Veritas Enterprise Vault™ Discovery Accelerator Reviewer's Guide

When you construct a search that contains multiple options, pay attention to how each option interacts with the others in the search properties pane. Discovery Accelerator links all the selected options together with Boolean AND operators rather than OR operators. For example, suppose that you construct a search whose criteria include the following:

• A data range in the Date range section

• A search term in the Search terms section

• A file extension in the Attachments section

The search properties pane has the following sections:

• Search section

• Date range section

• Search terms section

• Archives section

• Attachments section

• Miscellaneous section

• Policies section

• Custom attributes section

The Search terms section specifies the words or phrases for which Discovery Accelerator should search in items. Click Add search term to add each word or phrase for which you want to search. Note the following:

• Discovery Accelerator searches are case-insensitive.

• Regular expressions are not permitted.

• To search for a phrase, enclose the words in quotation marks.

  For example, you can search for all items whose subject lines contain the phrase "organizational changes" by defining a search term like this one:

  SUBJ: "organizational changes"

  Discovery Accelerator considers the file names of message attachments to be their subjects. So, the preceding search term finds both items that contain the phrase "organizational changes" in their subject lines and attachments that have this phrase in their file names.

• If you type multiple words on the same line, Discovery Accelerator finds all items that contain any of the words or phrases on the line.

  Note that you must separate all the words in the search term with spaces. The following search term does not return the expected results because there is no space between the words "changes" and "license" - and consequently Discovery Accelerator searches for items that contain one or more of the following words: "organizational", "changeslicense", and "agreements".

  SUBJ: "organizational changes""license agreements"

  Similarly, the search terms license;agreements and license; agreements differ because, in the second case, a space follows the semicolon. The presence of the space causes Discovery Accelerator to find the items that contain either word, whereas the absence of the space causes Discovery Accelerator to treat the search term as a phrase.

• Press the Return key in a search box to add another line to it. If you type multiple lines in a search box, choose Any of or All of in the left box to determine whether OR or AND conditions connect the lines.

• To add the details of email targets or custodians to the From box or To box, click the Targets and custodians button at the right of the box.

  

  Note:

  If you specify as a target or custodian a Domino user whose details you synchronize with a Domino directory, you must ensure that this user has an SMTP address defined in the Domino directory. Otherwise, the search fails to find the matching items. Alternatively, you can search for such users by their display names.

• Use the fields in the Custodian Manager options area to specify how to search for custodians or custodian groups. You can choose to search email addresses, display names, or both email addresses and display names. If you select Use Email Addresses and Display Names, a custodian or custodian group must have either a matching email address or a matching display name to meet the search criteria; it does not need to have both.

  Select Include member addresses for distribution lists if you want Discovery Accelerator to search not only the display name and email address of a custodian group but also the email addresses of all the members of the group.

  The conditions that you enter in the Custodian Manager options area use the custodian information that is available at the time that you build the search. This information is not updated unless you edit the search again. For example, when you create a search and select the option Include member addresses for distribution lists, the list members at that time are saved with the search. If the membership of the list changes later, these changes are not applied to the search until you edit and save it again.

• Place the plus sign (+) in front of a word or phrase to connect it to every other word or phrase on the line with a Boolean AND condition. This sign instructs Discovery Accelerator to treat the specified word or phrase as required criteria. For example, the following search string means "(server AND test) OR (group AND test) OR (cluster AND test)":

  [Any Of] server group +test cluster

  In the following example, the search string means "(server AND test AND group) OR (cluster AND test AND group)"

  [Any Of] server +group +test cluster

• Place the minus sign (-) in front of a word or phrase to connect it to every other word or phrase on the line with a Boolean AND NOT condition. This sign instructs Discovery Accelerator to exclude from the result set those results that match the other search criteria and contain the excluded term. For example, the following search string means "(server AND NOT test) OR (group AND NOT test) OR (cluster AND NOT test)":

  [Any Of] server group -test cluster

  In the following example, the search string means "(server AND cluster AND (group AND NOT test))":

  [All Of] server
           cluster
           group -test

  A search term cannot comprise an excluded word or phrase only. When you specify such words or phrases, you must also specify a positive word or phrase that you want to appear in the search results.

• You can use an asterisk (*) wildcard to represent zero or more characters in your search. Use a question mark (?) wildcard to represent any single character.

  A wildcard search always finds items that match your search criteria and that were archived in Enterprise Vault 10.0 or later. To ensure that the search results also include items that Enterprise Vault 9.0 or earlier has archived, enter at least three other characters before the wildcard. For example, the following search string returns hits for the words "make", "maker", "making", "wonder", "wondering", and so on:

  [Any Of] mak*
           Wonder*

  You can include wildcard characters in the email addresses that you specify in a From box or To box. The following example finds items from users with an email address that includes "@acme.uk" or "@acme.hk":

  [Any Of] @acme.?k

  However, you cannot use either wildcard character after a special character, such as the ampersand (@). For example, the search string "@?cme.uk" does not produce the expected results.

• Discovery Accelerator ignores any nonalphanumeric characters in the search term, except for those that have special significance, such as the plus sign, minus sign, and question mark.

  For example, a search for the term US@100 may find instances not only of US@100 but also of US 100 and US$100. Including nonalphanumeric characters in the search term may therefore return more results than you expect.

Note the following:

• If you enter the details of several attributes, use the options in the Attribution inclusion box to determine whether the search results should match any of the attributes or all of them.

• For attributes that accept string values, you can add the details of email targets or custodians by clicking the Targets and custodians buttons at the right of the boxes.

  If you set Custodian Manager options to Use Email Addresses and Display Names, it is important to understand how Discovery Accelerator processes the details of any custodian that you enter in a custom attribute field. Discovery Accelerator links the custodian's email address to the display name with either a Boolean AND operator or an OR operator, depending on what you choose in the Operator box. For example, with Operator set to All, only items that match both the custodian's email address and the display name meet the search criteria; an item that matches just one of these details does not meet the search criteria. Set Operator to Any to link the email address and display name with an OR operator. Then any item that matches at least one detail (but not necessarily both) meets the search criteria.

• To search for attribute information that third-party software has added to the X-Headers of SMTP items, add the prefix EVXHDR. to the name of the required attribute. For example:

  EVXHDR.X-CompanyID

  The attribute name and value are case-sensitive.

• Do not enclose attribute values in quotation marks if you want to indicate that they are phrases. Instead, select Phrase as the operator for these attributes, if you have a choice. Alternatively, you can indicate that an attribute value is a phrase by replacing all the spaces with periods, as follows:

  sample.attribute.value

  This technique lets you specify multiple phrase values for the same custom attribute. For example, consider the following attribute value:

  Enterprise.Vault.Service.Account system DA.Administrator

  This value matches "Enterprise Vault Service Account", "system", and "DA Administrator".