DataCove Search Methodology
An Introduction to DataCove’s Search System
Understanding the Search Query Interface
Saving a Search for Later Reuse
Adding Additional Search Parameters
Finding a Recently Run Search for Editing and Rerun
Email Export and Options Overview
Interpreting the Email Results List and Reading Pane
Search Query Fields
Social Security Number in Subject Line
Social Security Number in Text Field
Comment Author, Tag and Contents
Search Term Syntax
Exporting Emails from DataCove
An Introduction to DataCove’s Search System
DataCove’s search system is the heart of its functionality. What good is an archive of data if you cannot search it efficiently for any given investigation or eDiscovery request, right?
To that end, Tangent has expended an enormous amount of manpower and energy to fine tune and specialize the DataCove’s search capabilities towards text based emails (and text-based attachments), using a heavily customized version of the Lucene search engine as the backbone of the feature. Lucene is already a speed demon in terms of how fast it can return results; combine that with the system’s intelligent data caching and refined indexing (not to mention copious hardware resources) and DataCove will consistently begin returning results within a mere two seconds of the initiation of most searches.
This article will discuss DataCove’s search functionality in-depth, starting with an overview of the layout and customizability of the search page, moving onto definitions of the standard search fields and how they can be used and then onwards to advanced search options, like wildcards, term grouping and exporting emails for counsel review.
With Search being such an incredibly large topic all on its own, various related functions to Search, such as automated searches, redaction of content, legal holds and more, will only be mentioned briefly in this article. Additional content on those features can be found in their own dedicated articles or by contacting DataCove Support.
To begin, let’s familiarize ourselves with the Search interface.
DataCove’s search interface can be found by logging into the DataCove web interface and selecting Email Viewing in the top header bar.
The Search page is the default landing page for the Email Viewing section, but if navigated away from by accident, can always be found by selecting it at the top of the left hand side navigation menu.
The Query Terms interface is the “Question” part of DataCove’s search subsystem, wherein the terms being used in the investigation will be combined and populated in order to form the Search Query. Empty fields do not have any impact on a search query, but every field that is used and populated does implement their particular terms and syntax into the query and means that all resultant emails must match their stated parameters.
Fields in this section can dragged and dropped to modify the “order” they display in, with the Save Layout button locking in that search order for the profile of the user who saved it.
Selecting the circled X “(x)” button to the right hand side of any given field will remove it from the field of view and terminate any populated search syntax within it, entirely removing it from the query. These fields can always be added back in later if needed.
Selecting the Clear Fields button will empty out any populated fields and return them to their default state, which is great for cleaning up a search query to prepare for a new one.
Selecting the Save Search Criteria button will allow for the creation of a Saved Search, which is a search that has had its Query Terms prepopulated and is available to run again easily in the future.
Saved Searches can be used to rerun a previously useful search, to modify the saved search content to run against another email address or with different search terms and even for setting up automated searches using the Scheduled Searches functionality.
When saving a search, the Saved Search must be given a name and a description of what the search is for. This helps with locating the search later in the Saved Search list, as well as understanding what its purpose is at a glance.
A good example of a Saved Search would be an investigation that searches for a few particular terms, maybe some inappropriate language, that needs to be run every now and then for different groups of users to ensure the organization’s Terms of Service are not being violated. Saving the search this way would allow those terms to be ready to go with only the users being search for needing to be changed upon rerun.
Saved Searches can later be found by clicking Email Viewing in the top header bar, then selected Saved Searches on the left hand side menu.
Selecting the Magnifying Glass on the right hand side of any Email Address fields will spawn a new window for the Look Up Database.
DataCove maintains a list of every single email address it has ever seen, which can be used to find addresses at unfamiliar domains, especially those of external senders or recipients, as well as validate the correct spelling of a username or domain name when the eDiscovery request may not provide it (or provide an incorrect name or address).
Typing in any alphanumeric characters into the Search Terms field will start rendering results immediately, with asterisk based wildcards being able to find all variations of either a username or domain name depending on where it is placed.
In the pictured example, all we may know is that the email address of the person being investigated starts with an “N.” In this scenario, using an ‘N’ with and asterisk after it (which functions as a multiple-character wildcard) will bring up any email address at any domain that starts with the letter ‘N.’
Another variant of this search might be looking for “NickH@tan*”, which will find any users with the email username of ‘NickH’ at any domain that begins with ‘Tan’, such as Tangent, TanDog, Tannhauser, etc.
The more detail used in the Look Up search, the narrower the results will be and can help isolate the email address of the individual needing eDiscovery.
Once the desired targets are found, select the Add Selections button to add them to the Email Address field that the Look Up was initiated on, then click OK to populate the now-found address into the field.
Selecting the Add Search Term button towards the bottom middle of the Query Terms will spawn a new submenu from which additional search fields can be added to the Query, including duplicates of certain existing fields, like multiple From or To fields.
Additional duplicate fields can be used to create more complex Search Queries, such as a search that allows finding all emails Sent to UserA@domainname.com From UserB@domainname.com, but excluding emails sent From UserB@domainname.com to both UserA@domainname.com and UserC@domainname.com. These kinds of advanced filtering searches will be discussed further on.
These additional fields, once selected, will then spawn under the Query Terms section and will become available for use.
A full breakout of the different options, what they do and how they can be used will be covered later in this guide.
Lastly, the Search button initiates the search using the Query Terms specified above. To maximize the amount of viewable space of the email results, the Query Terms pane will fold up and minimize once a search starts. The Query Terms pane can be expanded again by clicking the Plus Sign (+) to review what the search terms used were, or to refine them for a new search.
A search is considered in progress when the text counting up the results is incrementing higher. This is denoted in red text.
Emails matching the search criteria will appear in the search result pane below this number and can be viewed while the search continues adding matching content, but certain actions, like exports, are best run only after the search finishes.
When a search completes, the result count number will reflect back in black text, and a green "The search has completed” confirmation blurb will appear above the now-minimized Query Terms section.
After a search executes, a ‘reusable’ record of it is made containing which search parameters were used and the date stamp of when it was run.
This record can be found by selecting Email Viewing in the top header bar, followed by clicking Recent Searches on the left hand side menu.
The last 100 searches made by the logged in user are tracked here and can be rerun using the Run Search button, or by selecting Load Search, the parameters used can be reloaded automatically into a fresh Search, where they can be edited or refined with additional terms to run a new variant of the original search.
This is especially useful when discovering new potential paths an investigation may be taking and needing to run related searches.
Directly below the Query Terms section is the Email Options menu.
This menu concerns different action types that are available to take upon an email after a search completes, along with the ability to sort the results using different views, such as the newest emails to oldest emails (the default), oldest to newest, alphabetically both ways by the Sender Email Address and alphabetically both ways by the Subject Line.
Note: Some options require the selection of an email, performed by clicking the small checkbox on the left hand side of that email, before they will become usable. Such options will remain greyed out until an email is selected. The Select All checkbox to the side of the total email results offers this same option for all emails that have rendered in the search.
The Email Options menu includes:
Export creates copies of the emails (replete with attachments) from DataCove and prepares them into an eDiscovery-ready format like EML, PDF, CSV or PST filetypes.
Forward allows for the forwarding of individual or small groups of messages to a specified email address for rapid restoration without any extra steps. Forwarding emails requires the DataCove’s Outgoing SMTP engine to be configured in advance (found under Configuration > Outgoing SMTP).
Print creates a printable web page of all of the selected emails in sequence, with a notation of any attachment filenames (this method does not make the attachments printable as well).
Tag applies informational Tags and/or Legal Holds to emails, for sorting, tracking and if enabled, specialty Retention Schedules. Tags and Legal Holds used in this manner are visible to all users of the system with the appropriate Tag Management permission.
Label is similar to Tag, in that it is used for sorting and grouping of emails, but does not possess any sort of Retention Policy integration. In addition, Labels are “per user” in their visibility and other users cannot see what another user has labeled an email. These are best used by end users who want to manage and sort their own emails on the system.
Comments are used to create notes on emails that can be searched upon later, but are less formal than the Tag subsystem and have been largely superseded by the Tag functionality. It is no longer recommended to use this function.
Print to PDF is a type of export that allows for quick selection of which emails should be exported to PDF, along with any attachments contained within (if desired), without going through the formal Export process and its additional steps.
Header spawns a new window containing the Message Headers of the email as it arrived in DataCove. This can be incredibly valuable in understanding the path an email took to reach DataCove since it shows the origin, every hop along the way and any modifiers it may have sustained on the way before finally being safely archived. These are occasionally called up in eDiscovery events to ensure that the email’s chain of custody can be corroborated by other server logs to show provenance.
Conversation creates a threaded, cohesive view for Text Messages and Teams Conversations that DataCove has recorded. This shows all participants in a conversation and date stamps each entry, in order of dispatch, so a standardized view of the conversation can take place without having to click on each message for a snippet of the content and having to piece them together manually.
Lastly, at the bottom of the screen are the Email Results List and the Reading Pane.
The Email Results List resides on the left hand side and shows all of the matching results to the Query Terms previously specified. In situations where more results are found than can be rendered on the user’s screen, a scroll bar will appear on the right hand side of this List to scroll through the matched results.
These are sorted, by default, with the most recent results on top.
The Subject Line appears a the top of of each individual entry, with the date the email was sent towards the right.
On the second line, the Email Sender’s address is listed along with the time the message was sent on the right.
