O365 - Exporting specific mailbox folders to pst files

By: Ricardo Viana

Some customers engage support by asking how to export specific folders to pst files.

Ediscovery can help you to achieve exporting the entire mailbox, and will not query Exchange Online Archive.

Support Engineer Ricardo Viana from O365 LATAM has built this script in order to export a single mailbox folder from Office365.

The script will map folder id's of selected mailbox and create a content search of all items in it. You can then download your results on Security and Compliance Center > Content Search.

Download the script here!

THIS CODE AND ANY ASSOCIATED INFORMATION ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK OF USE, INABILITY TO USE, OR RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.

  


$Loop = $true
While ($Loop)
{
    write-host 
    write-host +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    write-host   "Exchange Online Foler Export - Script menu"
    write-host +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    write-host
    write-host -ForegroundColor green '----------------------------------------------------------------------------------------------' 
    write-host -ForegroundColor white  -BackgroundColor DarkGreen   'SECTION A:  Create a PST of one or more folders           ' 
    write-host -ForegroundColor green '----------------------------------------------------------------------------------------------' 
    write-host                                              ' 1)  Create a PST from a mailbox '
  write-host                                              ' 2)  Create a PST from an archive '
    write-host
    write-host -ForegroundColor green  '----------------------------------------------------------------------------------------------' 
    write-host -ForegroundColor white  -BackgroundColor DarkRed 'End of PowerShell - Script menu ' 
    write-host -ForegroundColor green  '----------------------------------------------------------------------------------------------' 
    write-host -ForegroundColor Yellow            "3)  Exit the PowerShell script menu" 
    write-host

    $opt = Read-Host "Select an option [1-3]"
    write-host $opt
    switch ($opt) 


{



1
{
$email = Read-Host "Enter an email address"

if (!$credentials)
{
    $credentials = Get-Credential
}

if ($email.IndexOf("@") -ige 0)
{
   
    $emailAddress = $email

    
    if (!$ExoSession)
    {
        $ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell-liveid/ -Credential $credentials -Authentication Basic -AllowRedirection
        Import-PSSession $ExoSession -AllowClobber -DisableNameChecking
    }

    $folderQueries = @()
    $folderStatistics = Get-MailboxFolderStatistics $emailAddress 
    foreach ($folderStatistic in $folderStatistics)
    {
        $folderId = $folderStatistic.FolderId;
        $folderPath = $folderStatistic.FolderPath;
        $foldersize = $folderStatistic.Foldersize;
        $folderitems = $folderStatistic.ItemsInFolder;

        $encoding= [System.Text.Encoding]::GetEncoding("us-ascii")
        $nibbler= $encoding.GetBytes("0123456789ABCDEF");
        $folderIdBytes = [Convert]::FromBase64String($folderId);
        $indexIdBytes = New-Object byte[] 48;
        $indexIdIdx=0;
        $folderIdBytes | select -skip 23 -First 24 | %{$indexIdBytes[$indexIdIdx++]=$nibbler[$_ -shr 4];$indexIdBytes[$indexIdIdx++]=$nibbler[$_ -band 0xF]}
        $folderQuery = "folderid:$($encoding.GetString($indexIdBytes))";

        $folderStat = New-Object PSObject
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name FolderPath -Value $folderPath
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name FolderQuery -Value $folderQuery
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name Foldersize -Value $Foldersize
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name ItemsInFolder -Value $folderitems

        $folderQueries += $folderStat
    }
    Write-Host "-----Select Folders-----"
    $folderid2= $folderQueries | Out-GridView -OutputMode Multiple -Title 'Select folder/s:'
}

    Write-host "Folder selected:",$folderid2.folderpath
    $searchName = "Search"
    $searchActionName = "Search_Preview"

 
    if (!$SccSession)
    {
        $SccSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid -Credential $credentials -Authentication Basic -AllowRedirection
        Import-PSSession $SccSession -AllowClobber -DisableNameChecking
    }

   
    Remove-ComplianceSearch $searchName -Confirm:$false -ErrorAction 'SilentlyContinue'

   
    $complianceSearch = New-ComplianceSearch -Name $searchName -ContentMatchQuery $folderid2.folderquery -ExchangeLocation "$email"
    Start-ComplianceSearch $searchName
    do{
        Write-host "Waiting for search to complete..."
        Start-Sleep -s 5
        $complianceSearch = Get-ComplianceSearch $searchName
    }while ($complianceSearch.Status -ne 'Completed')


    if ($complianceSearch.Items -gt 0)
    {
        # Create a Complinace Search Action and wait for it to complete. The folders will be listed in the .Results parameter
        $complianceSearchAction = New-ComplianceSearchaction -SearchName $searchName -Preview
        do
        {
            Write-host "Waiting for search action to complete..."
            Start-Sleep -s 5
            $complianceSearchAction = Get-ComplianceSearchAction $searchActionName
        }while ($complianceSearchAction.Status -ne 'Completed')

