Email metadata search

GoldFynch search allows you to search for emails matching specific metadata fields. Email metadata contains information about the email - including the email sender and recipients.

Quick searches using email metadata

GoldFynch's search bar has special "quick" search capabilities for some of the basic email metadata fields. Activate such email metadata searches using the : (colon) character. The format field : value can be used to trigger an email metadata search.

GoldFynch recognizes the following metadata fields for quick searches:

• From - who the email sender is
• To - who the email recipient is
• Subject - what the subject line of the email is
• Cc - who is being copied
• Bcc - who is being blind-copied

Searching for emails from a particular address

For example, if you want to search for emails from the address demo@goldfynch.com

• Enter from: demo@goldfynch.com in the search bar.

• GoldFynch will search all the emails in the case and retrieve all emails that have the address entered against the from field.

Once the search results are listed you can further narrow down your search results by using the filter options present in the right panel. Learn more about how you can filter and sort through your search results

Note:

• To search for emails sent To a particular address you can use the format to: name@address.com. Similarly, you can use the format cc: name@address.com and bcc: name@address.com to search for emails cc'd or bcc'd to a particular address.

• The complete email address needs to be specified when searching using any one of the address-related fields.

Searching for emails with a specific subject

To search for all emails containing the word meeting in the subject line.

• Enter subject: meeting in the search bar.

• GoldFynch will retrieve all emails that have the word meeting in the subject line.

Note: A search for, subject: meeting will also include items that have the subject as meeting today.

Performing advanced searches using email metadata

GoldFynch's advanced search system enables you to perform many different searches using email metadata. The various metadata fields can be combined to narrow down your search results.

In the sections that follow we have given a few specific examples that highlight how to execute searches using the different email-specific metadata fields.

Note: All advanced searches can be saved and run by any of your collaborators. Click here to learn how to save your searches

Email-specific search parameters for advanced searches

GoldFynch recognizes the following email-specific metadata parameters:

• subject - Restricts the search to the subject line of each email in the case
• sent-date: - Restricts the search to the sent date of each email in the case
• received-date - Restricts the search to the received date of each email in the case
• to.address - Restricts the search to the 'to' field of the email
• from.address - Restricts the search to the 'from' field of the email
• cc.address - Restricts the search to the 'cc' (carbon copy) email addresses
• bcc.address - Restricts the search to the 'bcc' field of the email
• recipient.address Restricts searches to the 'to', 'cc' and 'bcc' fields at the same time, without needing to construct and link each parameter in the query with an 'OR' operator
• participant.address - Restricts searches to the 'to', 'cc', 'bcc' and 'from' fields at the same time, without needing to construct and link each parameter in the query with an 'OR' operator (it functions identically to recipient.address but also includes the 'from' parameter)
• (field).address.domain - Restricts the search to the 'domain' component of the email (e.g. a query with the parameter "from.address.domain with a value "gmail.com" would display emails sent from addresses like "johndoe@gmail.com") The valid domain fields are 'from', 'to', 'cc', 'bcc', 'recipient', and 'participant'.

Searching for emails from a particular domain and participant

Example: To find all emails from the domain "goldfynch.com" and the participant "demo@goldfynch.com"

Follow the steps described below to search for all emails from a particular domain and a specific participant.

Step 1. Navigate to the Advanced Search View using the option in the left pane

Step 2. Click on the Create New Search button

Step 3. Click anywhere in the condition box to enter the search criteria. Alternatively, you can click on the edit icon (the pencil) that appears when you hover over the condition box

Step 4. Click on the parameter's drop-down list (by default set to 'body') and select the from.address.domain parameter

Step 5. Enter the domain address in the text box on the far right and select the IS operator

Step 6. Click on the +Click to add condition text in the query builder area to add another condition. The AND logical operator is the default operator that is set when adding a new condition to the base search criteria