Small symbols may be listed, like a “price tag” or “chat bubble.” These denote that the message being seen has a Tag or Comments applied to it, with detail on those showing up when viewing a message in the Reading Pane.
When an email is selected from this list, it will render on the right hand side of the screen: the Reading Pane.
The Reading Pane displays the selected email, with any Tags that have been applied to this email appearing at the top. Legal Holds are displayed as red-colored Tags.
Immediately below the Tag section (if present) is the email’s envelope information, showing who the message was sent From, who it was sent To, any Carbon Copy (CC) recipients, any Blind Carbon Copy (BCC) recipients, the date and time stamps of the message, the Subject Line of the email and any attachments that were on it.
Below this envelope is the actual email content, which may be a single message or a entire conversation chain depending on “where” in the conversation this particular email takes place. Longer email chains will have scroll bars to the right hand side of the Reading Pane to scroll through their content.
When Search Terms are found within the Message Body, they will be highlighted in yellow and red for quick identification, allowing for rapid disposition of how the message met the search filters.
With this overview of the basics of DataCove’s search interface complete, let’s begin discussing the various fields that can be searched upon.
Search Query Fields
DataCove possesses a multitude of different content fields that can be mixed and matched to search for information within emails, text messages and Teams conversations, which can be categorized into “primary” search fields, “secondary” search fields and lastly, “specialty” search fields. For any given query, it’s common for at least a couple of Primary search fields to be used and possibly a Secondary search field added onto it for refinement. Specialty search fields get used when exacting requirements need to met for content location or the existence of additional parameters.
Primary Search Query Fields consist of several broad scopes, suitable for quickly locating any data that would be responsive to the investigation to validate whether there is “anything to find” in the first place. These scopes are intentionally broad for this reason, with the general search process starting with these and then getting more refined (if needed) with the Secondary and Specialty Query Fields.
For many organizations just seeking to comply with Freedom of Information Act (FOIA) or Public Records Requests (PRR), these types of Primary Queries will be sufficient most of the time to gather the desired data for follow-on redaction and distribution. For organizations who need to go deeper, are given very specific search terms or are trying to specifically trim any “fat” from the results before exporting them for provision, these Primary Queries will lay the foundation of the subsequent queries.
Primary Fields include zones like Email Sent Date, From Email Address, To Email Address, To/From Email Address and Text.
Secondary Search Query Fields work in conjunction with Primary Search Query Fields to tighten up the scope of a search, allowing for searches in specific areas that are of interest.
As an example, the Primary Search Query Field of “Text” searches Subject Line, Message Body, Attachment Name and Attachment Contents all in one-go, which can be overly broad and bring back far more results than are desired. Instead of using that Text field, using the Secondary fields that are specific to the desired location of the content can greatly narrow down the results.
Secondary Fields include areas like Subject Line, Message Body, Attachment Name, Attachment Type and Attachment Contents, Attachment Available.
Specialty Search Query Fields allow for extremely tight filtering of results and fantastic customizability. While relatively rarely used, their power is not to be understated in how rapidly it can trim down results to only pertinent content. When used in very large investigations or eDiscovery situations, these Fields can dramatically reduce the amount of work involved and allow for more efficient “packaging” of exported data.
Department Search limiting allows for creation of groups of users, by email address (both internal and external addresses are accepted) for which all subsequent searches can be run against, massively reducing the scope of any search to just the relevant cluster of people. While this can be done using Primary Fields, the ability to repeat results and “containerize” different groups of users allows for a significant reduction in results that don’t match the personnel needed.
Consequently, searching for specific data codes, like Social Security Numbers, requires specific syntax to be used that is easily mistyped. Using dedicated fields for this allows for far faster and reduced-error-rate data entry.
Specialty Fields include Department, Message ID, SSN-in-Subject, SSN-in-Text, Folder/Tag/Label Name, Comment-related Searches and Random Sample.
With these baseline concepts established, let’s dive into the specific search fields and how they work.
Sent Date is the date or date range of when the emails being searched for would’ve been sent.
Many search requests specify a particular date of an email having been sent, such as June 25, 2014, while others may have a range, such as June 3, 2014 to June 20, 2014. Others may want all emails before or after a specific date. For all of these scenarios, DataCove has support for them.
The Sent Date field is composed of two dropdown boxes: the ‘Search Direction’ parameter and the Calendar.
Search Direction determines the “route” that the search will take and alters the Calendar option accordingly. Routes can be forward from a specified point in time, backward from a specified point in time or between two distinct points in time (the most common type).
Calendar is a selectable zone that allows for easy mouse-click driven selection of date by selecting year, month and day, or manual data entry of the desired date in the text field atop it.
The Search Direction is composed of five different options:
Relative: Relative Directionality operates over a time scale that is "relative" to today. So, if the "Past Month" option is used under the Relative parameter, that means the search will go back to one month from present day, present day being determined by the date the user has logged in and run the search (and the DataCove’s system clock setting).
“Past 7 Days” is basically one week back from present day.
“Past Year” is the last 365 days from present day.
These are all essentially just a shorthand way of running a "Between These Dates" search without having to set two separate calendars and are used for ‘relatively’ (forgive the pun) recent emails.
On: The “On” Search Direction will return emails that were sent exactly on the date specified in the Calendar parameter. When it is known exactly on which day the email was sent, this is the fastest way of zeroing in on it.
Before: The “Before” Search Direction will return emails that were sent at any date prior to the date specified in the Calendar parameter, going all the way to the beginning of time as far as emails on the DataCove goes. For systems with emails ranging back into the 2000’s or 1990’s, this Search Direction can cause the search to take a bit longer due to how many indices must be opened.
After: The “After” Search Direction will return emails that were sent date after the date specified in the Calendar parameter, going all the way to the present day. Depending on how far back in time the starting date is set to, it may cause the search to take a little longer to open the appropriate indices and scan the data inside.
Between: The “Between” Search Direction will return emails that were sent between two dates as specified on two separate calendars, forming a range of time. For example, this search could be used to find emails sent between 2/23/15 and 8/12/22. This particular type of search is considered the optimal kind both in terms of utility and performance, as the vast majority of investigatory requests come with a range of time to search within and this minimizes the number of indices the DataCove must open to then run subsequent search parameters upon.
Sent Date is the single most important Primary Field, as it determines how far back in time the DataCove must hunt and is the most resource determinant parameter (searches over a wider range of time take more resources to run and will take longer, rather than more concise searches over small and specific periods of time).
Note: Historical emails imported into DataCove from prior to its installation will be searchable from their original Sent Date, not the date they were fetched into DataCove. This maintains the proper search continuity as expected, so searching for emails from 1996 should still have the year 1996 specified in the Sent Date field, rather than the date of import.
The From field allows for the specification of the sender’s email address or display name, or a combination thereof. This field is broken into two sections: the Boolean Operator dropdown menu and the From Address Text field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the From Text field, as a convenience so the searcher does not need to manually type them in themselves.
Contains All Of: Contains all of the email addresses/display names listed. Logically, an email cannot be sent from multiple people, so this Operator is only used in a From field when searching for a Display Name and ensuring that both first name and last name are matched. As an example, if a search were run for "Mike" on the average DataCove, it would bring up a whole bunch of results. Narrowing it down to "Mike Smith" and using the “Contains All Of” Operator is the recommended approach, as using the default “Contains One or More Of” would find display names that match either “Mike” or “Smith;” likely with many, many more results than desired.
Contains One or More Of: Contains one or more of the email addresses listed. This is used when searching for emails sent that may have been sent from a single address or multiple potential email addresses. Searching for UserA@domain.com, UserB@domain.com and UserC@domain.com can be executed with a single search by populating all possible sender addresses in this field and dividing them with a semicolon.
Contains None Of: Contains none of the email addresses listed. A more complex search option that allows for the prevention of results rendering from a particular email address or display name.
Note: Additional “From” Fields can be added to the search query using the Add Search Term function, allowing for multiple addresses to be specified with combinations of “Contains None Of” and “Contains One or More Of” to work in conjunction.
Note: In general, the “Contains One or More Of” Boolean Operator is the recommended option for most From Address searches.
Once the desired Boolean Operator has been selected, the From Address Text field can now be populated.
The From Address Text field can be as specific as “Sender@domain.com” or, in situations where the exact email address is unknown, searching ‘around’ what is known about the sender such as their domain name.
For example, using a preceding wildcard in the Username portion of the address, such as “*@domain.com” will find all users with a domain.com email address.
Alternatively, searching for Geoffrey@*.com will find all users with Geoffrey as their username at any domain that ends in the .com top level domain.
When only the name of the sender is known rather than an email address, using the Display Name of the user, such as Joe Smith, will find all emails with Joe or Smith in the name, which can then allow for drilling down on the results to find their email address for a subsequent refined search.
The To field allows for the specification of the recipient’s email address or display name, or a combination thereof. This field is broken into two sections: the Boolean Operator dropdown menu and the To Address Text field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the To Text field, as a convenience so the searcher does not need to manually type them in themselves.
Contains All Of: Contains all of the email addresses/display names listed. This matches only against emails that have every email address or display name specified. If three email addresses are being searched for but only two of the specified addresses are on the email, that result will not be returned. All terms must be present to match.
Contains One or More Of: Contains one or more of the email addresses listed. If three email addresses are specified in the search and only two email addresses are contained in an email, the result will be returned as at least one specified email address matched. Searching for emails sent to UserA@domain.com, UserB@domain.com and UserC@domain.com can be executed with a single search by populating all possible recipient addresses in this field and dividing them with a semicolon.
