{"id":1765,"date":"2015-12-15T21:54:20","date_gmt":"2015-12-15T21:54:20","guid":{"rendered":"http:\/\/microsoftgeek.com\/?p=1765"},"modified":"2015-12-15T21:54:20","modified_gmt":"2015-12-15T21:54:20","slug":"recover-a-single-e-mail-using-search-mailbox-in-exchange-2010","status":"publish","type":"post","link":"https:\/\/microsoftgeek.com\/?p=1765","title":{"rendered":"Recover a single e-mail using Search-Mailbox in Exchange 2010"},"content":{"rendered":"<p><strong>*Note*<\/strong> This article applies to Exchange Server 2010 SP1.<\/p>\n<p><span style=\"font-size: small;\">Recently I was asked to recover a single e-mail, because he deleted it by accident. In Exchange 2007 I would use the Export-Mailbox cmdlet.<br \/>\nIn Exchange 2010 SP1 a new cmdlet has been introduced: Search-Mailbox. For general information regarding this cmdlet, check the following <\/span><a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/dd298173.aspx\"><span style=\"font-size: small;\">TechNet<\/span><\/a><span style=\"font-size: small;\"> article.<\/span><\/p>\n<p><span style=\"font-size: small;\">I went through the following steps to perform the recovery of the single e-mail:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: small;\">Assign permissions to perform the search;<\/span><\/li>\n<li><span style=\"font-size: small;\">Use the Search-Mailbox cmdlet to export the specific e-mail;<\/span><\/li>\n<li><span style=\"font-size: small;\">Use the Search-Mailbox cmdlet to recover the e-mail.<\/span><\/li>\n<\/ul>\n<p><strong><span style=\"font-size: medium;\">Scenario<\/span><\/strong><\/p>\n<p><span style=\"font-size: small;\"><a href=\"mailto:regularuser@mydomain.com\">regularuser@mydomain.com<\/a> removes an e-mail by accident and sends the following e-mail to <a href=\"mailto:admin@mydomain.com\">admin@mydomain.com<\/a>:<\/span><\/p>\n<table border=\"1\" width=\"400\" cellspacing=\"0\" cellpadding=\"2\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"400\">Hi Admin,I deleted an e-mail by accident. This is what I know:<br \/>\nReceived from: <a href=\"mailto:otheruser@mydomain.com\">otheruser@mydomain.com<\/a><br \/>\nSubject: Important e-mail #3<\/p>\n<p>Could you please restore this e-mail to my mailbox?<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong><span style=\"font-size: medium;\">Assigning permissions to my \u201cadmin account\u201d<\/span><\/strong><\/p>\n<p><span style=\"font-size: small;\">By default, no user can use the Search-Mailbox cmdlet in the EMS. To be able to do this, you will need the \u201cDiscovery Management\u201d management role group.<\/span><\/p>\n<p><span style=\"font-size: small;\">If you would try to execute a Search-Mailbox command without the needed permissions, the EMS will not recognize the cmdlet.<br \/>\nTo add your account to this group, you can use the following line:<\/span><\/p>\n<table border=\"1\" width=\"467\" cellspacing=\"0\" cellpadding=\"2\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"465\">Add-RoleGroupMember &#8220;Discovery Management&#8221; \u2013Member myadmin<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong><span style=\"font-size: medium;\">Using Search-Mailbox to export the e-mail(s)<\/span><\/strong><\/p>\n<p><span style=\"font-size: small;\">Now you are ready to export the e-mails you need to recover. Using the Search-Mailbox cmdlet with a specific Searchquery, you can filter the e-mails for the mailbox you provided.<\/span><\/p>\n<table border=\"1\" width=\"790\" cellspacing=\"0\" cellpadding=\"2\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"788\">Search-Mailbox -identity &#8220;regularuser@<a class=\"skimlinks-unlinked\" title=\"\" href=\"http:\/\/mydomain.com\/\" data-skimwords-word=\"mydomain.com\" data-skim-creative=\"500005\">mydomain.com<\/a>&#8221; -TargetMailbox &#8220;DiscoveryMailbox&#8221; -TargetFolder &#8220;regularuser&#8221; -SearchQuery \u2018Subject: &#8220;Important e-mail #3&#8221; AND from:&#8221;otheruser@<a class=\"skimlinks-unlinked\" title=\"\" href=\"http:\/\/mydomain.com\/\" data-skimwords-word=\"mydomain.com\" data-skim-creative=\"500005\">mydomain.com<\/a>&#8220;\u2019<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>This command will export all e-mails with subject: \u201cImportant e-mail #3\u201d received from e-mail address: <a href=\"mailto:%E2%80%9Cotheruser@mydomain.com\">\u201cotheruser@mydomain.com<\/a>\u201d. Of course, you could refine the search query even more. Check the following <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/bb232132.aspx#AQS\">Technet article<\/a> for possible SearchQuery syntax.<\/p>\n<p><strong><span style=\"font-size: medium;\">Using Search-Mailbox to recover the e-mail<\/span><\/strong><\/p>\n<p><span style=\"font-size: small;\">The \u201cDiscoveryMailbox\u201d now contains a folder \u201cregularuser\u201d with all e-mails filtered by the Search-Mailbox <span class=\"skimlinks-unlinked\">command.We<\/span> are going to perform a similar action for the DiscoveryMailbox to recover the e-mail to the right user.<\/span><\/p>\n<table border=\"1\" width=\"748\" cellspacing=\"0\" cellpadding=\"2\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"746\">Search-Mailbox -identity &#8220;DiscoveryMailbox&#8221; -TargetMailbox<a href=\"mailto:regularuser@mydomain.com\">regularuser@mydomain.com<\/a> -TargetFolder &#8220;Recovered emails&#8221; -SearchQuery \u2018Subject: &#8220;Important e-mail #3&#8221; AND from:&#8221;otheruser@<a class=\"skimlinks-unlinked\" title=\"\" href=\"http:\/\/mydomain.com\/\" data-skimwords-word=\"mydomain.com\" data-skim-creative=\"500005\">mydomain.com<\/a>&#8220;\u2019<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>When running this command, the e-mails will be sent back to<a href=\"mailto:regularuser@mydomain.com\">regularuser@mydomain.com<\/a>. This user can then move the e-mail to the appropriate mail folder.<\/p>\n<p><a href=\"http:\/\/microsoftgeek.com\/wp-content\/uploads\/2015\/12\/image.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-1766\" src=\"http:\/\/microsoftgeek.com\/wp-content\/uploads\/2015\/12\/image.png\" alt=\"image\" width=\"958\" height=\"131\" srcset=\"https:\/\/microsoftgeek.com\/wp-content\/uploads\/2015\/12\/image.png 958w, https:\/\/microsoftgeek.com\/wp-content\/uploads\/2015\/12\/image-300x41.png 300w\" sizes=\"auto, (max-width: 958px) 100vw, 958px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>*Note* This article applies to Exchange Server 2010 SP1. Recently I was asked to recover a single e-mail, because he deleted it by accident. In Exchange 2007 I would use the Export-Mailbox cmdlet. In Exchange 2010 SP1 a new cmdlet has been introduced: Search-Mailbox. For general information regarding this cmdlet, check the following TechNet article. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-1765","post","type-post","status-publish","format-standard","hentry","category-exchange-2010"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1765"}],"version-history":[{"count":1,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1765\/revisions"}],"predecessor-version":[{"id":1767,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1765\/revisions\/1767"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}