Content Search and Pruge

%3CLINGO-SUB%20id%3D%22lingo-sub-180916%22%20slang%3D%22en-US%22%3EContent%20Search%20and%20Pruge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-180916%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20Afternoon%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuestion%20about%20the%20subject.%20When%20I%20run%20a%20content%20search%20against%20a%20known%20bad%20email%20then%20purge%20using%20New-ComplianceSearchAction%20command%2C%20what%20is%20the%20time%20it%20takes%20for%20the%20emails%20to%20be%20moved%2Fdeleted%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20just%20ran%20it%20against%20a%20email%20on%20Friday%20and%20the%20next%20day%20they%20were%20still%20in%20that%20subfolder.%20Doesn't%20seem%20to%20be%20removing%20anything.%20What%20am%20I%20missing%20here%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181194%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20and%20Pruge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181194%22%20slang%3D%22en-US%22%3E%3CP%3ESo%20when%20you%20do%20the%20content%20search%20besides%20including%20the%20initial%20subject%20you%20would%20need%20to%20include%20FW%3A%20and%20RE%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETrying%20to%20find%20the%20best%20and%20quickest%20way%20to%20delete%2Fpurge%20spam%2Fphishing%20emails.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181024%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20and%20Pruge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181024%22%20slang%3D%22en-US%22%3E%3CP%3EWhich%20subfolder%20in%20particular%20are%20we%20talking%20about%3F%20When%20you%20purge%20items%2C%20they%20will%20end%20up%20in%20the%20Deletions%20subfolder%20of%20the%20RecoverableItems%20subtree%2C%20where%20they%20will%20stay%20for%20the%20retention%20duration%20of%20that%20folder%20(30%20days).%20The%20content%20search%20results%20will%20include%20items%20from%20this%20folder%2C%20so%20it%20might%20seem%20to%20you%20that%20no%20items%20were%20affected%20by%20the%20Delete%20operation.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere's%20also%20the%20option%20that%20the%20delete%20query%20did%20not%20match%20any%20items.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Benjamin Wertz
New Contributor

Good Afternoon,

 

Question about the subject. When I run a content search against a known bad email then purge using New-ComplianceSearchAction command, what is the time it takes for the emails to be moved/deleted? 

 

I just ran it against a email on Friday and the next day they were still in that subfolder. Doesn't seem to be removing anything. What am I missing here?

2 Replies

Which subfolder in particular are we talking about? When you purge items, they will end up in the Deletions subfolder of the RecoverableItems subtree, where they will stay for the retention duration of that folder (30 days). The content search results will include items from this folder, so it might seem to you that no items were affected by the Delete operation.

 

There's also the option that the delete query did not match any items.

So when you do the content search besides including the initial subject you would need to include FW: and RE:

 

Trying to find the best and quickest way to delete/purge spam/phishing emails.