Contains None Of: Contains none of the email addresses listed. A more complex search option that allows for the prevention of results rendering that were sent to a particular email address or display name.
Note: Additional “To” Fields can be added to the search query using the Add Search Term function, allowing for multiple addresses to be specified with combinations of “Contains None Of” and “Contains One or More Of” to work in conjunction.
Note: In general, the “Contains One or More Of” Boolean Operator is the recommended option for most To Address searches.
Once the desired Boolean Operator has been selected, the To Address Text field can now be populated.
The To Address Text field can be as specific as “Sender@domain.com” or, in situations where the exact email address is unknown, searching ‘around’ what is known about the recipient such as their domain name.
For example, using a preceding wildcard in the Username portion of the address, such as “*@domain.com” will find all users with a domain.com email address.
Alternatively, searching for Geoffrey@*.com will find all users with Geoffrey as their username at any domain that ends in the .com top level domain.
When only the name of the recipient is known rather than an email address, using the Display Name of the user, such as Joe Smith, will find all emails with Joe or Smith in the name, which can then allow for drilling down on the results to find their email address for a subsequent refined search.
The From/To field is an especially broad Primary Search Query Field that receives significant use due to its efficacy. When just starting a search and trying to determine the scope of the content, starting with a From/To search is an excellent choice since it finds all emails from the specified email addresses (or display names) whether the messages were sent From or To the user, effectively matching them as either a Sender or Recipient.
The From/To field allows for the specification of the sender/recipient’s email address or display name, or a combination thereof. This field is broken into two sections: the Boolean Operator dropdown menu and the From/To Address Text field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the From/To Text field, as a convenience so the searcher does not need to manually type them in themselves.
Contains All Of: Contains all of the email addresses/display names listed. This matches only against emails that have every email address or display name specified. If three email addresses are being searched for but only two of the specified addresses are on the email, that result will not be returned. All terms must be present to match. When used in a ‘From/To’ search, this largely only functions as a ‘To’ search when email addresses are being used, since logically, an email cannot be sent from multiple people. This Operator is only used functionally in a From/To field when searching for a Display Name and ensuring that both first names and last names are matched. As an example, if a search were run for "Mike" on the average DataCove, it would bring up a whole bunch of results. Narrowing it down to "Mike Smith" and using the “Contains All Of” Operator is the recommended approach, as using the default “Contains One or More Of” would find display names that match either “Mike” or “Smith;” likely with many, many more results than desired.
Contains One or More Of: Contains one or more of the email addresses listed. If three email addresses are specified in the search and only two email addresses are contained in an email, the result will be returned as at least one specified email address matched. Searching for emails sent to UserA@domain.com, UserB@domain.com and UserC@domain.com can be executed with a single search by populating all possible recipient addresses in this field and dividing them with a semicolon.
Contains None Of: Contains none of the email addresses listed. A more complex search option that allows for the prevention of results rendering that were sent from or to a particular email address or display name.
Note: Additional “From/To” Fields can be added to the search query using the Add Search Term function, allowing for multiple addresses to be specified with combinations of “Contains None Of” and “Contains One or More Of” to work in conjunction. However, due to the wide scope of From/To searches, it is not recommended to use additional fields this way.
Note: In general, the “Contains One or More Of” Boolean Operator is the recommended option for most From/To Address searches.
Once the desired Boolean Operator has been selected, the From/To Address Text field can now be populated.
The From/To Address Text field can be as specific as “Sender@domain.com” or, in situations where the exact email address is unknown, searching ‘around’ what is known about the recipient such as their domain name.
For example, using a preceding wildcard in the Username portion of the address, such as “*@domain.com” will find all users with a domain.com email address.
Alternatively, searching for Geoffrey@*.com will find all users with Geoffrey as their username at any domain that ends in the .com top level domain.
When only the name of the sender or recipient is known rather than an email address, using the Display Name of the user, such as Joe Smith, will find all emails with Joe or Smith in the name, which can then allow for drilling down on the results to find their email address for a subsequent refined search.
The Text field is an extremely broad search that finds specified words or text that appear anywhere within the Subject Line, Message Body, or Attachments of an email. As this is a wide scope type of search, it is fertile ground to begin an investigation with since it can match results amongst the widest variety of content areas.
Text searching is broken into two sections: the Boolean Operator dropdown menu and the Text search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the Text search field, as a convenience so the searcher does not need to manually type them in themselves. Quotation marks can also be placed around the specified terms when using the Exact Phrase Operator.
Contains None Of: Returns emails that contain none of the keywords listed in the Subject Line, Message Body or Attachments of an email.
Contains All Of: Returns emails that contain all of the keywords listed anywhere in the Subject Line, Message Body or Attachments of an email. If one or more keywords are missing, the email will not be returned.
Contains One or More Of: Returns emails that contain one or more of the keywords listed anywhere in the Subject Line, Message Body or Attachments of an email.
Contains Exact Phrase: Returns emails that contain the exact phrase listed, as written, in the Subject Line, Message Body or Attachments of an email. Email will not be returned if it contains the same keywords, but not arranged in the exact phrase order.
Note: Additional “Text” Fields can be added to the search query using the Add Search Term function, allowing for multiple sets of search terms to be specified with combinations of “Contains None Of” and “Contains One or More Of,” “Contains Exact Phrase” and “Contains All Of” to work in conjunction.
Text will be searched within any of the following attachment types:
Adobe PDF
Microsoft Excel
Microsoft Powerpoint
Microsoft Word
OpenDocument Presentation
OpenDocument Text
OpenDocument Spreadsheet
The Text Search field itself allows specification of the desired keywords or phrases, and includes the ability to use various advanced search syntax covered in a later section.
For example, searching for the word “dog” using the default “Contains One or More Of” Boolean Operator will find all emails that have “dog” mentioned in the Subject Line, Message Body or Attachment content.
Specifying “cat” and “dog” using an “Contains All Of” Boolean Operator will require that both “cat” and “dog” appear somewhere in an email’s Subject Line, Message Body or Attachments, but not necessarily in that order.
Using a similar Google-style search of “Cat and Dog at the Rainbow Bridge” and using the “Contains Exact Phrase” constraint will require finding that exact sentence, without deviation, in either the Subject Line, Message Body or Attachment of an email to be returned.
The Subject Line field is a Secondary Search type that finds specified words or text that appear anywhere within the Subject Line and is best used to receive narrowed results.
Subject Line searching is broken into two sections: the Boolean Operator dropdown menu and the Subject Line search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the Subject Line search field, as a convenience so the searcher does not need to manually type them in themselves. Quotation marks can also be placed around the specified terms when using the Exact Phrase Operator.
Contains None Of: Returns emails that contain none of the keywords listed in the Subject Line.
Contains All Of: Returns emails that contain all of the keywords listed anywhere in the Subject Line. If one or more keywords are missing, the email will not be returned.
Contains One or More Of: Returns emails that contain one or more of the keywords listed anywhere in the Subject Line.
Contains Exact Phrase: Returns emails that contain the exact phrase listed, as written. Emails will not be returned if it contains the same keywords, but not arranged in the exact phrase order.
Note: Additional “Subject Line” Fields can be added to the search query using the Add Search Term function, allowing for multiple sets of search terms to be specified with combinations of “Contains None Of” and “Contains One or More Of,” “Contains Exact Phrase” and “Contains All Of” to work in conjunction.
The Subject Line field itself allows specification of the desired keywords or phrases, and includes the ability to use various advanced search syntax covered in a later section.
For example, searching for the word “dog” using the default “Contains One or More Of” Boolean Operator will find all emails that have “dog” mentioned in the Subject Line.
Specifying “cat” and “dog” using an “Contains All Of” Boolean Operator will require that both “cat” and “dog” appear somewhere in an email’s Subject Line, but not necessarily in order.
Using a similar Google-style search of “Cat and Dog at the Rainbow Bridge” and using the “Contains Exact Phrase” constraint will require finding that exact sentence, without deviation, in the Subject Line of an email to be returned.
The Message Body field is a Secondary Search type that finds specified words or text that appear anywhere within the Message Body and is best used to receive narrowed results.
Message Body searching is broken into two sections: the Boolean Operator dropdown menu and the Message Body search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the Message Body search field, as a convenience so the searcher does not need to manually type them in themselves. Quotation marks can also be placed around the specified terms when using the Exact Phrase Operator.
Contains None Of: Returns emails that contain none of the keywords listed in the Message Body.
Contains All Of: Returns emails that contain all of the keywords listed anywhere in the Message Body. If one or more keywords are missing, the email will not be returned.
Contains One or More Of: Returns emails that contain one or more of the keywords listed anywhere in the Message Body.
Contains Exact Phrase: Returns emails that contain the exact phrase listed, as written. Emails will not be returned if it contains the same keywords, but not arranged in the exact phrase order.
Note: Additional “Message Body” Fields can be added to the search query using the Add Search Term function, allowing for multiple sets of search terms to be specified with combinations of “Contains None Of” and “Contains One or More Of,” “Contains Exact Phrase” and “Contains All Of” to work in conjunction.
The Message Body field itself allows specification of the desired keywords or phrases, and includes the ability to use various advanced search syntax covered in a later section.
For example, searching for the word “dog” using the default “Contains One or More Of” Boolean Operator will find all emails that have “dog” mentioned in the Message Body.
Specifying “cat” and “dog” using an “Contains All Of” Boolean Operator will require that both “cat” and “dog” appear somewhere in an email’s Message Body, but not necessarily in order.
