Is there a way to search emails either via the message tracker or via PowerShell that will show me all the emails coming from a particular IP?

That is the X-Originating-IP in the Internet header.

To confirm the environment is office 365.

  • Where though? In your users mailboxes, in the incoming queue, in the logs?
    – NickW
    Jan 27 '14 at 16:23
  • @NickW I don't know much about incoming queuees with it but if office365 has logs with IPs then in the logs would be of interest to him or anybody interested in the question, and might be what he'd be fine with, but he has said X-Originating-IP i.e. reading that header from -the email-. I know outlook stores a file like inbox.dbx and that has everything so not sure where queues comes in.
    – barlop
    Jan 27 '14 at 16:30
  • As powershell is a candidate, you could ask just for powershell and ask in stackoverflow and this link mortisO mentioned cogmotive.com/blog/powershell/… may be relevant.
    – barlop
    Jan 27 '14 at 16:31
  • @barlop I'm just saying where you're looking is going to make a huge difference in terms of final results, in the mailboxes you will have the most info (full headers, etc) but you will also have users deleting mails, or moving them around.. in your logs you would have a record of every single mail, so on.. his question just lacks scope and a general purpose.
    – NickW
    Jan 27 '14 at 16:34
  • @NickW Really given that he just asked about searching email, and didn't say it has to include deleted email, a solution that searches email but doesn't do it for deleted email, is clearly a good solution with a slight very understandable weakness that maybe another improved solution could cater for.
    – barlop
    Jan 27 '14 at 17:51

I am unfamiliar with Office 365 but this webpage might be able to get you in the right direction. Are you familiar with Powershell?



If you wanted to search message header info in items in mailboxes, you might try PowerMapi.

Here's an example using that module that uses a Regular Expression pattern against the message headers of items in an inbox:

import-module PowerMapiLoader
$sess=new-MapiSession OutlookProfileName
$inbox=get-MapiFolder $sess Inbox
$found=search-MapiItems $inbox "PR_TRANSPORT_MESSAGE_HEADERS -match X-Originating-IP:10\.20\.30\.40|received:.+10\.20\.30\.40"

The regular expression lets you search then entire message header text where either the X-Originating-IP or the Received header contain the IP

Given the power of regular expressions, you can tailor this to the very simple or very complex.

Take a look at http://powermapi.com/cmdlets/search-MapiItems for more details about the search parameters.

Also, since this is a search using mapi, this is not exclusive to exchange. Any mailbox store in an outlook profile can be searched in the same way, meaning that if a bucket of PST files were delivered, the same pattern can be used against those as well. Very handy for forensic and legal work.

  • Please note if you want to promote your own product/blog you must disclose your affiliation, otherwise your answer may be flagged as spam. Please read How to not be a spammer
    – DavidPostill
    Jan 19 '17 at 0:01
  • Hmm, sorry about that. I thought the username would be enough. I'll be sure to provide a "full disclosure" statement first. Thanks for not flaming me over it! i've seen how some can be...your kindness is appreciated.
    – PowerMapi
    Jan 20 '17 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.