Arctera™ Insight eDiscovery Help
- About Arctera Insight eDiscovery
- Getting started with Insight eDiscovery
- Insight eDiscovery roles
- Managing investigations
- About Targeted Collections
- About Analytics Dashboard
- About Searches in investigation
- Working with searched emails
- Working with searched collaboration messages
- Working with searched files
- Working with Advanced ECA searches
- Applying tags to the Advanced ECA search items
- Applying labels to the Advanced ECA search items
- Exporting the Advanced ECA search items
- Exporting an Advanced ECA search summary report
- About Mail Reassignment
- About labels
- About legal holds
- About Tags
- About search log
- Managing cases
- About searches in eDiscovery
- Managing case documents
- Managing redaction reasons
- Managing reviews
- Reviewing emails
- Reviewing collaboration messages
- Reviewing files
- Managing production sets
- Annotating and redacting content in native viewer
- Managing exports
- Collaborative reports
- Insight eDiscovery alerts
- Email Continuity
- Methods for searching cases and accounts
- Boolean operator searches
- Methods for searching tables and reports
- Insight eDiscovery Frequently Asked Questions
- Best practices, limitations, and known issues
- Insight eDiscovery updates in previous releases
Creating a new search
You can search the content of archive accounts from the
tab, using Advanced Search and Query Search.To create a new search
- Select the Investigations tab, and then select the node where you want to perform the new search:
To search your own mailbox, select My Mailbox > Mailbox, or select My Mailbox > New Search.
To search one or more of your managed accounts, select Managed Accounts > New Search.
To search a single managed account, select Managed Accounts > Accounts, and click the required account. The Search pane appears.
- To perform advanced search, specify the following inputs in the Advanced Search tab.
Custodians
Select All to search archives of all of the custodians that are associated with the case.
Select Custom to search archives of the particular custodians.
The Manage button appears. Click Manage to open the Add/Remove Custodians.
Expand Selected Custodians to view the custodians selected for this search.
Expand Manage Custodians and select the custodians required for this search.
Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.
Custom Headers
Note:
The Custom Headers option does not appear if there is no entry for a custom header for a particular group or tenant in database. Custom header does not work independently. You need to use the filter criteria to search the required items.
Expand Custom Headers and set the header operator values.
Click + to add new search clauses.
Click - to remove search clauses that are not required.
In the first column, select the required header you want to search for. Based on the data type you have selected, the operator changes.
For example, if you have selected the receiver date in header, the operator values can be Between, Before inclusive and After inclusive. For a numeric or integer header value, the operator values can be Is equal to, Less than, and Greater than. If you have selected a string value in header, then the operator will be Contains.
In the second column, select the available operator.
In the third column, specify the text, phrase, or date that you want to search for.
Filters
Expand Filters and set the filter operator values. The operators are explained in a table below.
Select All to match all conditions you have provided.
Select Any to match any of the conditions you have provided.
Click + to add new search clauses, and complete a new row for each clause.
Click - to remove search clauses that are not required.
Searches are not case-sensitive. The search supports phrase search, Boolean operators, proximity search, and wildcard search.
The Filter operators are listed below:
Message
Entire Message
Contains / Doesn't Contain
Subject + Body
Contains / Doesn't Contain
Subject
Contains / Doesn't Contain
Body
Contains / Doesn't Contain
Inbound Message (AND)
Yes / No
Outbound Message (AND)
Yes / No
Is Hidden
Yes / No
IP Header
Contains / Doesn't Contain
Date Sent/Modified(AND)
Is Equal To
Select a date
Before
Select a date
After
Select a date
Within Range
Select a date range
Participants
All Senders and Recipients
Contains / Doesn't Contain
Senders Only
Contains / Doesn't Contain
Recipients Only
Contains / Doesn't Contain
To/Cc
Contains / Doesn't Contain
To
Contains / Doesn't Contain
Bcc
Contains / Doesn't Contain
Classification
Note:
This option is available if the Arctera Insight Classification service is enabled for a user.
Classified As
Contains / Doesn't Contain
Select a classification tag from the drop-down list. The list shows all the classification tags that have been applied to your company's messages in Arctera Insight Archiving.
To see a tooltip with a classification tag's description, select the classification tag from the drop-down list and then point to the classification tag.
Sentiment Score
Is Equal To / Below (Inc.) / Above (Inc.)
Attachment
Has Attachment
Yes / No
File/Attachment Name
Contains / Doesn't Contain
File Attachment Type
Contains / Doesn't Contain
Archive Date
Filter archived data based on the date when emails, collaboration items, or files were archived.
Is Equal To: Finds items archived on a specific date.
Before: Finds items archived before a certain date.
After: Finds items archived after a certain date.
Within Range: Finds items archived between two chosen dates.
Select date.
Note:
Use this filter only for the data archived after January 2021. Data before January 2021 will not appear in filtered results.
Tip: If you want to use Query Search instead of Advanced Search, use the ArchiveDate: term and then build the search criteria.
Source Type
Is: Filters results that match the selected source type(s)
Is Not: Excludes results that match the selected source type(s).
Select one or more sources as needed.
Department
Note:
This option is available if the Arctera Insight Surveillance service is enabled for a user.
All Senders & Recipients: Filters data where both the sender and recipient belong to the selected department(s).
Senders Only: Filters data where only the sender belongs to the selected department(s).
Recipients Only: Filters data where only the recipient belongs to the selected department(s).
Select Any or All operator and then click Select Department.
A dialog box opens where you can choose one or more departments to apply as a filter.
Use the Search Departments field to quickly locate a department by name.
Toggle the Use Inheritance to include child departments of a selected parent department.
Click Select All on Current Page to select every department visible on the current page. Else, select the required departments individually. The count of selected departments appears in the bottom of the dialog box.
Click Select to confirm and apply them as a filter.
If you want to reset your choices, click Clear Selection. If you want to close the dialog without saving changes, click Cancel.
Important!
In Advanced Search, the search text input functionality is updated. In previous releases, when users were providing multiple text input with space, the default logical operator "AND" was getting applied. From now onwards, the default logical operator "OR" is getting applied to get user records.
This operator change from "AND" to "OR" is applied to all kind of searches. If users have previously used spaces while providing the search text inputs, their saved records (saved searches/standard searches/Ongoing searches) will be impacted as the operator is changed from "AND" to "OR".
Based on the selected attributes, when you export the search report, the Search Summary and Search Report is generated as shown in the sample image below.
- To perform query search, specify the following inputs in the Query Search tab.
Note:
Use the scroll bar to view the lengthy queries.
Custodians
Select All to search archives of all of the custodians that are associated with the case.
Select Custom to search archives of the particular custodians.
The Manage button appears. Click Manage to open the Add/Remove Custodians.
Expand Selected Custodians to view the custodians selected for this search.
Expand Manage Custodians and select the custodians required for this search.
Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.
Query Search
Specify the search query by providing keywords.
Guidelines for specifying queries
The application supports query searches only if the following necessary conditions are followed. Else, the application displays corresponding errors.
Conditions
Examples
Operator-specific conditions
The search criteria must be used after the operator and before the query text.
Correct
subject:hi OR attachments:test
Incorrect
subject:hi OR test
The AND/OR/NOT operators must be written in capital letters.
Correct
subject:text1 AND textbody:text2 OR attflag:true
Incorrect
subject:text1 and textbody:text2 or attflag:true
The AND/OR logical operator is missing.
Correct
EntireMessage:test AND NOT Entiremessage:hi
Incorrect
EntireMessage:test NOT Entiremessage:hi
Spaces-specific conditions
The extra space(s) between operators is not allowed.
Correct
(NOT subject: test AND NOT textbody :test)
The space after bracket is not allowed.
Correct
(NOT subject: text1)
Incorrect
( NOT subject: text1)
The space before colon is not allowed.
Correct
(NOT subject: test AND NOT textbody:test)
Incorrect
(NOT subject : test AND NOT textbody :test)
- To search for the Insight Surveillance item using the Item ID Filter, perform the following steps:
Note:
Click the Id icon to copy the encrypted Item ID, then select Advanced Filter, expand Item ID Filter, choose Is Equal To, and paste the Item ID into the field as shown in the sample image below.
Note:
When the Item ID Filter is selected, all other filters are cleared to return the exact matching item
- Click Search.
- Click Save Search.