Using a similar Google-style search of “Cat and Dog at the Rainbow Bridge” and using the “Contains Exact Phrase” constraint will require finding that exact sentence, without deviation, in the Message Body of an email to be returned.
The Attachment Name field is a Secondary Search type that finds specified words or text that appear anywhere within the Attachment’s filename and is best used to receive narrowed results.
Message Body searching is broken into two sections: the Boolean Operator dropdown menu and the Attachment Name search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators, such as “OR,” in between the terms specified in the Attachment Name search field, as a convenience so the searcher does not need to manually type them in themselves. Quotation marks can also be placed around the specified terms when using the Exact Phrase Operator.
Contains One or More Of: Returns emails that contain one or more of the keywords listed anywhere in the Attachment Name.
Contains Exact Phrase: Returns emails that contain the exact phrase listed, as written. Emails will not be returned if it contains the same keywords, but not arranged in the exact phrase order.
The Attachment Name field itself allows specification of the desired keywords or filenames, and includes the ability to use various advanced search syntax covered in a later section.
For example, searching for the word “dog” using the default “Contains One or More Of” Boolean Operator will find all emails that have “dog” mentioned in the Attachment Name.
Using a similar Google-style search of “Cat and Dog at the Rainbow Bridge” and using the “Contains Exact Phrase” constraint will require finding that exact sentence, without deviation, in the Attachment Name of an email to be returned.
Searching for attachments by file type extension is supported, by using an asterisk as a wildcard and then the file type extension.
As an example, MP3 files can be found by running a search for “*.mp3” to yield emails containing attached MP3 files.
Note: Currently Attachment Name and Attachment Type are applied per-email rather than per-document. This means that a search requiring (for example) an Attachment Name of “my.txt” and an Attachment Type of “MS Word” will find all emails with an attachment named “my.txt” and an attachment of the “MS Word” type: it does not mean that it will only find MS Word documents with the name my.txt.
The Attachment Type field is a Secondary Search type that finds emails that also possess an attached file of the desired type.
Attachment Type searching is broken into two sections: the Boolean Operator dropdown menu and the Attachment Type dropdown menu, but the Boolean Operator is limited to only providing “One of More Of” in this context and can be ignored.
The Attachment Type field lists the most popular file types encountered in eDiscovery scenarios, such as PDFs, Excel spreadsheets and Word documents. Selecting the desired file type will limit search results to emails that also happen to have an attachment that corresponds to this selected file type.
Note: As the Attachment Type possesses a non-exhaustive list of options, using the above Attachment Name search with a file type extension and wildcard for the filename allows for finding emails with attachment types that are not provided for on this list.
Note: Currently Attachment Name and Attachment Type are applied per-email rather than per-document. This means that a search requiring (for example) an Attachment Name of “my.txt” and an Attachment Type of “MS Word” will find all emails with an attachment named “my.txt” and an attachment of the “MS Word” type: it does not mean that it will only find MS Word documents with the name my.txt.
The Attachment Contents field is a Secondary Search type that finds specified words or text that appear anywhere within text-based attachments and is best used to receive narrowed results.
Attachment Content searching is broken into two sections: the Boolean Operator dropdown menu and the Attachment Contents search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR” and “AND” in between the terms specified in the Attachment Contents search field, as a convenience so the searcher does not need to manually type them in themselves. Quotation marks can also be placed around the specified terms when using the Exact Phrase Operator.
Contains All Of: Returns emails that contain all of the keywords listed anywhere in the attachment. If one or more keywords are missing, the email will not be returned.
Contains One or More Of: Returns emails that contain one or more of the keywords listed anywhere in the attachment.
Contains Exact Phrase: Returns emails that contain the exact phrase listed, as written. Emails will not be returned if it contains the same keywords, but not arranged in the exact phrase order.
The Attachment Contents field itself allows specification of the desired keywords or phrases, and includes the ability to use various advanced search syntax covered in a later section.
For example, searching for the word “dog” using the default “Contains One or More Of” Boolean Operator will find all emails that have “dog” mentioned in the attachment.
Specifying “cat” and “dog” using an '“Contains All Of” Boolean Operator will require that both “cat” and “dog” appear somewhere in an email’s attachment, but not necessarily in order.
Using a similar Google-style search of “Cat and Dog at the Rainbow Bridge” and using the “Contains Exact Phrase” constraint will require finding that exact sentence, without deviation, in the attachment of an email to be returned.
The Attachment Available field is a Secondary Search type that finds emails that also possess an attached file of any type, but broader than the above Attachment type searches since it only asks that an attachment be present, without specification as to what kind of attachment or what it may contain. The Attachment Available search adds a search filter that requires that any results returned must have an attachment of some sort to qualify as a viable search result. Emails lacking an attachment will not display under a search with this field added.
Attachment Available searching is broken into two sections: the Boolean Operator dropdown menu and the Attachment Availability presence section, but the nature of this specific search field means that no changes can be made to either section.
Department searches are a particularly powerful Specialty Search type that allows for searches to only occur within, or without, a specific grouping of users. These are used in conjunction with other search terms (usually Text or other derivatives) to limit the scope of people being searched upon, or to avoid finding emails that match the search terms from a certain group of users.
To provide a basic definition: Departments are groupings of users, either manually created or synchronized from Active Directory groups, that correspond to actual organizational departments within the organization. Information Technology departments, Human Resources departments, Sales departments; that sort of thing. These Departments can then be individually searched on to only search on users within that Department, rather than all emails across the system.
Note: Departments do not need to correspond to actual organizational departments, but can instead be composed of any grouping of users that are desired. This method allows for creating a department of “subjects under investigation” which can be used to run repeated inquiries against without having to copy and paste in a series of email addresses each time.
Thusly, a search that is only pertinent for users within so-and-s0 department can be limited to only find emails from and to their staff, greatly reducing “noise” that can come up from other users who may be also discussing the same topic.
Department searches are broken into two sections: the Boolean Operator dropdown menu and the Department selection dropdown menu.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR” and “AND” in between the departments selected in the Department dropdown menu, as a convenience so the searcher does not need to manually type them in themselves.
Contains All Of: Returns emails that match the searched keywords listed, and with at least one user from each selected department. If one or more users from a selected department are missing, the email will not be returned.
Contains One or More Of: Returns emails that contain at the searched keywords listed, as long as they were sent To, From, Carbon Copied or Blind Carbon Copied to a user within a selected department.
Contains None Of: Prevents the return of emails that contain no users within a selected department.
Of especial interest is the dropdown menu for the Boolean Operators offering the “Contains None Of” function. Using “Contains None Of” and selecting a department will prevent emails from users within that department from showing up in search results. This can be fantastically powerful to run a search for content where one department is sure to know of it, but others are not, and can help find “leaks” in information.
Message ID searches are an extremely accurate type of Specialty Search type that finds emails based on their unique Message ID, which is comprised of a string of random alphanumeric characters and unique identifiers of the origin of the email, such as the domain name or email host server that dispatched that email. Only precise matches for that email (or duplicates of that message) will be found using this type of search. Message ID searches are bound to only find a unique message when queried; never a random assortment of different messages.
The drawback to a Message ID search is that the Message ID itself must be known ahead of time; it isn’t something casually found or searched for in and of itself. Traditionally, Message ID searches are used to remove specific results from a search after the Message ID is identified using the “Contains None Of” Boolean Operator.
Message IDs are found in the Headers of an email, which can be found in DataCove by clicking on an email and selecting the Headers button in the Actions menu, as well as in various email clients by looking at the properties of the message and viewing the headers.
Message ID searching is broken into two sections: the Boolean Operator dropdown menu and the Message ID search field itself.
The Boolean Operator dropdown, positioned on the left hand side of the field, automatically places Boolean Operators such as “OR,” “AND” or “NOT” in between the terms specified in the Message ID search field (which can be separated by a semicolon), as a convenience so the searcher does not need to manually type them in themselves.
Contains None Of: Does not return emails that contain the specified Message IDs.
Contains All Of: Returns emails that contain the full sequence of the Message ID, or segments thereof when using wildcards and multiple variants, such as “*@TCX-SRV.Tangent.local;” “*@google.com;” “*@MSFT-Host3929,” etc.
Contains One or More Of: Returns emails that contain one or more of the Message IDs listed.
Is Exactly: Returns emails that contain the exact Message ID listed without any variation tolerated.
Once the Boolean Operator menu selection is set, type in (or more likely, copy and paste in) the Message ID, then click Search. If using multiple Message ID entries, use a semicolon and a space to separate the entries.
The Social Security Number in Subject Line (SSN in Subject) field is a Specialty Search type that finds numerical sequences that match the length of a United States Social Security Number in the Subject Line of an email.
Nominally, this sees the most use by entities that use the Social Security Number as an identifier for a person, often including government agencies and healthcare entities, but also some corporate users for background checks and W-2 filings. While use of Social Security Numbers is very commonly found at organizations who use the Social Security Number as an identifier, they’re not always nestled in the Subject Line and using the “SSN in Text” search is recommended over “SSN in Subject” to find sources of Social Security Numbers being used in a multiple sections of an email, such as the Message Body or Attachments, unless it is known that they will be in the Subject Line itself.
SSN in Subject Line searching is broken into two sections: the Accuracy Scope dropdown menu and the SSN in Subject search field itself.
The Accuracy Scope dropdown, positioned on the left hand side of the field, offers two options that determine how wide a scope the search will be.
