Link to home
Start Free TrialLog in
Avatar of SupermanTB
SupermanTB

asked on

Exporting all mailbox email from date range into PST

I've been asked with exporting all emails in a mailbox from a particular date range into a PST file.  I've done a little bit of research online and it looks like an easy way to do this is export to PST, but adding a filter to export only the sent items during the date ranges and the received during the date ranges.  I've done a test and that appears to be working fine.

I have two questions

1.  Has anyone used this method before and is it very reliable?  These results are to be provided for a lawsuit and they need to be accurate.

2.  Is there anything I might be missing that the sent & received filters might not catch.  It seems like an email is either sent or received, so that should catch them all.

Email is hosted with Office365 and using Outlook 2016

Thanks very much.
Avatar of Colleen Kayter
Colleen Kayter
Flag of United States of America image

If you look in the Outlook Options, Mail Pane, you'll notice under the Save messages category that a) replies can be saved in a folder other than Sent Items when the received message is not in the In folder (e.g., I receive a message from you, move it to my EE folder and when I reply, the reply is saved in the EE folder) AND b) if the user has, at any time during the date range, cleared the check box to save copies of messages in the Sent Items folder.

Given the importance of having a complete record of sent messages, you might want to set the export to the top level (the full user account) and export all messages from that user sent during the date range. PST files are fairly reliable and this way you'll catch all sent items, including archives, except those that have been permanently deleted.
Avatar of Todd Nelson
If you are an Exchange admin in Office 365, you are looking to export from Compliance Management via the Exchange Admin Center and not Outlook, correct?

1) Very reliable. Personally, I would give this task to the legal team or to whomever received the request. Give the persons Compliance Management permissions.
2) I would recommend targeting all email instead of just sent items. I know many people that delete their sent items.

Unfortunately, via PowerShell, you cannot export mailbox content from Exchange Online to PST.
One other note... I'm assuming this account is still active (otherwise you would not be able to create the PST). If you have Admin authority, you can place a Litigation Hold on this account.

In Office 365, go to Exchange Admin Center > Recipients.

Select the user account, then click the Edit Pencil icon at the top of the list. Scroll down and enable Litigation Hold.

For more details: https://technet.microsoft.com/en-US/library/ms.exch.eac.LitigationHoldChangesLearnMore(EXCHG.150).aspx?v=15.1.1341.20&l=1&s=BPOS_S_E15_0
SOLUTION
Avatar of S_K_S
S_K_S

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
As S_K_S stated, the Security & Compliance Center in the O365 Admin Center will replace the Compliance Management in the O365 Exchange Admin Center.  But for now, you should be able to use both for exporting mail data to PSTs.

This is the message currently in the Compliance Management section of the EAC...

"We've postponed the July 1, 2017 deadline for creating new In-Place eDiscovery searches and holds in the EAC. But later this year or early next year, you won't be able to create new searches and holds in the EAC. Please start using  Content search in the Office 365 Security & Compliance Center. In Exchange hybrid deployments, searches run from your on-premises organization won't be affected by this change. Learn more about  content search and  retention in the Security & Compliance Center."
Avatar of SupermanTB
SupermanTB

ASKER

Colleen:  to your first comment, i did the export on the top level (full user account) as you mentioned.  The accounts are still active and I have them configured in Outlook.

Todd:  I am targeting all email.  My apologies if my initial question was not clear.  I'm targeting sent/received email for the entire mailbox

I do have global admin on this account.  I suppose I could follow the steps recommended by SKS, but are there any problems with doing it the way I have described in my initial post.  Seems like it would work pretty well.  My initial tests look good.  The exported PST file has emails from the selected date range in their appropriate sub folders.
By the way, thank you for your replies
Superman, how many user accounts are involved here? A separate PST file for each?

If this is a CYA exercise, then you'll want to make it as easy as possible to find relevant records. If it was triggered by subpoena, then by all means, send them scads of .PST files.
FYI, i realize now in my original post that incorrectly stated that i was only after sent emails.  I need sent & received emails.  In my filtering I have filtered during the particular date range for both sent & received emails.  The resulting PST file contains both the sent and received emails in their appropriate folders/subfolders.  So everything looks good.  I would think I would have everything if use a sent filter & received filter for the given date range.  

I'm just curious if i could be missing something somehow

There are about a dozen user accounts.  I already have then configured in Outlook.  Problem is some of the PST files will be huge (20-40 GB).  There are probably about 4 of those.  

I definitely want to CMYA.  Would love you all's thoughts.
You definitely need to implement litigation holds. It won't prevent users from using their email accounts, just deleting contents.
If there are a set of users you know who should not be deleting their emails and you need to at a later stage pull out the data to PST for legal reasons then the best option is to build a case within the New Security & Compliance Portal. Add the set of users to it and do not worry till the time you need to extract the data to PST. LitigationHold is an option but the best suited Hold for your scenario is In-Place Hold.
Best part of it is:
1. End user will not even be impacted on their day-to-day activity. They can access and do whatever they want to within their Mailbox. Even if they delete emails system will allow the user to do that and they in the background those emails will be available to you\Admin when the data is extracted to PST at later stage
2. You do not have to worry about creating each users' outlook profile and export PST. The larger the mailbox the more chances are for PST corruption and this entire exercise is a very time consuming one. Via the portal what size of the PST it will dump the data into 10GB PST batches.
Since you are the one who knows your environment the best it is upto you to decide which Hold you use. These are different just Tools that makes you work smarter and easier way and allows you to choose per need basis. If you have additional questions do ask and we'd be more than glad to respond in the best way possible
I'm not worried about users deleting emails.  If they would have deleted emails, they would have done it long before now.  The users are also unaware this is happening
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hi Superman: Do you still have additional questions that need to be answered?
That tool Chris provided did it nice & easy.  Very simple & easy to use