Step 7. Select the participant.address from the parameter drop-down list

Step 8. Enter the participant address and select the IS operator

Step 9. Execute the search

Searching for emails with a specific subject and participant

Example: To search for all emails with the subject "schedule" and the participant demo@goldfynch.com

The steps to find all emails with a specific subject and participant have been described below:

Step 1. Navigate to the Advanced Search View using the option in the left pane

Step 2. Click on the Create New Search button

Step 3. Click on the edit icon (the pencil) or click anywhere in the condition box to enter the search criteria

Step 4. Click on the parameter's drop-down list and select the subject parameter

Step 5. Enter the subject in the text box on the far right and select the CONTAINS operator

Step 6. Click on the +Click to add condition text in the query builder area to add another condition

Step 7. Select the participant.address from the parameter drop-down list

Step 8. Enter the participant address and select the IS operator

Step 9. Execute the search

Note :

• To search for multiple participants and different subjects you can use the IS ANY OF and CONTAINS ANY OF operators. For example, if you would like to search emails that have either of the participants demo@goldfynch.com and support@goldfynch.com you just need to select the operator IS ANY OF. The query for this would, participant.address IS ANY OF (demo@goldfynch.com, support@goldfynch.com)

• To exclude a participant just select the IS NOT operator

Click here to learn more about these complex operators

Searching for emails with a specific text in its content and between a particular date range

Example: To search for all emails which have the text "interviews" in the body of the message and received between 1st September 2001 and 31st December 2010

The steps to find all emails with a specific text in their content and between a given date range have been described below:

Step 1. Navigate to the Advanced Search View using the option in the left pane

Step 2. Click on the Create New Search button

Step 3. Click on the edit icon (the pencil) or click anywhere in the condition box to enter the search criteria

Step 4. Enter the value in the textbox on the far right and select the CONTAINS operator

Step 5. Click on the +Click to add condition text in the query builder area to add another condition

Step 6. Select the received-date from the parameter drop-down list

Step 7. Enter the date and set the operator to >=

Step 8. Drag and drop the "AND" operator around the received date condition

Step 9. Click on the +Click to add condition text in the new nested AND operator to add another condition

Step 10. Select the received-date from the parameter drop-down list

Step 11. Enter the date and set the operator to <=

Step 12. Execute the search

Searching for emails with a specific text in its content by using the file type parameter

Example: To search for emails that contain the phrase "floor meeting" in their content by using the file types "eml" and "msg"

The steps to find all emails with a specific phrase in their content have been described below:

Step 1. Navigate to the Advanced Search View using the option in the left pane

Step 2. Click on the Create New Search button

Step 3. Click on the edit icon (the pencil) or click anywhere in the condition box to enter the search criteria

Step 4. Select the type parameter from the drop-down list

Step 5. Select the IS ANY OF operator from the operator drop-down list

Step 6. Click on Add Value and select the "eml" type from the drop-down list

Step 7. Click on Add Value and select the "msg" type from the drop-down list

Step 8. Click on the + Click to add condition text to add another condition in the query builder area

Step 9. Enter the value in the textbox on the far right and select the CONTAINS operator.

Step 10. Execute the search

Note:

• Using the subject and received date parameters in your search will limit the search to emails

• To retrieve all emails from your case when performing a file type search both the "eml" and "msg" file types will need to be used. Most standard email services have the "eml" file format whereas Microsoft Outlook uses the "msg" file format.

• Learn about the 6 email eDiscovery file types

Want to perform advanced searches using other parameters?

If you want to run advanced searches with other parameters and use other features of the advanced search system, check out this article!

Some of the things it lets you do include:

• Search against multiple parameters at the same time
• Use logical operators like AND, OR, and NOT to group queries together (e.g. "Find all files with the word 'Finance' OR all files with the word 'Economy'")
• Explicitly filter out results (e.g. "Find all files NOT of the file type '.docx'")
• Save your search queries for you or your collaborators to use later

Video Guide