Partial Social Security Number: Returns emails that possess any numerical segment of a Social Security Number in the Subject Line, such as a three digit segment, a two digit segment, a four digit segment or a full nine digit sequence.
Any Social Security Number: Returns emails with Subject Lines that possess any sequence of numbers that match the nine digit format of a Social Security Number.
The SSN in Subject search field operates in two ways:
When configured with an Accuracy Scope of “Partial Social Security Number”, this field allows for the specification of digits in any of the three Social Security Number sections. Fields left blank or populated with an asterisk (*) will match any digits of the appropriate segment length. Single character wildcards (?) can be used to match against individually unknown digits.
When the SSN in Subject Accuracy Scope is configured for the “Any Social Security Number” option, no further isolation of the Social Security Number is necessary; this search will bring back any email with a full nine digit sequence in the Subject Line.
The Social Security Number in Text (SSN in Text) field is a Specialty Search type that finds numerical sequences that match the length of a United States Social Security Number in the Subject Line, Message Body and Attachments of an email.
Nominally, this sees the most use by entities that use the Social Security Number as an identifier for a person, often including government agencies and healthcare entities, but also some corporate users for background checks and W-2 filings.
SSN in Text searching is broken into two sections: the Accuracy Scope dropdown menu and the SSN in Text search field itself.
The Accuracy Scope dropdown, positioned on the left hand side of the field, offers two options that determine how wide a scope the search will be.
Partial Social Security Number: Returns emails that possess any numerical segment of a Social Security Number in the Subject Line, Message Body and Attachments, such as a three digit segment, a two digit segment, a four digit segment or a full nine digit sequence.
Any Social Security Number: Returns emails with Subject Lines, Message Bodies or Attachments that possess any sequence of numbers that match the nine digit format of a Social Security Number.
The SSN in Text search field operates in two ways:
When configured with an Accuracy Scope of “Partial Social Security Number”, this field allows for the specification of digits in any of the three Social Security Number sections. Fields left blank or populated with an asterisk (*) will match any digits of the appropriate segment length. Single character wildcards (?) can be used to match against individually unknown digits.
When the SSN in Text Accuracy Scope is configured for the “Any Social Security Number” option, no further isolation of the Social Security Number is necessary; this search will bring back any email with a full nine digit sequence in the Subject Line, Message Body or Attachments.
Folder Name searching is a very particular kind of Specialty Search that is designed for end users, not system administrators or investigative departments like Legal or Human Resources.
For some background: DataCove possesses a means of mirroring live user mailboxes to the archived emails that the system stores, known as Folder Sync, that shows those archived emails in a “folder view” similar to that of an email client like Microsoft Outlook or Mozilla Thunderbird. This mechanism is designed to help the ‘more organized’ type end users who are reliant on a folder structure to find emails, rather than the global search that DataCove and Google use. By selecting which folder or subfolders an email may have been in, the end user can limit the search to areas the email is likely to be stored in, making for a far faster and more context-rich search.
This, of course, breeds the obvious question: if a user knows approximately where those emails may be inside their own folder structure, why would they use the DataCove to find them? Surely they could simply find them in their own email client?
This is where corporate policy enters the fray: due to mailbox size limits, users who refuse to delete anything and the hardware and software limits of a user’s computer slowing down tremendously when dealing with large datasets, it’s a common scenario where users must be forcibly limited in how much data they can store locally. Sometimes this means limited amounts of data being stored locally, with the rest being gathered from a remote server (such as Outlook’s Cached Exchange Mode). Other times, it means a corporate retention policy which purges emails out of user mailboxes that is over a certain age, which keeps mailboxes trim. Occasionally, it’s PST files being stored on a network share having poor performance when a user wants to search on it.
In all of these scenarios, DataCove’s job is already storing vast amounts of data, keeping it rapidly searchable (and having the power to do so) and possesses a simple and friendly enough user interface to where users can learn it quickly. Thus Folder Sync was born as a means to alleviate end user issues in a policy-driven world that frowns upon them storing large datasets on their own.
Emails that have been deleted out of a user’s mailbox are logically inaccessible to them, however DataCove, by virtue of the Folder Sync feature, knows exactly which folder the email was last present in prior to its removal and keeps a copy of the archive version there for them within the DataCove Folder View, by means of logic pointers in a backend database. Only the mailbox owner can see their own folder structure within DataCove, hence why this is limited in functionality to only the end users.
With that foundation established, Folder Name searching requires two big configurations to exist in advance:
End Users must be granted access to the DataCove to search for emails (usually just their own emails).
The Folder Synchronization Mailbox Service must be configured and functional.
Once these two features are working, when a user logs in, they’ll have the ability to run a Folder Name search, which will run all of the search criteria they specify only inside of the folders or subfolders they select.
Folder Name searching is broken into two sections: the Boolean Operator dropdown menu and the Folder Selection field, but the nature of this kind of search limits itself to only possessing the “Contains One or More of” Boolean Operator (since “All Of” and “None Of” are not logically useful here) and a selection field for the folders that the user account has synchronized.
By selecting the folder(s) that the user wants to search within, they can then apply any other search criteria to find content matching their needs within just the desired folders as “source” data.
Tag Name searches are a “search within a search” of a sort, since they run new queries against emails that have already had a “Tag” or “Legal Hold” applied to them. Insofar as to how this type of Specialty Search operates, Tags and Legal Holds are interchangeable.
As a refresher, Tags and Legal Holds are two related mechanisms that apply informational “tags” to emails that will allow for easy sorting and categorization of emails found during an investigative event. Generally, they are used to flag emails that may be responsive to an investigation and then later drilled down on for relevance or redaction, before being exported to counsel or requester.
Once emails have been tagged as being “of interest,” follow-on searches that search only within the tagged emails can be performed by using Tag Name searches. This allows for narrowing down of searches already run, expansion of the search into related directions based on what was previously found and, if desired, additional tag emplacements on emails deemed responsive in other ways.
Tag Name searching is broken into two sections: the Boolean Operator dropdown menu and the Tag Selection field, but the nature of this kind of search limits itself to only possessing the “Contains One or More of” Boolean Operator (since “All Of” and “None Of” are not all that practical for this use case) and a selection field for the Tags that the user account has synchronized.
By selecting the tag(s) that the user wants to search within, they can then apply any other search criteria to find content matching their needs within just the desired tagged emails as “source” data.
Label Name searching is another Specialty Search focused around end users who spend significant amounts of time in the DataCove. Labels are another means of categorizing emails that the end user looks at, in the same exact fashion as a Tag, but limited in visibility only to the end user who created it. In this sense, they are made by and for the end user themselves, since they are not useful to anyone but them.
Labels hold no especial value or function on their own, unlike the Legal Hold variant of a Tag, but are instead simply a means of organizing emails for a user who may not be using the Folder Synchronization functionality to sort their emails, but still wants a means of organizing them that can be searched on in the future.
In such an example, UserA could search for all emails related to a contact they know, Peter Parker, then Label all the results that appear so that subsequent searches for any details or conversations had with Peter Parker can be run within the confined space of only emails labeled as being pertinent to Peter Parker. This is another “search within a search” type function, just like Tag Name searching, but focused solely around an end user and granting them the privacy of their own tagging mechanism.
Label Name searching is broken into two sections: the Boolean Operator dropdown menu and the Label Selection field, but the nature of this kind of search limits itself to only possessing the “Contains One or More of” Boolean Operator (since “All Of” and “None Of” are not all that practical for this use case) and a selection field for the Labels that the user account has previously made.
By selecting the label(s) that the user wants to search within, they can then apply any other search criteria to find content matching their needs within just the desired labeled emails as “source” data.
Labels can be found by clicking the Email Viewing header, then selecting My Labels on the left hand side menu. New labels can be created on this page, as well as the viewing of existing labels and their contents.
Comment searching is, as of Version 5.2.8 of the DataCove software, a largely deprecated function that has been superseded by Tags.
In overview, Comments were the predecessor to Tags, allowing a privileged user such as an Auditor, Attorney or Administrator to make notations to emails that could be revisited later (especially by searching for the Comment content (the words used to make the comment), Comment author or Comment tag (“title” as they are known in Comment parlance) for follow-up purposes. As DataCove’s use of Comments went on over the years, limitations were found in terms of automation and sorting ability, both of which the Tags feature was then developed to address.
Tags allow for a rapid overview of relevant emails (sorting) as well as automatically applying Tags (and their bigger brother, Legal Holds) to emails when defined search criterion was met, while Comments remained a ‘manual’ affair requiring interaction on an individual basis of each email of interest.
As of the writing of this article, Comments’ value as a feature is exceedingly niche and not in any sort of practical use that Tags does not already achieve, with certain Specialty Search functions like being able to search for a Comment’s Author, Comment Title or Comment content itself being relics of decades past.
In the event that individual email commenting functionality may have value to your organization, please contact DataCove Support for a thorough walkthrough of the feature and functionality, along with a comparison to Tags and Legal Holds, to ensure that it is indeed needed.
Random Sample searching is a Specialty Search modifier that alters any search being run to only bring back a percentage of the total results that would otherwise have rendered. Random Sample was originally designed for Compliance Officers or other Governance, Risk, Compliance (GRC) departments within organizations to basically search for emails that may break some internal policy of Terms of Service (say, inappropriate language) and provide a small subset of the potential results that would otherwise return to then be reviewed and dealt with, rather than bringing back all potential matches.
