I'm new to this so sorry if wrong forum. 2010 SP2, When running a Discovery search via EMC with full logging and deduplication selected, the message I'm looking for is properly recognized in the summary text (as 1 item found) and in the csv.zip log entry as being located in the associated Archive mailbox in a particular subfolder which is correct, but yet the message does not appear in the Results folder. Only when I uncheck deduplication do I get the actual message (shown by drilling down in the results Archive Mailbox folder) that I can open and review. This is a single mailbox search and date range is the only other criteria. I can duplicate this behavior. Please advise. Thnx ( I do receive other messages from the search in that date range that reside in the Inbox, but the one that resides in Archives does not show in the results, even though there is a "hit" for it in the summary. It's like deduplication has decided not to show the only hit for that particular message.)

What you want to acheive using Discovery Search ? I can Share the Commands.Satheshwaran Manoharan | Exchange 2003/2007/2010 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you

My goal is to perform a search for all emails in a particular mailbox on a particular date using deduplication and have the results returned accurately. I have one message, the last one of a thread that was moved by the user to archives. That message will not show in the results (even though a "hit" will show and in the csv log it will actually list the hit in the archives.) For some unknown reason, the results folder will not list that email. If I run the same exact search (for all mail on a particular mailbox on a particular day) and uncheck the deduplication option, the message DOES appear in the results, this time in the folder structure of Archives (which should occur when deduplication is not selected.) So my question is more of - why does this tool not display a message only because deduplication has been selected, and why would it list it in the logs as a hit and still not show it in the results. The Discovery GUI always searches Archives - you cannot tell it not to, so I don't know that running the same search from the shell will change anything. Thnx.Dennis Osterhouse

Search-Mailbox -Identity "$SourceMailbox" -SearchQuery "Received:> $('1/01/2012') and Received:< $('12/31/2012')" -TargetMailbox "Administrator" -TargetFolder "MailboxExportContent" -logonly Change the Dates accordingly Enter the Mailbox name u want to seach = replace with Source Mailbox Exporting to Administrator "unless u use DoNotIncludeArchive Switch " it will search the archive If you remove -Logonly from the Command it will Copy the messages to the administrator mailbox into the folder name "MailboxExportContent" Please TEST IT , Before running into production Check this link for Proper Permissions and How to Execute commands - A little different Scenario http://careexchange.in/deleting-a-specific-email-from-entire-organization-in-exchange-2010-2/ Links Referred : http://technet.microsoft.com/en-us/library/dd298173.aspx http://social.technet.microsoft.com/Forums/en/exchange2010/thread/3ca4f5c6-ca45-454d-9edf-788654a1c718 Satheshwaran Manoharan | Exchange 2003/2007/2010 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you

Thank you for your detailed response. I don't doubt that running a powershell command will yield favorable results. My question was more related to a bug with the Discovery gui and/or the dedupe function that yields inconsistent results. Does Microsoft caution us not to use the gui or the depluplication option because some messages might inadvertently be dropped? Can we trust MS at all for legal e-discovery? My company has contacted MS support, and we have shown them the repeatable bug in which choosing deduplication looses certain messages which are otherwise found by not checking the deduplication option. I expect we will not be charged if MS confirms it as a bug. Thank you for your help. I can already obtain accurate results by not choosing the dedupe option (and manually deduping) but now that defeats the purpose of having a dedupe option.Dennis Osterhouse

If any bug is proved , MS won't charge for the case Created Satheshwaran Manoharan | Exchange 2003/2007/2010 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you