Arctera Enterprise Vault™ eDiscovery Administrator's Guide

To conduct an advanced search

1. On the Advanced tab in the Search area at the left of the Review pane, click New search.

   This dialog box has much in common with the visual rule builder with which you can construct analytics rules.

2. Type a name and description for the search.

3. In the Search builder area, define one or more conditions that an item must meet. To define the conditions, proceed as follows:

   • In the Select attribute drop-down list, choose an attribute of the items for which to search. For example, choose Subject if you want to search the subject lines of items.

   • In the next drop-down list, choose an operator to apply to the selected attribute. For example, if you have set the attribute to Subject, you can choose the Contains operator to search for items whose subject lines contain certain words.

   • Set the required value for the attribute. For example, when the attribute is Subject and the operator is Contains, you can type Secret to search for items whose subject lines contain this word. Note the following:

     • The search string cannot contain any punctuation characters other than the underscore character.

     • You can append an asterisk (*) as a wildcard character to the end of the search string.

     • SQL Server does not index commonly occurring words such as "the" and "and", so eDiscovery ignores these words when it encounters them in a search string. You can override this behavior by editing the SQL Server stopword file.

   • If you set the attribute to Subject, Content, or Subject or Content, choose whether to turn search stemming on or off.

     Stemming lets you match words that derive from the word that you specify. For example, the word "run" matches "running" and "ran". You cannot use wildcard characters in conditions that use stemming.

   • Click the + button to save the condition and add another one, if required. For example, you may want to search for items whose Author field contains a nominated author and whose Subject field contains a specified string.

     You define the relationship between two conditions with the And/Or buttons. And denotes that an item must match both conditions, whereas Or denotes that the item can match one condition but not the other.

   • If you want to remove a condition, click the - button at the right of its row.

   As you add conditions, they appear in the Search query area. When you become familiar with the query language, you can construct more complex queries by editing the syntax manually.

4. If you have defined one or more custodians or custodian groups with Insight eDiscovery Custodian Manager, use the fields in the Search condition settings area to specify how to search for them. In each case, you can choose to search email addresses, display names, or both. For custodian groups, you can choose to expand the distribution lists of the groups to include their members in your searches, rather than just the list names and email addresses.

   Note:

   eDiscovery does not expand the distribution lists when you use the Near operator with the attributes Subject, Content, Subject or Content, Author, To, CC, BCC, and Author or Recipients.

   The conditions that you enter in the Search conditions settings area use the custodian information that is available at the time that you build the search. This information is not updated unless you edit the search again. For example, when you create a search and select the option Expand distribution list to include members, the list members at that time are saved with the search. If the membership of the list changes later, these changes are not applied to the search until you edit and save it again.

5. Click Save, and then click Apply.