Local Exchange email searching

Hi,

I have an old exchange 2007 which I need to do an email audit for a particular client.
When I do a search, it's only showing just the recent result, the past months only.
I need to search for email 4 years ago.

I just look at the Exchange Transaction Log Drive Statistics and it's showing "Circular Logging is enabled"
Could that be why I can't search the older email?
I can't do an individual search for each mailbox as we have more then 100 user and about 50 keyword to search.
Is there a way I can search the exchange directly?
If it's possible, please provide steps.

Thanks, much appreciated.

Jason
jason wAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

yo_beeDirector of Information TechnologyCommented:
The Transaction logs and other logs are not going to us leveraged for a search.  Your indexing of your exchange sounds like it is truncated.
I just did a simple search and found this.  https://social.technet.microsoft.com/Forums/exchange/en-US/0e2dc1a3-307f-4e2d-8eec-19b688a3cb2c/exchange-server-2007-search-results-not-showing-old-mails-after-a-new-search-index-build?forum=exchangesvrclientslegacy

May or may not be an viable option.  

Another option is to setup this mailbox in a Outlook profile and do an advance search.  This will crawl the entire mailbox.  It might be the quickest solution if this is a one off task and is not a mission critical server.
AlanConsultantCommented:
Hi,

I can't recall what PowerShell options you have with Exchange 2007, but maybe you can do it that way?

This is an example command with various parameters - maybe you can adjust to suit your needs:

Search-Mailbox -Identity "Firstname Lastname" -SearchQuery 'From:Sender@example.com Subject:"Multiple word test" sent:01/01/2013..1/1/2018' -TargetMailbox "Search Mailbox Name" -TargetFolder "Search Folder Name" -LogLevel Full

Open in new window


Hope that helps,

Alan.
jason wAuthor Commented:
Hi Thanks for the quick reply,
Your task is for 1 mailbox, I need to search the whole exchange database.
I need all email related to this particular client and it could have gone into any of our staff's mailbox.
If I search each mailbox, that'll take weeks..
Are there quicker ways?
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

jason wAuthor Commented:
I did a search via the power shell basic parameter but no result

get-messagetrackinglog -Recipients: clientemail@domain.com.au

Not showing any result at all.
AlanConsultantCommented:
Hi Jason,

I'm not at a server right now to check this, but I think you should be able to pipe all the mailboxes through that command so something like:

Get-MailBox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'From:clientemail@domain.com.au Sent:01/01/2013..1/1/2018' -LogLevel Full

Open in new window



Does that work?

Alan.
MASEE Solution Guide - Technical Dept HeadCommented:
Adding to the above.
Please try to use export function. Please check this for more details.
https://technet.microsoft.com/en-us/library/aa998579%28v=exchg.80%29.aspx?f=255&MSPPError=-2147217396
Get-mailbox -resultsize unlimited| Export-Mailbox -SubjectKeywords "Content keywords" -TargetMailbox Administrator -TargetFolder 'Search folder'

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
IvanSystem EngineerCommented:
Hi,

Message tracking log maximum age is 30 days, by default. That is why you very likely wont be able to find any information older then 30 days.

Info: https://technet.microsoft.com/en-us/library/cc539071.aspx

Regards,
Ivan.
MichelangeloConsultantCommented:
- need to search for a particular email which you presume is saved in a user mailbox
Search-mailbox is the way to go, provided that the email has not been deleted more that 30 days ago (check your retention settings)

- you need to search for logs about sending/receiving a particular email:
Get-messagetrackinglog is the way to go (last 30 days OR directory size, it depends on yr configuration)
jason wAuthor Commented:
Hi,
Thanks guys, thanks for your helps.
I've manage to kind of get it going, but am not getting the right result, got some meeting and sent item but not enough result.
I am using this
Get-mailbox -resultsize unlimited| Export-Mailbox -SubjectKeywords "key word" -TargetMailbox Administrator -TargetFolder 'target folder in administrator outlook'

(My understanding to this is, it should search and copy the item from all mailbox that has the "Key word" to a "target folder" in the administrator's profile, it seems to do that but only getting limited result, why?)
AlanConsultantCommented:
Hi,

When you say you are only getting 'limited result', what do you mean exactly?

Are you getting one or more items in the target folder in the Administrator mailbox?

If so, do you have reason to believe that there are other items that have the 'Key Word' in them that are not getting placed in that folder?


Alan.
jason wAuthor Commented:
Thanks guys, got it sorted.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.