XADM: How to Find Mailboxes That Contain a Specific Message

You may need to find which mailboxes have messages meeting specific criteria. For example, you may need to identify which mailboxes have a known virus-infected document or a copy of a company confidential message. You can perform this task with the Microsoft Exchange Mailbox Merge program (Exmerge.exe), version 3.71.

In version 3.71, ExMerge reports the number of messages that it processes that meet the criteria you specify in the Data Selection Criteria dialog box. ExMerge outputs this information to the Exmerge.log file, normally at the root of the C drive. You can easily examine this log to extract the information you require.

Note that the subject, attachment name, and date criteria are AND'ed together, as in (Date) AND (Subj1 OR Subj2 OR... SubjN) AND (Attach1 OR Attach2 OR ... AttachN). For example, filling in the Subject field with "ILOVEYOU" and the Attachment field with ".vbs" will cause ExMerge to search for mail with both ILOVEYOU in the subject line and an attachment with a .vbs extension. However, ExMerge would not search for mail with a different subject or with an attachment having a different extension.

To find which mailboxes contain messages that meet specific criteria:

1. Rename any existing Exmerge.log files at the root of all drives.
2. Run the ExMerge program.
3. Choose the Two-step merge option, and click Next.
4. Click the Step 1 option, and then click Next.
5. Type a server name in the Exchange Server box, and then click the Options button.
6. Click the Import Procedure tab, and then click Copy data into the target store, or click Archive data to store if you also want to remove the specified messages.
7. Specify the message criteria you want to search for on the Folders, Dates, and Message Details tabs. Click OK, and then click Next.
8. Click Select All to search all mailboxes or select specific mailboxes, and then click Next. Click Next on the following page.
9. Use the standard Windows system command, find.exe, to extract the lines reporting processed messages:
   find /i "Number of messages processed for mailbox" c:\exmerge.log | find /i /v ": 0"
   This extracts the lines from the C:\Exmerge.log file that show the mailboxes processed and does not include mailboxes from which no messages were extracted.
10. You will see output similar to the following:

    ---------- C:\EXMERGE.LOG
    [18:25:28] Number of messages processed for mailbox 'Mailbox1': 6
    [18:25:29] Number of messages processed for mailbox 'Mailbox2': 2
    					

The new logging feature is a useful way to determine which .pst files contain mail and are not empty. It is more reliable than examining the size of the .pst file generated.

To obtain the latest version of ExMerge, contact Microsoft Product Support Services. For additional information on the ExMerge utility, click the article number below to view the article in the Microsoft Knowledge Base: