Arctera™ Insight eDiscovery Help

To perform an advanced search

1. Access the Advanced Search tab from the Investigation or the eDiscovery tab.
2. Specify the following inputs:

   Custodians	Select All to search archives of all of the custodians that are associated with the case. Select Custom to search archives of the particular custodians. The Manage button appears. Click Manage to open the Add/Remove Custodians. Expand Selected Custodians to view the custodians selected for this search. Expand Manage Custodians and select the custodians required for this search. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.
   Custom Headers	Note: The Custom Headers option does not appear if there is no entry for a custom header for a particular group or tenant in database. Custom header does not work independently. You need to use the filter criteria to search the required items. Expand Custom Headers and set the header operator values. Click + to add new search clauses. Click - to remove search clauses that are not required. In the first column, select the required header you want to search for. Based on the data type you have selected, the operator changes. For example, if you have selected the receiver date in header, the operator values can be Between, Before inclusive and After inclusive. For a numeric or integer header value, the operator values can be Is equal to, Less than, and Greater than. If you have selected a string value in header, then the operator will be Contains. In the second column, select the available operator. In the third column, specify the text, phrase, or date that you want to search for.
   Filters	Expand Filters and set the filter operator values. The operators are explained in a table below. Select All to match all conditions you have provided. Select Any to match any of the conditions you have provided. Click + to add new search clauses, and complete a new row for each clause. Click - to remove search clauses that are not required. Searches are not case-sensitive. The search supports phrase search, Boolean operators, proximity search, and wildcard search. See Search syntax for Advanced Search.

   The Filter operators are listed below:

   Message	Entire Message	Contains / Doesn't Contain
   	Subject + Body	Contains / Doesn't Contain
   	Subject	Contains / Doesn't Contain
   	Body	Contains / Doesn't Contain
   	Inbound Message (AND)	Yes / No
   	Outbound Message (AND)	Yes / No
   	Is Hidden	Yes / No
   	IP Header	Contains / Doesn't Contain
   Date Sent/Modified(AND)	Is Equal To	Select a date
   	Before	Select a date
   	After	Select a date
   	Within Range	Select a date range
   Participants	All Senders and Recipients	Contains / Doesn't Contain
   	Senders Only	Contains / Doesn't Contain
   	Recipients Only	Contains / Doesn't Contain
   	To/Cc	Contains / Doesn't Contain
   	To	Contains / Doesn't Contain
   	Bcc	Contains / Doesn't Contain
   Classification	Classified As	Contains / Doesn't Contain Note: This option is available if the Arctera Insight Classification service is enabled for your company. Select a classification tag from the drop-down list. The list shows all the classification tags that have been applied to your company's messages in Arctera Insight Archiving. To see a tooltip with a classification tag's description, select the classification tag from the drop-down list and then point to the classification tag.
   	Sentiment Score	Is Equal To / Below (Inc.) / Above (Inc.)
   Attachment	Has Attachment	Yes / No
   	File/Attachment Name	Contains / Doesn't Contain
   	File Attachment Type	Contains / Doesn't Contain See Searchable attachment types.
   Source Type	Is - Upon selecting this operator, the application uses the OR function for the selected source types. Items from all the selected source types are filtered. Is not - Upon selecting this operator, the application uses the AND function for the selected source types. Items from all the selected source types are excluded.	Allows you to filter items (Emails, Collaboration messages, Files) based on their source types such as Exchange, Microsoft Teams, Zoom, and more. Multiple source types can be selected simultaneously. Filters items from new searches, standard searches, saved searches, ongoing searches, and ECA searches. The list of source types varies based on the services enabled for the customer. For example, if the customer has Exchange, Zoom, and Google Drive services enabled, the available source types will be limited to these three options for users belonging to that customer. Remember: The Exchange source type includes items from Exchange versions 2003 to 2019, Office 365, and items collected from unidentified source types. The Domino source type includes items from Domino versions 7 to 2.x

3. Click Search.

   You can perform a new search and optionally save it, or you can view the results of a previously saved search.

To perform query search

1. Access the Query Search tab from the Investigation or the eDiscovery tab.
2. Specify the following inputs:

   Custodians

   Select All to search archives of all of the custodians that are associated with the case. Select Custom to search archives of the particular custodians. The Manage button appears. Click Manage to open the Add/Remove Custodians. Expand Selected Custodians to view the custodians selected for this search. Expand Manage Custodians and select the custodians required for this search. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.

   Query Search

   Specify the search query by providing keywords. For example, if you are using the Source Type filter option, do the following as required: To filter items from one source type, type a query as SourceType: "<source>". Example: SourceType: "Exchange" To filter items from multiple source types, type a query as SourceType: ("<source 1>" and "<source 2>"). Example, SourceType: ("Exchange" OR "Citrix")

   Guidelines for specifying queries

   The application supports query searches only if the following necessary conditions are followed. Else, the application displays corresponding errors.

   Conditions		Examples
   Operator-specific conditions
   	The search criteria must be used after the operator and before the query text.	Correct subject:hi OR attachments:test Incorrect subject:hi OR test
   	The AND/OR/NOT operators must be written in capital letters.	Correct subject:text1 AND textbody:text2 OR attflag:true Incorrect subject:text1 and textbody:text2 or attflag:true
   	The AND/OR logical operator is missing.	Correct EntireMessage:test AND NOT Entiremessage:hi Incorrect EntireMessage:test NOT Entiremessage:hi
   Spaces-specific conditions
   	The extra space(s) between operators is not allowed.	Correct (NOT subject: test AND NOT textbody :test)
   	The space after bracket is not allowed.	Correct (NOT subject: text1) Incorrect ( NOT subject: text1)
   	The space before colon is not allowed.	Correct (NOT subject: test AND NOT textbody:test) Incorrect (NOT subject : test AND NOT textbody :test)

3. Click Search.

   You can perform a new search and optionally save it, or you can view the results of a previously saved search.