i need to recover an email dated 3/6/2023

To recover an email dated 3/6/2023 and find out if it had an attachment, you can use the following methods depending on whether your mailbox is in Exchange Online or on-premises Exchange:

For Exchange Online:

1. Using Search-Mailbox Cmdlet: You can perform a search query against the mailbox to check for the email and its attachment. Here’s an example command:

      Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery "received:03/06/2023" -TargetMailbox "IRMailbox" -TargetFolder "Investigation" -LogLevel Full
   

2. Using New-ComplianceSearch Cmdlet: Alternatively, you can use the New-ComplianceSearch cmdlet to search for emails with attachments:

      New-ComplianceSearch -Name "Investigation" -ExchangeLocation "YourMailbox" -ContentMatchQuery "received:03/06/2023 AND hasattachment:true"
   

For On-Premises Exchange:

You can use the Get-MessageTrackingLog cmdlet to search for message delivery information. Here’s an example:

Get-MessageTrackingLog -Server Mailbox01 -Start "03/06/2023 00:00:00" -End "03/06/2023 23:59:59"

This will help you find out if the email was received on that date and if it contained an attachment.

Make sure to replace placeholders with your actual mailbox and server names as needed.

Hi KEVIN Shahin,

Thank you for posting your question in the Microsoft Q&A forum.

From your description, you want to locate and ideally recover an email (including its attachments) that was delivered to your mailbox in early or mid‑2023.

This situation is quite difficult because we are now at the end of 2025, your request involves content that is more than 2 years old. In Microsoft 365/Exchange environments, items deleted from a mailbox typically aren’t retained that long unless your organization explicitly enabled one or more of the following:

• In‑Place Hold / Litigation Hold (or Microsoft Purview retention policies) on the mailbox
• An Online Archive mailbox with policies and capacity that kept the item
• Third‑party journaling/archiving or backup

If none of these were in place, the probability of recovery is very low.

But if the emails were not deleted, you can use Outlook’s built‑in search to find messages with attachments. End‑user article: https://support.microsoft.com/en-us/office/find-all-messages-with-attachments-in-outlook-b1395e66-804f-4d05-99ef-0fbd9618fecf#id0ebf=new_outlook

For more insights, in Exchange Online, a message typically moves through these stages:

1. Deleted Items (user deletes the item) > Deletions (soft‑deleted; visible via “Recover Deleted Items”) > Purges (hard‑deleted or copy‑on‑write)
2. If Litigation/In‑Place Hold is applied, messages in the Recoverable Items folder are retained until the hold duration expires. If the hold duration is unlimited, then items are retained until the hold is removed or the hold duration is changed.

References:

• https://v4.hkg1.meaqua.org/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/enable-or-disable-single-item-recovery
• https://v4.hkg1.meaqua.org/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention

If you’re fortunate and the mailbox was on hold or the item was preserved in an Online Archive, an administrator can search and export the content:

• Use Microsoft Purview Content Search to query mailbox content.
  Article: https://v4.hkg1.meaqua.org/en-us/purview/edisc-search-mailboxes

  Note: This is an administrator function. If you’re an end‑user, please contact your IT/Compliance admin to run this search for you.

If your organization uses Exchange Server (on‑premises), you may be able to confirm delivery of the email by searching Message Tracking Logs but only if the server still retains logs from 2023. To search message tracking logs (on‑prem): https://v4.hkg1.meaqua.org/en-us/exchange/mail-flow/transport-logs/search-message-tracking-logs

Tracking logs can confirm whether the message entered your organization and whether it was delivered to a mailbox. They don’t recover content; they provide forensic delivery evidence. If logs from 2023 have been rotated or purged, this path won’t be available.

If your mailbox wasn’t on hold, the item isn’t present in the Online Archive, and there’s no journaling/backup, then regrettably, the email you’re looking for is no longer recoverable after this amount of time.

Additional references:

• https://v4.hkg1.meaqua.org/en-us/purview/archive-mailboxes

I hope the information above helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.