Email search for a time period

[lmendel]

Hi,

We have a customer for whom we provide M365 backup services. Although they have chosen not to invest in a proper journaling or compliance solution, they occasionally request searches for specific emails within defined timeframes typically in anticipation of possible litigation.

For example, they may request a search for all emails sent from sender@imaginary.email.com to mailbox@tenantxyz.com between 1 January 2024, and 1 March 2024.

I’ve explained to them that our backup solution is not designed as a compliance search or journaling tool, and there’s a possibility the requested emails may not be available. However, given that backups are their only option, they’re willing to cover any costs associated with performing these searches.

Could you advise on how to script such a search—either using PowerShell or a REST API—based on the data available in the M365 backups?

Best regards

[lmendel]

Anyone?

[track1044]

I would tell them to use Compliance Search (eDiscovery) in M365 and this would not be needed.Aand most likely save them a lot of money and headache in the process.

If you do this on the backup side, which it is not meant for, you would have to go trough each Restore Point within that period, get all backup items from the sender and filter on the sent email.
It would take quite a while to develop, setup and troubleshoot, but I wouldn't say its impossible. Just very time consuming. You would also have to validate the output to make sure nothing is missed if the company is to trust the data. That will take a bit as well.
The data can be feched via API or Powershell, so thats a preference thing.