        
        $results = Get-ComplianceSearch -Identity $complianceSearchAction.EstimateSearchRunId |select successresults
        $results= $results -replace "@{SuccessResults={", "" -replace "}}",""
        $results -match "size:","(\d+)"
        $match= $matches[1]
        $matchmb= $match/1Mb 
        $matchGb= $match/1Gb 
        Write-Host "------------------------"
        Write-Host "Results"
        Write-Host "------------------------"
        Write-Host "$results"
        Write-Host "------------------------"
        Write-Host "Found Size"
        Write-Host "$matchmb","Mb"
        Write-Host "$matchGb","Gb"
        Write-Host "________________________"
        Write-Host -foregroundcolor green "Success"
        Write-Host "________________________"
        Write-Host "go to https://protection.office.com/#/contentsearch and export your PST"
        write-host
        write-host
        Read-Host "Press Enter to get back to the menu..."
        write-host
        write-host
        }
        }
2
{
$email = Read-Host "Enter an email address"

if (!$credentials)
{
    $credentials = Get-Credential
}

if ($email.IndexOf("@") -ige 0)
{
   
    $emailAddress = $email

    
    if (!$ExoSession)
    {
        $ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell-liveid/ -Credential $credentials -Authentication Basic -AllowRedirection
        Import-PSSession $ExoSession -AllowClobber -DisableNameChecking
    }

    $folderQueries = @()
    $folderStatistics = Get-MailboxFolderStatistics $emailAddress -Archive
    foreach ($folderStatistic in $folderStatistics)
    {
        $folderId = $folderStatistic.FolderId;
        $folderPath = $folderStatistic.FolderPath;

        $encoding= [System.Text.Encoding]::GetEncoding("us-ascii")
        $nibbler= $encoding.GetBytes("0123456789ABCDEF");
        $folderIdBytes = [Convert]::FromBase64String($folderId);
        $indexIdBytes = New-Object byte[] 48;
        $indexIdIdx=0;
        $folderIdBytes | select -skip 23 -First 24 | %{$indexIdBytes[$indexIdIdx++]=$nibbler[$_ -shr 4];$indexIdBytes[$indexIdIdx++]=$nibbler[$_ -band 0xF]}
        $folderQuery = "folderid:$($encoding.GetString($indexIdBytes))";

        $folderStat = New-Object PSObject
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name FolderPath -Value $folderPath
        Add-Member -InputObject $folderStat -MemberType NoteProperty -Name FolderQuery -Value $folderQuery

        $folderQueries += $folderStat
    }
    Write-Host "-----Select Folders-----"
    $folderid2= $folderQueries | Out-GridView -OutputMode Multiple -Title 'Select folder/s:'
}

    Write-host "Folder selected:",$folderid2.folderpath
    $searchName = "Search"
    $searchActionName = "Search_Preview"

 
    if (!$SccSession)
    {
        $SccSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid -Credential $credentials -Authentication Basic -AllowRedirection
        Import-PSSession $SccSession -AllowClobber -DisableNameChecking
    }

   
    Remove-ComplianceSearch $searchName -Confirm:$false -ErrorAction 'SilentlyContinue'

   
    $complianceSearch = New-ComplianceSearch -Name $searchName -ContentMatchQuery $folderid2.folderquery -ExchangeLocation "$email"
    Start-ComplianceSearch $searchName
    do{
        Write-host "Waiting for search to complete..."
        Start-Sleep -s 5
        $complianceSearch = Get-ComplianceSearch $searchName
    }while ($complianceSearch.Status -ne 'Completed')


    if ($complianceSearch.Items -gt 0)
    {
        # Create a Complinace Search Action and wait for it to complete. The folders will be listed in the .Results parameter
        $complianceSearchAction = New-ComplianceSearchaction -SearchName $searchName -Preview
        do
        {
            Write-host "Waiting for search action to complete..."
            Start-Sleep -s 5
            $complianceSearchAction = Get-ComplianceSearchAction $searchActionName
        }while ($complianceSearchAction.Status -ne 'Completed')

        
        $results = Get-ComplianceSearch -Identity $complianceSearchAction.EstimateSearchRunId |select successresults
        $results= $results -replace "@{SuccessResults={", "" -replace "}}",""
        $results -match "size:","(\d+)"
        $match= $matches[1]
        $matchmb= $match/1Mb 
        $matchGb= $match/1Gb 
        Write-Host "------------------------"
        Write-Host "Results"
        Write-Host "------------------------"
        Write-Host "$results"
        Write-Host "------------------------"
        Write-Host "Found Size"
        Write-Host "$matchmb","Mb"
        Write-Host "$matchGb","Gb"
        Write-Host "________________________"
        Write-Host -foregroundcolor green "Success"
        Write-Host "________________________"
        Write-Host "go to https://protection.office.com/#/contentsearch and export your PST"
        write-host
        write-host
        Read-Host "Press Enter to get back to the menu..."
        write-host
        write-host
        
        
        }
        }

3
{
$Loop = $true
Exit
}
}
}