Advanced Attachment Search
An advanced attachment search lets you search for attachments to email messages, such as images or other files. For O365 environments, you can also perform an attachment search on modern attachments. Attachments can be:
- Greater than or less than a specific size
- Files that match or do not match words in a word list
- Files that include or exclude certain words in the body
- Files that include words close to other words
Keep in mind that the AND and OR Boolean operators are the mainstay of the advanced search. Think about how to narrow or broaden a search by including or excluding certain information pertinent to the case. Remember that the AND operator narrows a search and the OR operator broadens a search. In NetGovern Search, the AND operator is represented by "All of" and the OR operator is represented by "Any of"—see Search Operators.
When searching for attachments, the ideal scenario is to take the search parameters from an attachment search you have previously conducted using the Search dialog box, and use them in an advanced message search.
It is only possible to use parameters from previous searches if you have not cleared them from the Search dialog box after running the search.
Then when you open the Advanced Search dialog box, the attachment fields will already be populated with the parameters you used in an earlier search.
If you do not want to use the previous search parameters, simply remove the rules you do not want or clear the entire Advanced Search dialog box before starting a new search.
Also, you can decide whether you want to search for attachments within the Email section and use nested queries, or search for attachments independent of other queries. Either way, the method of creating an advanced attachment query is the same.
- In the Advanced Search dialog box, click Clear.
- In the Location view, select the email archive location that contains the
custodiansyou want to target for the search.
- Click Search > Advanced Search.
- In the Attachment section, click Add Rule.
If you added a rule to the Attachment section of the Message section, your query will be part of a larger query if there are rules in the Email, Audit, or Tag groups.
- Click Attachment and select one of the following:
- All of: Searches for items that match all criteria specified in the rule.
- Any of: Searches for items that mention any criteria in the rule.
Setting the operator at this level helps you mentally set the framework of the query as you build it. As you add more rules and the complexity of the query increases, you can go back and change the operator at this level and any other.
- Click Add Rule.
- A rule is added to the Attachment group.
The Federated section of the Advanced Search dialog box is removed because it does not apply when you perform a message, attachment, or document search.
- Click the Field list and select an option from the menu. For descriptions of each option, see Attachment Properties.
- The rule updates to display the available options associated with the field you chose.
- From the operator list, select an operator. The list of operators updates according to the field you chose—see Search Operators.
- In the text field, enter the alphanumeric text or size you want to search. If you are using a word list, see About Word Lists.
- (Optional) Add more rules to the same group. Repeat this step until you have built your query.
- (Optional) If there is an existing rule you want to copy, click Copy From, select a rule, and click Add Rule.
A rule must already exist somewhere in the Advanced Search dialog box in order for you to copy it.
- (Optional) Add another group to the group. Click Add Group and add one or more rules to it. Repeat this step to continue adding groups within groups to create nested queries. For each new group, set the operator (Any of/All of) in the upper-left corner.
- New groups are created, each one in a different shade of gray.
- (Optional) In the Message section, set the search parameters. For descriptions of each option, see Message Properties.
- (Optional) In the Audit section, do the following:
- Set the operator in the upper-left corner of the group.
- Add a rule.
- Select a field.
- Select an operator.
- In the text field, enter the alphanumeric text, date, or size you want to search. You can also use a word list.
- (Optional) In the Tag section, repeat the previous step.
- Click Search to execute the query.
- The result is displayed in the Document view and the Advanced Search dialog box is closed.