Let's say a given search is being run that would bring back 100 results. If the Random Sample slider is set to 1%, only 1 result would then appear, which could be used for "spot checking" of the data to see what should be acted on or not.
From the practical standpoint, this is meant to offer workable quantities of content for an already busy Compliance Officer to deal with while still demonstrating enforcement of the organization’s policies. In the same sense that “the police cannot be everywhere at once,” the same holds true for policy enforcement at an organization, with examples being made to show that penalties for breaching the Terms of Service can happen, even if it they don’t always happen.
Random Sample only has two options: the percentage sliding bar or the percentage text box. Both operate as one option and simply allow for the difference between and click-and-drag manipulation or entering in the numerical values desired.
Search Term Syntax
Search Terms and Search Modifiers are the little refinements that can be used with the various Search Fields described above to tweak, localize and specify the search’s reach to very granular degrees. Before diving into the numerous options and how significantly they can modify a search, a few of the basics should be covered.
Capitalization:
Search Terms in DataCove are not case sensitive. For example, searching “Project” and “project” will return the exact same results.
Note: Boolean Operators, discussed further below, do require capitalization for them to function. They are not standard Search Terms, but are instead Modifiers, which have different behavioral requirements.
Accent Marks:
Accent marks are searchable and non-normalized (i.e. words with accent marks do not get transformed [“normalized”] into the same characters without the accent mark for the purposes of a search).
To clarify the concept of ‘normalization’, searching for “Michael” and “Míchael” are two different searches and will not bring up results for the other, as the accent mark over the “i” makes it a different character and, in effect, a different word.
In this example, searching for “Michael” will bring up all emails with “Michael” in them, but will not render results that have “Míchael.”
As a corollary, searching for “Míchael” will not bring up any emails with “Michael” in them.
To further illustrate this, a Text Search is being run for an exact phrase in French below, but written in plain English without the various accent marks.
Note that no results appear from searching this term.
Now, if that same search was run again with the accent marks, note that a result appears.
The difference that accent marks make when searching for words or names with accents can make or break an investigation. It is imperative to pay attention to them when presented with them in any eDiscovery request.
Adding additional duplicate search fields for “None Of” search filtering:
Covered previously in the Search Introduction section, but worth mentioning once more, is the ability to add the same search field multiple times to a search query.
Additional duplicate fields can be used to create more complex Search Queries, such as a search that allows finding all emails Sent to UserA@domainname.com From UserB@domainname.com, but excluding emails sent From UserB@domainname.com to both UserA@domainname.com and UserC@domainname.com.
In the below example search, emails from “mikes@tangent.com” that were sent to both “ramind@tangent.com” and “edmunde@tangent.com” are being searched for. However, the addition of the second “To” Search Field with the “None Of” modifier means that emails that were sent to “ramind@tangent.com” and “edmunde@tangent.com” will show up in the results, but not emails that were sent to “ramind@tangent.com” and “edmunde@tangent.com” and either “erikk@tangent.com” or “danas@tangent.com.”
By matching against a “negative,” undesired results can be removed from the results. This is particularly valuable in removing communications that may have been blasted to multiple people, such as an entire department, and just bring in purposeful communications between smaller groups of pertinent people.
Search Term Types:
There are two types of Search Terms in DataCoves: Single Terms and Phrases.
Single Terms are singular words or number sequences, such as “128,” “Jonathan” or “Invoice.” More often than not, search terms provided by opposing counsel, a Freedom of Information Act/Public Records Request (FOIA/PRR) or other investigation will have an assortment of these.
Single Terms can be used as they are and do not require any special punctuation to be applied to them to be understood by the DataCove.
Phrases are groups of words or numbers, like “Job 128,” “Jonathan Galvez” or “May 2024 invoice amount.” Phrases tend to be occasionally called up in comparison to singular words, but DataCove has strong support for them as well.
To indicate a phrase, enclose the phrase within double quotation marks(“).
This quotation mark bracketing functions exactly like how Google’s “exact” search works.
Multiple Search Terms, including both Phrases and Single Terms, can be combined using Boolean Operators for more complex searches.
The various types of Search Modifiers, along with their Boolean Operators, are described in the following sections.
With the basic, individual Search Terms now covered, there often comes a need to combine Search Terms in different arrangements to find emails matching the criteria in certain ways. This is where Boolean Operators come in.
Boolean Operators allow the combination of multiple search terms together to formulate a search to behave in different ways.
To use a Boolean Operator, the Operator should be typed in all capital letters. For example, if a search was run to find the terms “cat” and “dog” somewhere in the same email, this would require search syntax that will capitalize the Boolean Operator “and” in between the terms. The search syntax would come out to be ‘cat AND dog’ in order to find the word “cat” and the word “dog” in the same email together. Only the Operator itself must be capitalized; capitalization of the search terms does not make a difference.
There are four distinct Boolean Operators that DataCove uses: OR, AND, NOT and + (plus sign).
The “OR” Operator returns a result if one or more of the specified Search Terms are found.
OR is the default Boolean Operator. Unless otherwise specified by having a different Boolean Operator or Modifier between them, all terms will be treated as having the OR Boolean Operator placed in between them.
As an example: a user needs to find an old email that includes a person, Kelsey, who took several pets on a road trip to Yosemite. In looking for mention of pets that that may have been taken, a search is composed that contains a combination of Single Terms for the type of pets, the person’s name, the destination’s name and a Phrase for an affectionate term that Kelsey often used.
This search syntax is laid out as ‘cat OR dog OR kelsey OR sardine OR yosemite OR “meow kitties”’ which will render results that match any of the Search Terms specified, including the multiple-word Phrase “meow kitties,” as long as both ‘meow’ and ‘kitties’ are right next to each other and in that order.
The “AND” Boolean Operator is the next most commonly used Modifier, as it groups Search Terms together that must be found within the same Search Field (such as all terms must be found in the Subject Line, Message Body, Attachment Name, Attachment Contents or, if using the Text Search Field, in any combination of these fields) to return a result.
“AND” only returns a result if all of the specified search terms are found. If any are missing, the message will not be returned.
As an example, if a user is looking for an email about a specific marketing project budget discussion from several years ago, the criteria used could be something like ‘budget AND “marketing campaign” AND 2021’ to find an email that has the Single Term of “budget” in it, the Phrase “marketing campaign” and a mention of the date, such as in the the datestamp of a reply to an email or forward of an email, like “2021.”
The “NOT” Boolean Operator is a more powerful Operator than it appears at first glance. Unlike the OR and AND Operators, NOT is an exclusionary Operator which signals that a specified Search Term cannot exist in a returned message. This can be used to filter out other words that may appear with other Search Terms that are being searched for and greatly reduce the “noise”, in terms of extraneous messages, of any given search’s results.
As an example, if a user is searching for emails about a product launch, but wants to exclude any messages related to the marketing team’s involvement, they might build the search query like ‘“product launch” NOT marketing’ which would remove any potential results mentioning marketing, such as a marketing representative’s title, from showing up in any messages about the product being launched.
Note: The NOT operator can be substituted with a hyphen (-) that functions in the same manner as the NOT operator, but with slightly less typing involved. This can be useful when conducting large scale reductive search refinement using multiple NOT operators. Example syntax: A search run for “hunting -rifle” would search for the word “hunting” but exclude any results that also had “rifle” in it.
Note: Exclusionary Operators cannot be used if there is only one search term. For example, if the full search is ‘-onboarding’ or ‘NOT onboarding’, the Search Term will not be excluded since there is nothing else to match against.
The + (plus sign) Boolean Operator forces the requirement of the term that comes after to be present in the Search Field it is used in, but the presence of subsequent, non-required Search Terms is optional.
In context, this means that whichever term has a Requirement must appear in the message, but any other Search Terms specified are “preferentially” there and will not return a result without the required term being present.
This is an important distinction, as while the + Operator functions very similarly to an OR Operator, it places emphasis on the need for the Required Search Term.
As an example:
‘Cat OR Dog’ will find emails that have either “cat” or “dog” mentioned in them. Both entries need not appear for the email to return, so long as at least one entry does.
‘Cat AND Dog’ will find emails that have both “cat” and “dog” mentioned in them, but will not return results that lack either.
‘+Cat OR Dog’ will find emails that have “cat” in them and will return those results, regardless of whether “dog” is also present, but will never show emails with “dog” on its own the way it would with a standard OR search.
Search Term Modifiers allow for more esoteric types of searches to be run, especially in regards to searches that look “around” the specified terms provided by the requester, or especially when used in internal investigations where the whole story of any given situation may not be known, these Modifiers can uncover new approaches and angles of attack that may never have been considered before.
In overview, these Modifiers allow searches to perform actions like:
Finding misspelled words that are similar to a Search Term.
Find Search Terms that are located within specific word distance apart from each other.
Find variations of a word that may make them “in scope” of the investigation that otherwise would not have been detected.
Wildcard searches allow a user to replace one or more unknown characters within a word with a special character, known as a Wildcard.
How does one search for characters they do not know? An excellent question. The answer is that DataCove tries every possible variation of them to find different matches that could fit.
This Wildcard functionality allows for a search to automatically try all possible variations of a word, such as pluralization, variant spellings or alternative word endings, all with a single search.
Wildcard searches come in two flavors: Single Character Wildcards and Multiple Character Wildcards.
A Single Character Wildcard uses the question mark symbol (?) to replace a singular character in a Search Term and is best used for small scale variations that could occur with a word.
