Local Exchange email searching

Hi,

I have an old exchange 2007 which I need to do an email audit for a particular client.
When I do a search, it's only showing just the recent result, the past months only.
I need to search for email 4 years ago.

I just look at the Exchange Transaction Log Drive Statistics and it's showing "Circular Logging is enabled"
Could that be why I can't search the older email?
I can't do an individual search for each mailbox as we have more then 100 user and about 50 keyword to search.
Is there a way I can search the exchange directly?
If it's possible, please provide steps.

Thanks, much appreciated.

Jason
jason wAsked:
Who is Participating?
 
MAS (MVE)Technical Department HeadCommented:
Adding to the above.
Please try to use export function. Please check this for more details.
https://technet.microsoft.com/en-us/library/aa998579%28v=exchg.80%29.aspx?f=255&MSPPError=-2147217396
Get-mailbox -resultsize unlimited| Export-Mailbox -SubjectKeywords "Content keywords" -TargetMailbox Administrator -TargetFolder 'Search folder'

Open in new window

0
 
yo_beeDirector of Information TechnologyCommented:
The Transaction logs and other logs are not going to us leveraged for a search.  Your indexing of your exchange sounds like it is truncated.
I just did a simple search and found this.  https://social.technet.microsoft.com/Forums/exchange/en-US/0e2dc1a3-307f-4e2d-8eec-19b688a3cb2c/exchange-server-2007-search-results-not-showing-old-mails-after-a-new-search-index-build?forum=exchangesvrclientslegacy

May or may not be an viable option.  

Another option is to setup this mailbox in a Outlook profile and do an advance search.  This will crawl the entire mailbox.  It might be the quickest solution if this is a one off task and is not a mission critical server.
1
 
AlanConsultantCommented:
Hi,

I can't recall what PowerShell options you have with Exchange 2007, but maybe you can do it that way?

This is an example command with various parameters - maybe you can adjust to suit your needs:

Search-Mailbox -Identity "Firstname Lastname" -SearchQuery 'From:Sender@example.com Subject:"Multiple word test" sent:01/01/2013..1/1/2018' -TargetMailbox "Search Mailbox Name" -TargetFolder "Search Folder Name" -LogLevel Full

Open in new window


Hope that helps,

Alan.
1
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
jason wAuthor Commented:
Hi Thanks for the quick reply,
Your task is for 1 mailbox, I need to search the whole exchange database.
I need all email related to this particular client and it could have gone into any of our staff's mailbox.
If I search each mailbox, that'll take weeks..
Are there quicker ways?
0
 
jason wAuthor Commented:
I did a search via the power shell basic parameter but no result

get-messagetrackinglog -Recipients: clientemail@domain.com.au

Not showing any result at all.
0
 
AlanConsultantCommented:
Hi Jason,

I'm not at a server right now to check this, but I think you should be able to pipe all the mailboxes through that command so something like:

Get-MailBox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'From:clientemail@domain.com.au Sent:01/01/2013..1/1/2018' -LogLevel Full

Open in new window



Does that work?

Alan.
0
 
IvanSystem EngineerCommented:
Hi,

Message tracking log maximum age is 30 days, by default. That is why you very likely wont be able to find any information older then 30 days.

Info: https://technet.microsoft.com/en-us/library/cc539071.aspx

Regards,
Ivan.
0
 
MichelangeloConsultantCommented:
- need to search for a particular email which you presume is saved in a user mailbox
Search-mailbox is the way to go, provided that the email has not been deleted more that 30 days ago (check your retention settings)

- you need to search for logs about sending/receiving a particular email:
Get-messagetrackinglog is the way to go (last 30 days OR directory size, it depends on yr configuration)
0
 
jason wAuthor Commented:
Hi,
Thanks guys, thanks for your helps.
I've manage to kind of get it going, but am not getting the right result, got some meeting and sent item but not enough result.
I am using this
Get-mailbox -resultsize unlimited| Export-Mailbox -SubjectKeywords "key word" -TargetMailbox Administrator -TargetFolder 'target folder in administrator outlook'

(My understanding to this is, it should search and copy the item from all mailbox that has the "Key word" to a "target folder" in the administrator's profile, it seems to do that but only getting limited result, why?)
0
 
AlanConsultantCommented:
Hi,

When you say you are only getting 'limited result', what do you mean exactly?

Are you getting one or more items in the target folder in the Administrator mailbox?

If so, do you have reason to believe that there are other items that have the 'Key Word' in them that are not getting placed in that folder?


Alan.
0
 
jason wAuthor Commented:
Thanks guys, got it sorted.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.