Exchange 2007: How to Search For And Export Mail Filtered By Sender

Soooo, your company is suing someone, or being sued, and you’ve been told find all of the mail johnny@some-co.com sent to lucy@your-domain.com and they want you to do it without letting either party know.

No problem if you are running Exchange 2007!

1. Give yourself FULL ACCESS permission to the mailbox in question using Exchange Command Shell, like this:Get-Mailbox -Identity <mailbox-to-search-export> | Add-MailboxPermission -User <your-username> -AccessRights FullAccess
   
2. Run the export command, like this:Export-Mailbox –Identity <mailbox-to-search-export@your-domain.com> -TargetMailbox <your-username@your-domain.com> -TargetFolder <anything-you-like> –SenderKeywords senders-name@senders-domain.comOR

   Export-Mailbox –Identity <mailbox-to-search-export@your-domain.com> -TargetMailbox <your-username@your-domain.com> -TargetFolder <anything-you-like> –RecipientKeywords senders-name@senders-domain.com

   OR

   Export-Mailbox –Identity <mailbox-to-search-export@your-domain.com> -TargetMailbox <your-username@your-domain.com> -TargetFolder <anything-you-like> –AllContentKeywords senders-name@senders-domain.com

   
   

3. Go to your Outlook and look for the folder (at the top of the tree) labeled <anything-you-like>.

Keep in mind the following note about Keywords:

If you use any keyword parameters, Export-Mailbox will first export all of  the messages, including messages in the dumpster, and then search the target mailbox for messages that meet the keyword criteria.

The full help on EXPORT-MAILBOX is here:

SYNTAX
export-Mailbox -Identity <MailboxIdParameter> [-AllContentKeywords <String[
]>] [-AllowDuplicates <SwitchParameter>] [-AttachmentFilenames <String[]>]
[-BadItemLimit <Int32>] [-Confirm [<SwitchParameter>]] [-ContentKeywords <S
tring[]>] [-DeleteAssociatedMessages <SwitchParameter>] [-DeleteContent <Sw
itchParameter>] [-EndDate <DateTime>] [-ExcludeFolders <MapiFolderPath[]>]
[-GlobalCatalog <Fqdn>] [-IncludeFolders <MapiFolderPath[]>] [-Locale <Cult
ureInfo>] [-MaxThreads <Int32>] [-RecipientKeywords <String[]>] [-ReportFil
e <LocalLongFullPath>] [-SenderKeywords <String[]>] [-StartDate <DateTime>]
[-SubjectKeywords <String[]>] [-ValidateOnly <SwitchParameter>] [-WhatIf [
<SwitchParameter>]] [<CommonParameters>]

export-Mailbox -Identity <MailboxIdParameter> -TargetFolder <String> -Targe
tMailbox <MailboxIdParameter> [-AllContentKeywords <String[]>] [-AllowDupli
cates <SwitchParameter>] [-AllowMerge <SwitchParameter>] [-AttachmentFilena
mes <String[]>] [-BadItemLimit <Int32>] [-Confirm [<SwitchParameter>]] [-Co
ntentKeywords <String[]>] [-DeleteAssociatedMessages <SwitchParameter>] [-D
eleteContent <SwitchParameter>] [-EndDate <DateTime>] [-ExcludeFolders <Map
iFolderPath[]>] [-GlobalCatalog <Fqdn>] [-IncludeFolders <MapiFolderPath[]>
] [-Locale <CultureInfo>] [-MaxThreads <Int32>] [-RecipientKeywords <String
[]>] [-ReportFile <LocalLongFullPath>] [-SenderKeywords <String[]>] [-Start
Date <DateTime>] [-SubjectKeywords <String[]>] [-ValidateOnly <SwitchParame
ter>] [-WhatIf [<SwitchParameter>]] [<CommonParameters>]

