Recover content in Microsoft Exchange
Recovering content in Exchange Online that is stored in the folder structure of mailboxes, can be done via compliance searches and eDiscovery cases. To perform the steps, administrators can use the Microsoft Purview portal and the Security & Compliance Center PowerShell module.
Perform the following steps to create an eDiscovery case and export data from mailboxes:
Navigate to the Microsoft Purview portal.
Select eDiscovery > Standard in the left navigation pane.
Select + Create a case.
Enter a Case name and a meaningful Case description that helps you identify it later and select Save.
Select the case.
On the Searches tab, select + New search to associate a search with the case.
Enter a Name and Description for the search and select Next.
On the Locations page, choose the content locations you want to search and select Next.
Input the keywords and conditions for the search and select Next.
On the Review your search and create it page review the search and select Submit and then Done.
Select the Searches tab and select the search.
Select Actions and then Export results, review the Output options and select Export.
Go to the Exports tab and select the Export you generated.
Copy the Export key to the clipboard and select download results.
Fill out the information in the Export Tool and select Start.
You'll find the exported information in the form of one or more PST-files in the path you specified.
You can also use the Exchange PowerShell and the New-ComplianceSearch cmdlet to create a Search:
New-ComplianceSearch -Name <case name> -ExchangeLocation <username> -ContentMatchQuery "'Patent' AND 'Project X'"
After you create a new search, you can use the Start-ComplianceSearch cmdlet to start it:
Start-ComplianceSearch -Identity <case name>
When the search is completed, you can use the New-ComplianceSearchAction to create an export:
New-ComplianceSearchAction -SearchName <case name> -Export
To gain access to the PST-Files, you need to visit the Microsoft Purview compliance portal and download them using the ClickOnce application.
In the Microsoft Purview portal, under Solutions select Content search.
Go to the Exports tab and select the Export you generated.
Copy the Export key to the clipboard and select download results.
Fill out the information in the Export Tool and select Start.