3

I am running exchange online via office 365. We had a customer email that our user could not locate. I ran a message trace and it found the message. We ran a search in the users outlook but the message does not show up there. How can I locate and/or forward that message to view it in it's entirety and get the attachment?

1
  • When you found the message...what does the trace show? That it was delivered to the mailbox? Can you do an e-Discovery of the email instead?
    – TheCleaner
    Dec 15, 2016 at 14:20

1 Answer 1

0

The message trace doesn't have a copy of the message, only a record of its initial delivery. Once it's in the mailbox, the trace is done. So if the user of the mailbox deletes the message, and it expires from the dumpster, then it's gone. (Did you include the dumpster when searching?)

2
  • yes, I know that it does not have a copy. I am looking for a way to find the actual message (not just data about the message) based on the message id or some other information that I can view in the message trace. the user says that he never saw the message and it cannot be located (I am not ruling out the possibility of deletion) -- if the message does still exist somewhere on the server, what is the best way to retrieve the actual message? Dec 15, 2016 at 15:16
  • Use the PowerShell Search-Mailbox command to look for it. You can search just the user's mailbox, or all mailboxes. Include the -searchdumpster option. If you don't want to use PowerShell, do a discovery search as @TheCleaner suggests.
    – longneck
    Dec 15, 2016 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .