You will find me on my blog<\/a>.<\/p>\n Take it away, Thiyagu!<\/p>\n <\/p>\n Last year, a survey was conducted to figure out the number of email messages sent every day across the globe. It was estimated that approximately 294 billion messages per day are sent, which is 2.8 million messages per second. By the way, 90 percent of all email is either spam or viruses.<\/p>\n Each and every email message you send or receive has a piece of information in it called a message header<\/i>. Every email message you receive in your inbox has this information. There are different ways to view this message header, depending on which email client you are using. For example, here are instructions for getting the message header<\/a> of an email address if you are using Outlook 2010. The following figure shows how a message header looks.<\/p>\n This text information contains a lot of details about the message you have received. RFC 822<\/a> tells how to place information about an email message into this header.<\/p>\n For now, focus on the green box in the preceding figure. This section has information about how this message got to your inbox. For an email to come to your inbox, it takes so many routes. That is our main focus in today’s post: we want to get this data parsed out of this messy text and present it in a nice little table so that you can understand what really happened with that email message.<\/p>\n Whenever you try to make sense of an email message header, read it from the bottom up. The above piece of code has only four lines and is cut into different lines. Here is how it looks after removing the unwanted lines:<\/p>\n You see, it looks already a lot cleaner, after you remove those extra lines. Take a look at the boxes and circles in the image above, and read it like this:<\/p>\n Received the email from Server “Corp.red.com ([16.25.5.17])” by Server “Singapore.red.com ([15.60.22.16])” with protocol “mapi id 14.01.0323.002” and at time “Wed, 13 Jul 2011 18:50:16 +0800” , which is UTC +8 (which is Singapore), you can tell from the server which received the message it says “Singapore.red.com”<\/p>\n If that did not make much sense, it might help to visualize it like in the following figure.<\/p>\n Now, this server will send the message again to another server and so on. Each trip from server to server is called a hop<\/i>. The hop chain continues until it finally reaches your inbox. At times, there might be a delay when going through one of these chains. Maybe a server was busy or there was too much load, which could cause delays to email being delivered to your inbox. In this example, we have four lines, so we have four hops for the email to reach your mailbox.<\/p>\n Enough of theory. Let’s talk about Windows PowerShell, starting with another figure.<\/p>\n We have to extract the piece of information between the above-mentioned sections to form our objects. You can see from the preceding screenshot that it has a pattern. Luckily, this is where regular expressions come to the rescue. Read this great article by PowerShell MVP Tome about regular expressions and Windows PowerShell<\/a>.<\/p>\n We need to get four pieces of information from each line:<\/p>\n Here is the regular expression pattern I came up with:<\/p>\n $regexFrom1 = ‘Received: from([\\s\\S]*?)by([\\s\\S]*?)with([\\s\\S]*?);([(\\s\\S)*]{32,36})(?:\\s\\S*?)’<\/p>\n Can you believe, that the above regular expression pattern can do all four of the things I said above? If you are good at Windows PowerShell and still haven’t used regular expressions, you are missing an important weapon in your Windows PowerShell arsenal.<\/p>\n Note <\/b> Check out this webcast<\/a> by Tome. It is a great introduction to regular expressions.<\/p>\n Because we do not know how the text is going to be in the message header, it is good to read the whole data as one long string and work with it. Here is the technique to do read a file into one big string.<\/p>\n $text = [System.IO.File]::OpenText(“C:\\Scripts\\msg6.txt”).ReadToEnd()<\/p>\n His file now has the same information as the first screenshot in this post. I wanted to write a function that would take this $text<\/b> as input, process the string, give out all the parsed data, package it in an array of PSObjects<\/b>, and return them. I used Select-String<\/b> along with the regular expression pattern and iterated through all the matches I got.