Share via

Search Mails sent to myself with Attachments

Yesu Sundar Raju Eswaran 1 Reputation point
2020-08-01T19:04:21.02+00:00

Hello All,

I have received a new request that one of my Colleague sent an mail himself with some attachments and he couldn't remember the exact date's in exchange 2016.

We have backups but not sure to check as this was sent years back and he couldn't remember when it was sent, so its hard to search in backups.

Is there anyway to get details ?

Tried Get-MessageTrackingLog but not helping to find attachment details

Any help on this will be highly appreciated

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,389 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Manu Philip 16,991 Reputation points MVP
    2020-08-02T05:41:59.327+00:00

    Hi,
    I have an article in my blog here: search-mailbox-in-exchange-online. This is for exchange online but mostly same for exchange 2016 also. Basically, you should have relevant privileges assigned to search a mailbox, the search results will be copied to a mailbox. You may frame your cmdlet as shown in the example

    0 comments
  2. Eric Yin-MSFT 4,386 Reputation points
    2020-08-03T06:52:07.97+00:00

    Since the message was sent years back, has it been processed by retention policy?

    If it still in somewhere of the user mailbox and the user remembers some words of the attachment file, you can try this command: 

    Search-Mailbox -identity username -SearchQuery attachment: keyword* -TargetMailbox administrator -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

    Or use this command to return all messages with attachement from himself : 

    Search-Mailbox -identity username -SearchQuery "{HasAttachment :true} and From:'username'" -TargetMailbox administrator -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full