As an administrator, you can use Exchange Management Shell to search user mailboxes to find specific emails. The cmdlet that is used for searching mailboxes is Search-Mailbox.
Other than searching specific items in a mailbox, following tasks can be also performed using this cmdlet:
The below cmdlet is for searching specific message(s) in the user mailboxes. Just provide your mailbox name and specific phrase or words and the target folder name where you want to save the data.
Now, let us see how to search messages by using SearchQuery of attachment parameter in all the mailboxes.
The output result would be all the messages containing that attachment with the specified file name. It also sends a log message to the administrator’s mailbox.
Let us see the commands to search for emails with particular phrase or words coming in the email subject, copy them to the target folder and then delete them from the source mailbox.
Using this command, you can simply search and delete the messages having a specific phrase in the subject.
Run this command if you want to search specific messages that contain the specified phrase in the subject. It copies these messages to deleted messages folder and deletes those messages from the Source mailbox folder.
For easier search and conversion of items (from EDB file, live Exchange, or Office 365), users can take the help of Kernel for Exchange Recovery which is efficient third-party software that facilitates search and conversion of mailbox items within minutes.
Use of PowerShell commands to manually search and delete Exchange mailboxes messages is explained here. If you need to save search results to some other destinations or formats, you can use tools like Kernel for Exchange Recovery.