As as example, imagine a user is searching for an email from a specific contact. but is unsure if their last name is spelled ‘Hermansen’ or ‘Hermanson.’ By using a Single Character Wildcard search, ‘Hermans?n,’ the search results would include both spelling variations.
Alternatively, when searching for other common words, searching for a Search Term like ‘fre?’ will yield returns such as ‘free,’ ‘Fred,’ ‘fret’ and other variations. Placing the Single Character Wildcard inside a word like ‘c?p’ would find results like ‘cap,’ ‘cup,’ ‘CCP’ and ‘cop.’
The broader-scope brother of the Single Character Wildcard is the Multiple Character Wildcard.
The Multiple Character Wildcard uses the asterisk symbol (*), emplaced somewhere in the Search Term, which seeks to find any variations of the Search Term with zero or more characters after the point that the asterisk is inserted.
In the below example, a search for ‘p*d’ will find results like ‘pod,’ ‘piled,’ ‘poured’ and others, since the wildcard was placed in the middle of a term. As long as the first letter and last letter of the word match (and other letters that may have been in-between), all possible variations of words that start with ‘P’ and end with ‘D’ would return.
When a Multiple Character Wildcard is placed at the end of a word, the results can be even wider. The ‘tang’ in the example search below would yield ‘Tangent,’ ‘tangerine,’ ‘tangelo,’ ‘tango,’ ‘tang’ and other similar variations.
Proximity Searches are used to find Single Search Terms that are located a specified distance apart from each other. In other words, users can specify how close together two or more Search Terms should appear within a Search Field before a result will return.
Proximity Searches are useful when the terms being looked for may not necessarily be adjacent, such as a parent and school official communicating of the status of a student in a specific teacher’s class, or a project manager discussing the status of a project and any obstacles they are encountering with it.
To configure a Proximity Search, place the two Single Terms within Quotation Marks (“), as if creating an Exact Phrase Boolean search, then add a tilde (~) and the maximum number of words apart the search should extend to.
As an example, using “guaranteed return”~10 will bring back results that match ‘guaranteed return,’ ‘guaranteed to give you a 50% return,’ ‘guaranteed by me to return tomorrow,’ but won’t have a result like ‘guaranteed to yield 4.85% over the course of the next fifteen years with incremental dividend increases, further maximizing your return,’ since that extends beyond the 10 word range assigned.
Fuzzy Searches allow users to enhance the flexibility of search queries by returning results that can include misspelled words and other slight variations in spelling. A Fuzzy Search will have results return that have similar spelling and the same number of characters.
Fuzzy Searches are best used in situations of high Search Term variability, such as when a subject person has a nickname (or several nicknames) they may go by, or when searching for the emails of users who are known not to be the best spellers, like students.
Configuring a Fuzzy Search is quite easy: simply place a tilde (~) after the Search Term to enable a standard Fuzzy Search.
Running a search for “roam~” could yield results like ‘room’ and ‘foam,’ in addition to finding ‘roam’ itself.
As another example, running a search for “United~” can bring back ‘United,’ ‘Unlted,’ ‘Vnited, ‘Vnlted’ and other similar variations.
To increase or decrease the amount of accuracy-to-term used in a Fuzzy Search, placing an decimalized number after the tilde between 0.1 and 0.9 can change how loose or tight the “fuzziness” is.
0.1 would be a very loose variation of the word being search for while 0.9 will only return results that have very minute differences from the original Search Term.
The default value when unspecified is 0.5.
As an example of this kind of altered-accuracy Fuzzy Search, “United~0.2” would return far more variable results than “United~0.8” despite the search terms being very similar.
A search can be formed via smaller sub-queries through a process known as Search Term Grouping. These sub-queries can then be matched in sequence before moving onto the next step in the search, such as matching against another set of variable Search Terms (which may have their own sub-queries as well). This process can look a lot like Algebra, but using words, and the same Algebraic knowledge of sequencing applies here as well.
In this manner, the Grouping of Search Terms can be useful to control the order of the Boolean logic in a search, which can offer different and far more precise results.
To create a Group, enclose the Search Terms being used within parentheses. Other Search Terms can still come before or after, and if they need to match in multiple ways also, they can likewise be independently enclosed in their own parenthetical brackets.
For a syntax example: to search for either word of ‘broker’ or ‘hedge’ while also needing to find the word ‘website’ in an email, enclose the first two terms within parentheses so they can both match independently against the latter ‘website’ term. Such a query would look like “(broker OR hedge) AND website” and would match emails that have ‘broker’ and ‘website’ in them, ‘hedge’ and ‘website’ in them and ‘broker’ and ‘hedge’ and ‘website’ in them.
The below example uses a simple “cat OR dog AND fish” search, which looks for either the word ‘cat’ on its own, or the combination of ‘dog’ and ‘fish’ somewhere in the email. Note that it does not search for ‘cat’ and ‘fish’ together, since the order of operations here has ‘cat’ being searched independently first, then the ‘dog AND fish’ combination term.
55 results are found within the past month with this search.
In comparison, by Grouping the Search Term of “cat OR dog” together first, then adding the “AND” Boolean Operator, either ‘cat’ or ‘dog’ must be found with ‘fish’ somewhere in the email for the result to return. Such a search is effectively running two searches, one for “cat AND fish” and another for “dog AND fish” and then merging the results together.
Note that with the same past month search, 57 results were found, with two entries matching the “cat AND fish” criterion.
There are some characters that DataCove will attempt to treat as Boolean Operators, even if they are intended to be part of the search.
These characters include:
+ (plus sign)
- (hyphen)
& (ampersand)
| (vertical bar)
! (exclamation point)
( (left parenthesis)
) (right parenthesis)
{ (left brace)
} (right brace)
[ (left bracket)
] (right bracket)
^ (caret)
“ (double quotation mark)
~ (tilde)
* (asterisk)
? (question mark)
: (colon)
\ (backslash)
In order to search for these characters, an “Escape Character” must be used preceding the desired character being searched upon. This Escape Character lets the DataCove know that the character succeeding it isn’t to be treated as a Boolean Operator, but instead part of the Search Terms. The Escape Character that DataCove uses is the “\” backslash.
Note: It is not possible to search for the aforementioned characters, or any punctuation, in the email text areas like the Subject Line or Message Body fields, but other sections like attachment filename can be searched in this manner.
An example search for an attachment named “You need to see this!.jpg” would use the following search, with a backslash preceding the exclamation mark in the filename: “You need to see this\!.jpg”
Exporting Emails from DataCove
Once the desired emails are found on DataCove, the next steps are generally exporting them out for legal counsel to review and redact as necessary. Exporting emails from DataCove is quite easy, and has multiple different options available.
Once the emails are selected from the Email List pane, which can be performed individually or using the Select All checkbox next to the total number of results count, clicking on Export will spawn the Export menu.
There are five total export options, along with the Print Email functionality (discussed further below).
Raw Email (individual .EML files)
PDF Export (individual .PDF files)
PST Export (conglomerated .PST file)
To/From/Subject/Date (HTML format)
To/From/Subject/Date (CSV format)
Note: All export types, sans the metadata-only export types used for European Union legal compliance, will fully ‘rehydrate’ the emails and their attachments into individual files once more. All benefits of attachment deduplication will not be applied to these exported emails, meaning that the exported files will take up significantly more space than the version DataCove itself holds. Be certain there is sufficient space available on the DataCove before beginning any sort of eDiscovery export jobs (less than 85% of used capacity is generally a safe amount of space for standard eDiscovery work).
Before diving into the Export Types themselves, it is best to understand a universal constant of the exports: how to track their progress and where to find them when they are done being exported.
Once an export has been initiated, a small dialog box will appear at the top of the screen indicating that process has started, and provide a link to the Exported Results page, wherein the export can be downloaded from once it is complete.
Depending on the quantity of files being exported, this process can take time to recompile all of the emails desired and convert them into the desired format, with PDF exports taking the longest and Metadata exports going the fastest.
Direct observation of the progress of the exports can be had by clicking Status in the top header bar, then clicking System Status on the left hand side menu.
Under Active Jobs, an export can be found with the process name determined by which user initiated the export and the filename they gave it.
Clicking on the Magnifying Glass will allow a closer look into the progress.
Under the export process’s details, a Progress count can be found, along with start time, end time (when applicable) and the approximate quantity of emails currently complete.
Once the Export is complete, the My Exported Results page will make the files available. This page can be found by clicking Email Viewing in the top header bar, then selecting My Exported Results on the left hand side menu.
This page will contain a collection of all exports that the user account has made, along with any exports that have been shared to it by user accounts.
Very large exports will be broken into multiple files, delineated with a ‘part number’ of the whole number of exports (i.e. ExportFile_1_of_28).
Several functions are available on the right hand side of the page on a per-file basis.
Download initiates a download of the selected file immediately to the Web Browser’s default download location (usually My Downloads).
Share spawns a dialog box allowing for the specification of other user accounts on the DataCove to then grant access to this exported file to.
Unshare spawns a dialog box allowing for the removal of users who previously had been granted access to the exported file for download.
Delete removes the exported file from DataCove, liberating the space it was taking up.
Note: By default, no other users, including system administrators, can see the exports made by an individual user account. The only means of seeing other users’ exports is by Sharing them or by contacting DataCove Support.
Note: It is strongly recommended to delete exports from DataCove once they have been downloaded. Leaving exports around takes up significant amounts of non-deduplicated space on the system and can impact the amount of total archives the system can hold over time.
First and foremost amongst export formats is “Raw Email,” which exports self-contained versions of each email, replete with their own attachments and headers, in the .EML format.
