Enterprise Vault.cloud™ Advanced eDiscovery User Guide
- About Enterprise Vault Advanced eDiscovery
- Getting started with Advanced eDiscovery
- Advanced eDiscovery roles
- Investigations
- About Investigations
- About the Managed Accounts node
- Creating a label
- Performing a new search of accounts (Investigations tab)
- Saving a search of accounts (Investigations tab)
- Viewing or modifying a saved search (Investigations tab)
- Generating and exporting printable reports for searches (Investigations tab)
- Deleting saved searches (Investigations tab)
- Working with emails in the Investigations tab
- Hiding and unhiding emails
- Deleting emails permanently
- About the Mail Reassignment node
- Reassigning emails
- Viewing email reassignment status
- Canceling the email reassignment activity
- Generating a Mail Reassignment status report
- Sending notifications to the mail reassignment batch initiator
- About Collaboration
- Searching Collaboration messages during investigation
- Applying tags to Collaboration messages during investigation
- Case management
- About Targeted Collections
- Configuring Targeted Collection for Microsoft Teams
- About cases in the E-Discovery tab
- Case workflow summary: Discovery Administrator
- Customizing the case review status tags
- Creating a case
- Viewing the details of a case
- Editing a case
- Performing a new search of a case
- Saving a search of a case
- Viewing and modifying a saved search of a case
- Applying a search-level legal hold
- Assigning Research Sets to reviewers
- Generating printable reports for searches
- Searching and tagging Collaboration messages in E-Discovery
- Reviewing and working with emails in eDiscovery
- Email export
- Collaborative reports
- Advanced eDiscovery alerts
- Email Continuity
- Methods for searching cases and accounts
- Methods for searching tables and reports
- Advanced eDiscovery Frequently Asked Questions
- Best practices, limitations, and known issues
- Advanced eDiscovery updates in previous releases
Search examples and tips
Suppose that you want to search for the messages that relate to the resetting of a password. You can enter password reset into the Search box and click to perform a Search. The space between password and reset is treated as an AND operator, so the returned results contain any messages that include both the word password and the word reset.
Suppose that you now decide to search for the phrase password reset, and to exclude from the results any emails that reference the word Box. You can use an Advanced Search for this purpose. Click the expand icon to display the Advanced Search options. Your original Search is now shown in the first criteria row.
Insert double quotation marks around password reset to specify it as a phrase. Then click to add a second criteria row. In the new criteria row, select and enter Box in the text field.
Click to perform the Advanced Search. The search returns any items that do not contain Box but that contain the exact phrase password reset.
You could obtain the same results if you entered the following term in the Search bar:
"password reset" NOT box
Table: List of query search terms lists some possible query search terms along with examples.
Table: List of query search terms
Search term | Data type | Description | Example |
|---|---|---|---|
_All, Entiremessage | Text | Searches through all default fields. Similar to simple search or not specifying a field. | _All:(test or test2) "hello world" Entiremessage:test |
Attachments.content | Text | Search by attachment content. | Attachments.content: "Hello World" |
Attachments.extension | Text | Search by attachment file type (PDF, DOC, docx, and so on.) | Attachments.extension:docx |
Attachments.filename | Text | Search by the file name of the attachment. | Attachments.filename:Report.PDF |
Attcount | Integer | Search by the amount of attachments. | Attcount:6 |
Attflag | Boolean | Search by whether there is an attachment. | Attflag:true |
Atttext | Text | Search the content of the attachments. | Atttext:Computers |
Atttypes | Text | Search by the attachment type. | Atttypes:PDF |
Cc | Text | Search by carbon copy recipients. | Cc:JoeBlogs@example.com Sender:*@example.com |
Classification.tags | Text | Search by classification tags. | Classification.tags:PII |
Hidden | Boolean | Search whether email is visible to end user or not. | Email Hidden: Hidden:(1) Email Visible: NOT Hidden:(1) |
Inbound | Boolean | Search inbound emails. | Inbound:false |
Ipheader | IP Address | Search by the IP header of the email. | Specific IP Address: Ipheader:(10.201.1.1) IP Address using wildcards: Ipheader:(10.*.1.1) AND Ipheader:(10.201.?.1) |
Maildate | Date Time | Search by the date the message was sent. | Closed Range: Maildate: [2018-01-01T00:00:00 TO 2019-12-31T23:59:59] Open Range: Maildate: {2018-01-01T00:00:00 TO 2019-12-31T23:59:59} |
Messagesizeinkb | Floating Point Number | Search by total size of the email. | Messagesizeinkb:[2.5 TO 5] |
Outbound | Boolean | Search whether a user sent the email. | Outbound:true |
Sender | Text | Search by the sender address(es). | Sender:JoeBlogs@example.com Sender:*@example.com |
Subject | Text | Search by the subject of the email. | Subject:IT |
Textbody | Text | Search the text content of the email. | Textbody: "Hello World!" |
To | Text | Search by recipient. | To:JoeBlogs@example.com To:*@example.com |
Examples of Query Searches:
MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00]
Messagesizeinkb:[0.0 TO 11.5]
Subject:(export OR report)
MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00] AND subject:archive
Sender:(*@domain.com OR *@domain2.com OR *@domain3.com)
Atttypes:(pdf OR docx) AND atttext:process
Attachments.filename:(Report.PDF or Export.docx)
The , , and search options are available within an Advanced Search.
The option provides search results from the To, BCC, and CC fields.
The option provides search results from the From field.
The option provides search results from the From and To fields.
One way to search for items within a specific domain is to enter the domain name in the To field of an Advanced Search.
You can use wildcards to search for results from a group of similar domains. For example mycloud* returns emails for the domains that begin with mycloud.