Search-Mailbox cmdlets, we will review a couple of optional scenarios.

Scenario 1 – Copy mail items from the Recoverable Items folder to – Discovery Search Mailbox

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • Mail items that are stored in the Recoverable Items folder (SearchDumpsterOnly).
  • In addition, create a detailed Log (LogLevel Full).

Copy mail items from the Recoverable Items folder to – Discovery Search Mailbox

PowerShell command syntax

Search-Mailbox <Identity> -SearchDumpsterOnly -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchDumpsterOnly -TargetMailbox “Discovery Search Mailbox” -TargetFolder <John recovered mail> -LogLevel Full

Scenario 2 – Provide a report about deleted mail items

  • We don’t wish to recover mail items but instead, we just want to get a detailed report about all the mail items that reside in the Recoverable Items folder
    We want to search (but not to recover) mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • Mail items that are stored in the Recoverable Items folder (SearchDumpsterOnly).

 Provide a report about deleted mail items

PowerShell command syntax

Search-Mailbox <Identity> -SearchDumpsterOnly -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full -LogOnly

PowerShell command Example

Search-Mailbox John -SearchDumpsterOnly -TargetMailbox “Discovery Search Mailbox”-TargetFolder “David Deleted mail items” -LogLevel Full -LogOnly

Scenario 3 – Recover deleted mail items from all user mailboxes (bulk mode)

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in all of the Exchange user mailboxes (Bulk search).
  • Mail items that are stored in the Recoverable Items folder (SearchDumpsterOnly).

 Recover deleted mail items from all user mailboxes (bulk mode)

PowerShell command syntax

Get-Mailbox -ResultSize Unlimited |Search-Mailbox -SearchDumpsterOnly -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchDumpsterOnly -TargetMailbox “Discovery Search Mailbox” -TargetFolder “All users Deleted mail items” -LogLevel Full

Scenario 4 – Recover only deleted calendar mail items

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • A specific mail items – only mail items with a specific attachment
  • Mail items that are stored in the Recoverable Items folder (SearchDumpsterOnly).

 Recover only deleted calendar mail items

PowerShell command syntax

Search-Mailbox <Identity> -SearchDumpsterOnly -SearchQuery “Attachment:<Mail Type>” -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchDumpsterOnly -SearchQuery “Kind:meetings” -TargetMailbox “Discovery Search Mailbox” -TargetFolder “John calendar items” -LogLevel Full

Scenario 5 – Recover deleted mail items with a specific attachment

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • A specific mail items – only calendar mail items
  • Mail items that are stored in the Recoverable Items folder (SearchDumpsterOnly).

 Recover deleted mail items with a specific attachment

PowerShell command syntax

Search-Mailbox <Identity> -SearchDumpsterOnly -SearchQuery “Kind:<Mail Type>” -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchDumpsterOnly -SearchQuery “Kind:meetings” -TargetMailbox “Discovery Search Mailbox” -TargetFolder “John calendar items” -LogLevel Full

Scenario 6 – Recover only deleted mail items that include a specific text (mail body or subject)

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • Mail items that include a specific text string.

 Recover only deleted mail items that include a specific text (mail body or subject)

PowerShell command syntax

Search-Mailbox <Identity> -SearchQuery “<Text String>”  -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchQuery “call me ASAP” -TargetMailbox “Discovery Search Mailbox” -TargetFolder “John mail items” -LogLevel Full

Scenario 7 – Recover only deleted mail items that include a specific text in mail subject

  • We want to search and recover a mail item that answers the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • Mail items that include a specific text string that appear in the E-mail subject.

Recover only deleted mail items that include a specific text in mail subject

PowerShell command syntax

Search-Mailbox <Identity> -SearchQuery ‘Subject:”<Txt String>”‘ -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchQuery ‘Subject:”call me ASAP”‘ -TargetMailbox “Discovery Search Mailbox” -TargetFolder “John mail items” -LogLevel Full

Scenario 8 – Recover deleted mail items from a specific date range

  • We want to search and recover mail items that answer the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • Mail items that were sent on a specific date range.

Recover deleted mail items from a specific date range

PowerShell command syntax

Search-Mailbox <Identity> SearchQuery ‘(sent: sent:dd/mm/yy..dd/mm/yy)’ -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox SearchQuery ‘(sent: 09/1/2015.. 09/10/2015)’ -TargetMailbox -TargetFolder -LogLevel Full

Scenario 9 – Copy ALL mail items from a specific mailbox to – Discovery Search Mailbox

  • We want to search and recover ALL mail item that answers the following parameters:
  • Mail items that are stored in a specific Exchange user mailbox.
  • ALL Mail items from a specific mailbox
  • In addition, create a detailed Log (LogLevel Full).

 Copy ALL mail items from a specific mailbox to – Discovery Search Mailbox

PowerShell command syntax

Search-Mailbox <Identity> -TargetMailbox <Destination mailbox> -TargetFolder <Folder name> -LogLevel Full

PowerShell command Example

Search-Mailbox John -SearchDumpsterOnly -TargetMailbox “Discovery Search Mailbox” -TargetFolder <John recovered mail> -LogLevel Full

 Additional consideration related to the use of the Search-Mailbox command

  1. Assign Full access permission to the Discovery Search-Mailbox
  • in case that we want to look into the content of the Discovery Search-Mailbox by using the Outlook mail client, we will need to Assign Full access permission to the Discovery Search-Mailbox.

 Recover only deleted calendar mail items

PowerShell command syntax

Add-MailboxPermission “<Destination Mailbox>”  -User <Identity> -AccessRights FullAccess -InheritanceType all -Automapping $False

PowerShell command Example

Add-MailboxPermission “Discovery Search Mailbox”  -User John -AccessRights FullAccess -InheritanceType all -Automapping $False
  1. Assign the required permission for using the PowerShell cmdlets Search-Mailbox
  • To be able to use the PowerShell cmdlets Search-Mailbox, we will need to assign the required permission to the user account that will use the PowerShell cmdlets Search-Mailbox
  • We will need to enable the following permissions:
  • Add a user to the Discovery Management role group and assign the user account the Mailbox Import Export role

 Add user to the Discovery Management group

PowerShell command syntax

Add-RoleGroupMember -Identity “Discovery Management” -Member <Identity>

PowerShell command Example

  Add-RoleGroupMember -Identity “Discovery Management” -Member John

Assign a user “Mailbox Import Export” permission

 Assign a user “Mailbox Import Export” permission

PowerShell command syntax

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User <Identity>

PowerShell command Example

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User John
  1. Create a new discovery mailbox
  • Exchange Online provides a default mailbox that will serve as the container for the search result, the Discovery Search-Mailbox mailbox.
  • In case that we want to create an additional “Discovery Search-Mailbox mailbox” we can use a PowerShell command for creating this additional mailbox.

 Create a new discovery mailbox

PowerShell command syntax

New-Mailbox -Name <name> -Discovery

PowerShell command Example

New-Mailbox -Name “New Discovery” -Discovery