export-Mailbox -Identity <MailboxIdParameter> -PSTFolderPath <LongPath> [-A
llContentKeywords <String[]>] [-AllowDuplicates <SwitchParameter>] [-Attach
mentFilenames <String[]>] [-BadItemLimit <Int32>] [-Confirm [<SwitchParamet
er>]] [-ContentKeywords <String[]>] [-DeleteAssociatedMessages <SwitchParam
eter>] [-DeleteContent <SwitchParameter>] [-EndDate <DateTime>] [-ExcludeFo
lders <MapiFolderPath[]>] [-GlobalCatalog <Fqdn>] [-IncludeAssociatedMessag
es <SwitchParameter>] [-IncludeFolders <MapiFolderPath[]>] [-Locale <Cultur
eInfo>] [-MaxThreads <Int32>] [-RecipientKeywords <String[]>] [-ReportFile
<LocalLongFullPath>] [-SenderKeywords <String[]>] [-StartDate <DateTime>] [
-SubjectKeywords <String[]>] [-ValidateOnly <SwitchParameter>] [-WhatIf [<S
witchParameter>]] [<CommonParameters>]
DESCRIPTION
To run the Export-Mailbox cmdlet, the account you use must be delegated the
following:
* Exchange Server Administrator role and local Administrators group for the
target server
* Full access to the source and target mailboxes
For more information about permissions, delegating roles, and the rights th
at are required to administer Microsoft Exchange Server 2007, see Permissio
n Considerations.
To grant full access to a mailbox, use the Add-MailboxPermission cmdlet and
specify FullAccess for the AccessRights parameter.
You cannot export data from a mailbox in one forest to a mailbox in a diffe
rent forest. The source and target mailboxes must be in the same forest.
You can use the Export-Mailbox cmdlet to export data to either a folder or
a .pst file. The source and target mailboxes must be on one of the followin
g:
* Exchange 2007 server
* Exchange Server 2003 Service Pack 2 (SP2) (or later versions) server
* Exchange 2000 Server Service Pack 3 (SP3) (or later versions) server
To export data from a .pst file, you must run the Export-Mailbox cmdlet fro
m a 32-bit computer that has the following installed:
* The 32-bit version of the Exchange management tools
* Microsoft Office Outlook 2003 SP2 or later versions
Microsoft Knowledge Base articles 289999 (http://go.microsoft.com/fwlink/?l
inkid=3052&kbid=289999) and 813593 (http://go.microsoft.com/fwlink/?linkid=
3052&kbid=813593) describe a problem with using Outlook 2003 to delete seve
ral objects from a folder. You cannot use the Export-Mailbox cmdlet to dele
te more than 4,000 objects from a folder. To export more objects, you must
use Outlook 2007.
For Exchange 2007 management tools 32-bit download information, see Microso
ft Exchange Server 2007 Management Tools (32-Bit) (http://go.microsoft.com/
fwlink/?LinkId=82335).
You cannot export data to a .pst file from a mailbox that is in a recovery
storage group (RSG).
You cannot export data from a public folder database.
The Export-Mailbox cmdlet exports all empty folders and special folders to
the target location. The special folders are the following:
* Inbox
* Deleted Items
* Drafts
* Junk E-Mail
* Outbox
* Sent Items
* Journal
* Calendar
* Contacts
* Notes
* Tasks
If you export data to another mailbox by using the TargetMailbox parameter,
the Export-Mailbox cmdlet also exports messages from the dumpster of Delet
ed Items. The messages from the dumpster are converted to regular messages
when they are exported.
If you use any keyword parameters, Export-Mailbox will first export all of
the messages, including messages in the dumpster, and then search the targe
t mailbox for messages that meet the keyword criteria. Messages that were i
n the dumpster on the source mailbox are converted to regular messages on t
he target mailbox and will also be searched for keywords. Export-Mailbox th
en deletes messages on the target mailbox that do not match the keyword cri
teria. If you also use the DeleteContent parameter, Export-Mailbox will the
n delete the messages that match the keyword criteria from the source mailb
ox.
If you export data to a .pst file by using the PSTFolderPath parameter, the
Export-Mailbox cmdlet does not export messages from the dumpster.
For more information about messages in the dumpster, see How to Recover a D
eleted Item.