching the whole of an Exchange 2007 mailbox store for a particular e-mail?

Here's the scenario - a user received an e-mail from an external contact. She then moved that e-mail to a folder within another mailbox that she, and several others, have access to. That e-mail has now gone missing and we need to try and locate it.

I have checked the message tracking system and can see the e-mail coming in, so I have the MessageID.

I've checked the deleted items, mailboxes etc of all the other people who have access to the mailbox, and also checked their 'recover deleted items' - but no luck in finding the e-mail.

As the e-mail came in 3 weeks ago, it should still be in the message store somewhere, even if it has been deleted by someone.

Is there any way of interrogating the message store to find out :-
a) If it still exits in the store
b) if it does, where it is located
c) If it does not, an audit trail of what happened to it


Who is Participating?
Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
What you could try is something like this below...

Get-mailboxdatabase | Export-mailbox -SenderKeywords "Sender Email" -TargetMailbox "testuser" -TargetFolder "MyFolder"

This will search all of the mailboxes within all databases and look for anything that has a sender of "sender@mydomain.com" and put a copy of each mail item it finds with that sender into Testuser Mailbox under the "MyData" folder.

You can also use different switches like

- ContentKeywords

in replace of -SenderKeywords


Michael986Author Commented:
Thanks  your reply.

I've tried the command as follows :-

[PS] C:\Windows\system32>Get-mailboxdatabase | Export-mailbox -SubjectKeywords "
Sales Report" -TargetMailbox "michael" -TargetFolder "temp"

But am getting the following error message

Export-Mailbox : The specified user "<Server Name>\First Storage Group\Mailbo
x Database" could not be found.

Any ideas?
Will SzymkowskiSenior Solution ArchitectCommented:
Looks like the first command get-mailboxdatabase wants to have the database name. Use the format Server\storage group\database name

Also make sure that the targetmailbox is actually the correct name as well.
Michael986Author Commented:
I tried using the database name but came up with the same error message

I found an article regarding a similar issue with the get-mailboxdatabase cmdlet - http://social.technet.microsoft.com/Forums/exchange/en-US/861e7336-9e0a-4fed-ac12-961b9a4bfefe/prb-with-exportmailbox-cmdlet

I tried the suggestion in there of changing the command to

Get-Mailbox -Database -"Mailbox Database"

and this worked - sort of. I sent an e-mail with the subject "Sales Report" to a test mailbox then ran the command - this created a subfolder in my 'temp folder' and copied the e-mail there - all good. However, it only worked for some mailboxes, not all.

The 'StatusMessage' on completion of the command shows either :-

Error occurred in the step: Moving messages.
 Failed to copy messages to the destination
mailbox store with error:
MAPI or an unspecified service provider.
ID no: 00000000-0000-00000000


 This mailbox has been exported to the target
  user mailbox.

My first guess at this is that might be a permissions thing - maybe the target mailbox has to have some permission over the mailbox being exported? Is there a quick way around this, rather than having to go into each mailbox to set permissions?
Michael986Author Commented:
There were a few issues with this method, but it certainly put me on the right tracks to be able to find what I needed
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.