EWS Script for Searching the Dumpster and exporting message information

Scenario:  You want a logical way of exporting message information for all messages in a mailbox dumpster. In this scenario we are going to target the date of which items show  ‘deleted on’ in Outlook when in the ‘Recover Deleted Items’ folder.  The message property for this ‘Deleted On’ date is LastModifiedTime.

Script:  The following EWS script runs in 5 day increments as you are maxed out  when performing a filter/view against a dataset with EWS at a specific number.  The mailbox had a large number of recently deleted items. If you are able to, feel free to adjust the values for  $startdate.adddays(x) and $enddate.adddays(x) so you do not end up with 1000’s of files like me.

#Connect to Exchange Service
        Import-Module -Name "C:Program FilesMicrosoftExchange ServerV15BinMicrosoft.Exchange.WebServices.dll"
        $service = new-object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.Exchangeversion]::exchange2013)
        $service.Url = new-object System.Uri("https://ex2013svc1/EWS/Exchange.asmx")
   
 #Pick the Mailbox
        $mailboxname = "baduser@domain.com"
 
#Bind to the RootFolder
        $folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::RecoverableItemsDeletions,$mailboxname) 
        $RecoverFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid)

#starter Variables
        [datetime]$StartDate  = "1/1/2005"
        [datetime]$EndDate = "1/5/2005 23:59"
        $result = @() 
        $temp = @()
        $Today = Get-date

#loop it
Do{
        #Define Loop Variables
        $file_startdate = ($startdate).tostring("MMddyyyy")
        $file_enddate = ($enddate).tostring("MMddyyyy")
        $file_Datestring = $file_Startdate +"_"+$file_Enddate
        "Searching $file_DateString"
        #Create Collection and Query upon your Filter
        $sfCollection = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+SearchFilterCollection([Microsoft.Exchange.WebServices.Data.LogicalOperator]::And);
        $Sfgt = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsGreaterThan([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeReceived, $StartDate)
        $Sflt = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsLessThan([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeReceived, $EndDate)
        $sfCollection.add($Sfgt)
        $sfCollection.add($Sflt)
        $view = new-object Microsoft.Exchange.WebServices.Data.ItemView(2000000)
        $frFolderResult = $RecoverFolder.FindItems($sfCollection,$view) 
        $temp = @($frFolderResult)
        $result+= $frFolderResult
        "Current: $($temp.count)"
        "Total Count: $($result.count)"
        
#Export Results
        $temp |Select LastModifiedTime, LastModifiedName, Subject, From, DateTimeReceived  | Export-csv C:tempuser_$file_datestring.csv
        $StartDate = $StartDate.AddDays(5)
        $EndDate = $EndDate.AddDays(5)
        }While($StartDate -gt $today)

#View Results:
$result