.EML files have been the standard for the saving of individual emails for decades and practically any desktop email client (such as Outlook, Thunderbird, Eudora, etc) can open this file type, making it near-universal in legibility.
.EML exports are the fastest method of exporting from DataCove since there is very little overhead required in terms of file formatting and conversion.
When exporting large amounts of emails in the .EML format, maximum efficiency is achieved by running exports in approximate 30,000 email chunks, with export durations at this quantity varying between 8 hours and 24 hours.
To begin a Raw Email export, select “Raw Email” from the export menu as the output file type, create a filename for the .ZIP file that the various exports will be compressed into, and if desired, add an email address in the Email On Completion field, which will notify the specified email address when the export is complete.
Click OK when ready.
Once the export completes and the file(s) are downloaded, locate the .ZIP file in the local computer’s My Downloads folder and decompress it.
Inside will be a folder called DataCove, and inside that folder is a subfolder containing the Exported Email itself as well as an HTML manifest file called Index.html.
The Index file contains a manifest of every email in the export, sorted by datestamp, sender name and email address and the subject line of the email and is best used for finding and reviewing individual emails from the export.
Clicking on the Details link on the right hand side of the manifest will jump the page over to an expanded view of that particular email, providing additional data like the exact filename, Message ID and the To/CC contact list.
The email itself can be directly opened by selecting the View button, which will open the email from within the subfolder without having to find it manually.
When diving into the Exported Email subfolder directly, the emails are listed by datestamp, sender email address and subject line. This is similar to what the Index file contains, but can be less responsive to dig through individually.
Double clicking any email inside will open it using the default email client on the workstation.
These are the exported emails that can be provided to legal counsel for further review.
The next type of popular export is “PDF” which exports self-contained versions of each email, replete with their own attachments (when applicable) and headers, in the .PDF format.
.PDF files have been a popular universal file format since the early 2000’s and essentially all computers have support, either native or third-party, for reading and editing these files.
.PDF exports are the slowest method of exporting from DataCove as converting all of the emails, and their attachments (when applicable) into an embedded PDF file with layers is incredibly resource intensive.
When exporting large amounts of emails in the .PDF format, maximum efficiency is achieved by running exports in approximate 400 email chunks, with export durations at this quantity varying between 1 hour and 6 hours.
To begin a PDF export, select “PDF” from the export menu as the output file type, create a filename for the .ZIP file that the various exports will be compressed into, and if desired, add an email address in the Email On Completion field, which will notify the specified email address when the export is complete.
Depending on the level of completeness required in the export, check the boxes for “Add attachments” and “Add SMTP Headers as an attachment.”
Note: Not all attachment types will convert into a PDF file successfully. Failed attachment conversion attempts will add significant retry time to the PDF export process and can cause the export of the email to fail.
Click OK when ready.
Once the export completes and the file(s) are downloaded, locate the .ZIP file in the local computer’s My Downloads folder and decompress it.
Inside will be a folder called DataCove, and inside that folder is a subfolder containing the PDF-converted itself as well as an HTML manifest file called Index.html.
The Index file contains a manifest of every email in the export, sorted by datestamp, sender name and email address and the subject line of the email and is best used for finding and reviewing individual emails from the export.
Clicking on the Details link on the right hand side of the manifest will jump the page over to an expanded view of that particular email, providing additional data like the exact filename, Message ID and the To/CC contact list.
The PDF of the email itself can be directly opened by selecting the View button, which will open the email from within the subfolder without having to find it manually.
When diving into the Exported Email subfolder directly, the emails are listed by datestamp, sender email address and subject line. This is similar to what the Index file contains, but can be less responsive to dig through individually.
Double clicking any PDF file inside will open it in the default PDF reader installed on the workstation.
These are the exported emails that can be provided to legal counsel for further review.
When looking at an opened PDF file, locate the Paperclip or Attachments icon in the PDF Reader application (different applications will have this in different places).
Selecting that Attachments icon will provide a listing of the attachments that are layered into the PDF export, whereupon double clicking them will open their respective files for independent download and access.
The last type of popular export is “PST” which exports a conglomerated version of each email, replete with their own attachments (when applicable) and headers, into a single .PST file containing all of the emails.
.PST files have been popular since the 1990’s with the advent of Microsoft Outlook and is a favored storage type used in Windows environments, thus forcing popularity with all sorts of email and archiving providers.
.PST exports are a substantially slower method of exporting from DataCove as converting and inserting all of the emails, and their attachments, into a single PST file is incredibly resource intensive.
When exporting large amounts of emails in the .PST format, maximum efficiency is achieved by running exports in approximate 20,000 email chunks, with export durations at this quantity varying between 12 hours and 30 hours.
To begin a PST export, select “PST” from the export menu as the output file type, create a filename for the .ZIP file that the export will be compressed into, and if desired, add an email address in the Email On Completion field, which will notify the specified email address when the export is complete.
Note: Not all attachment types will convert into a PST file successfully. Failed attachment conversion attempts will add significant retry time to the PST export process and can cause the export to fail.
Click OK when ready.
Once the export completes and the file(s) are downloaded, locate the .ZIP file in the local computer’s My Downloads folder and decompress it.
Inside will be a folder called DataCove, and inside that folder is a subfolder containing the PST file itself as well as an HTML manifest file called Index.html.
The Index file contains a manifest of every email in the export, sorted by datestamp, sender name and email address and the subject line of the email and is best used for finding and reviewing individual emails from the export.
Clicking on the Details link on the right hand side of the manifest will jump the page over to an expanded view of that particular email, providing additional data like the exact filename, Message ID and the To/CC contact list.
Clicking the View button on any email will attempt to open the .PST file directly, which may require prompting a locally installed Outlook client to import the .PST file to then view the files this way.
When diving into the Exported Email subfolder directly, a single .PST file will be present containing all of the emails from the export.
This .PST file should be imported into an Outlook client to begin viewing the contents, as they are not natively viewable without an Outlook client.
This .PST file can also be provided to legal counsel for further review directly.
For organizations within the European Union or who are otherwise subject to their archival laws, “To/From/Subject/Date” exports provide a Metadata-only variant of all of the emails in the export. Without getting too deep into the minutia of the archival requirements of the European Union, emails are the “work product” of an employee and the employee owns them, meaning the organization isn’t allowed to archive them fully. In this scenarios, the organization can only archive data “around” the email itself, such as who sent it, whom it was sent to, the subject line and the datestamp. This is known as the email’s metadata and it is enough to identify an email, but not possess its contents.
Metadata archiving is only a requirement in the European Union and other locations following their laws and generally require the DataCove be configured in a manner that meets these needs before archiving any data.
All organizations, European Union-sited or not, can still conduct HTML and Comma Separated Value (.CSV) metadata exports from the DataCove in scenarios where the email content is not desired for provision.
Since metadata exports are only very small amounts of data from each email, exports of the HTML or CSV type are extremely fast, regardless of quantity of emails being exported, and generally complete within mere minutes.
To begin a metadata export, select either “To/From/Subject/Date” from the export menu for HTML as the output file type, or “To/From/Subject/Date (CSV)” for the .CSV output file type, then create a filename for the .ZIP file that the export will be compressed into, and if desired, add an email address in the Email On Completion field, which will notify the specified email address when the export is complete.
Click OK when ready.
Once the export completes and the file(s) are downloaded, locate the .ZIP file in the local computer’s My Downloads folder and decompress it.
Inside that decompressed folder is the HTML metadata file called Index.html.
The Index file contains a manifest of every email in the export, sorted by datestamp, sender name and email address and the subject line of the email.
As this is a metadata only export, there is no way to see any further data about the emails beyond this manifest.
This file can be provided directly to legal counsel as is.
For .CSV format exports, once the export completes and the file(s) are downloaded, locate the .ZIP file in the local computer’s My Downloads folder and decompress it.
Inside the decompressed folder will be a file called Index.csv.
Double-click on the file to open it in a spreadsheet application such as Microsoft Excel.
The .CSV file will contain the same information to what the metadata HTML variant possesses, but in spreadsheet format. All of the tools used in spreadsheets, such as sorting filters and pivot tables, can be used to better dig through the data contained within.
This file can be provided directly to legal counsel as is.
The Print-to-Webpage functionality is not directly listed under the regular DataCove export options, but is another means of exporting emails from DataCove.
This feature “strings” together the selected emails into a single webpage so they can be printed out the same as any other webpage, but as an effectively long chain of emails. As a key reference point, the dynamic stitching together of emails on the fly and rendering them as a single page is a very resource intensive process for the workstation and browser accessing DataCove, and is thusly not recommended for more than 30 emails at a time to be exported this way. The DataCove itself is not the system conducting the export, but rather the local workstation, and few user workstations have the adequate amount of memory for this kind of dynamic webpage conglomeration.
Very long email chains or large quantities of emails being exported in this manner can easily crash the web browser being used to export them, so these kinds of printable exports are best performed only on the small scale.
Note: Attachments do not print out using the Print-to-Webpage functionality. This was an intentional design choice given how large attachments could be and the aforementioned quantitative export issues that already impact web browsers.
When a Print-to-Webpage export is initiated, a new browser tab will spawn and start preparing the emails for rendering. Scrolling through the emails will show how they are stitched together, with older emails on top and newer emails towards the bottom, for easier reading of context by the export receiver.
Once the page finishes rendering, a Print dialog box will automatically be spawned and allow for the selection of a printer to begin printing to, including PDF printers.