<\/p>\n Here is how I did that:<\/p>\n Function Process-ReceivedFrom<\/p>\n {<\/p>\n Param($text)<\/p>\n $regexFrom1 = ‘Received: from([\\s\\S]*?)by([\\s\\S]*?)with([\\s\\S]*?);([(\\s\\S)*]{32,36})(?:\\s\\S*?)’<\/p>\n $fromMatches = $text | Select-String -Pattern $regexFrom1 -AllMatches<\/p>\n if ($fromMatches)<\/p>\n {<\/p>\n $rfArray = @()<\/p>\n $fromMatches.Matches | foreach{<\/p>\n $from = Clean-string $_.groups[1].value<\/p>\n $by = Clean-string $_.groups[2].value<\/p>\n $with = Clean-string $_.groups[3].value<\/p>\n Switch -wildcard ($with)<\/p>\n {<\/p>\n “SMTP*” {$with = “SMTP”}<\/p>\n “ESMTP*” {$with = “ESMTP”}<\/p>\n default{}<\/p>\n }<\/p>\n $time = Clean-string $_.groups[4].value<\/p>\n $fromhash = @{<\/p>\n ReceivedFromFrom = $from<\/p>\n ReceivedFromBy = $by<\/p>\n ReceivedFromWith = $with<\/p>\n ReceivedFromTime = [Datetime]$time<\/p>\n } <\/p>\n $fromArray = New-Object -TypeName PSObject -Property $fromhash <\/p>\n $rfArray += $fromArray <\/p>\n }<\/p>\n $rfArray<\/p>\n }<\/p>\n else<\/p>\n {<\/p>\n return $null<\/p>\n }<\/p>\n }<\/p>\n To explain the regular expression a little bit:<\/p>\n ‘Received: from([\\s\\S]*?)by([\\s\\S]*?)with([\\s\\S]*?);([(\\s\\S)*]{32,36})(?:\\s\\S*?)’<\/p>\n <\/p>\n Each of those is matched into groups and then you can access them using the matches<\/b> property. This is true except for the last one (in the world of regular expressions, “?:” means don’t group them). This is the class it will get stored in: Microsoft.PowerShell.Commands.MatchInfo<\/b>. <\/i><\/p>\n I just loop through the matches and then build a PSObject<\/b> for each of the matches. Now, if I output the results of the function to a gridview, I see what is shown in the following figure:<\/p>\n Read the next part tomorrow, where I show how I put the pieces together to get delay information from different hops and then finally to build a GUI tool for this functionality.<\/p>\n <\/p>\n Thiyagu, this is an excellent article. Thank you for sharing your time with us and for sharing your expertise with the Windows PowerShell community. I am really looking forward to part 2 tomorrow!<\/p>\n I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Summary: Guest Blogger Thiyagu teaches how to use Windows PowerShell to parse and analyze email message headers. Microsoft Scripting Guy Ed Wilson here. Thiyagarajan Parthiban is our guest blogger today with an interesting article about using Windows PowerShell to analyze Exchange email. First, though, let’s learn something about Thiyagu. I am the founder of […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[56,28,180,3,225,45],"class_list":["post-12971","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-guest-blogger","tag-messaging-and-communication","tag-microsoft-exchange-2010","tag-scripting-guy","tag-thiyagu","tag-windows-powershell"],"acf":[],"blog_post_summary":" Summary: Guest Blogger Thiyagu teaches how to use Windows PowerShell to parse and analyze email message headers. Microsoft Scripting Guy Ed Wilson here. Thiyagarajan Parthiban is our guest blogger today with an interesting article about using Windows PowerShell to analyze Exchange email. First, though, let’s learn something about Thiyagu. I am the founder of […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=12971"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12971\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=12971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=12971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=12971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3782.HSG-8-18-11-1.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8623.HSG-8-18-11-2.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/7382.HSG-8-18-11-3.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8741.HSG-8-18-11-4.jpg\" "\\"Image")
<\/a><\/p>\n\n
\n
\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/1586.HSG-8-18-11-5.jpg\" "\\"Image")
<\/a> <\/p>\n