Searching the Compliance Archive

The Archive provides search tools for locating archived emails. This article covers how to perform simple and extended searches, the available search fields and operators, and how to sort, save, and export search results.

About Archive Search

Search permissions vary by role. End users can search only for messages where they were a participant (sender or recipient, directly or through a distribution list). Discovery users can search across all messages in the Archive.

A search can be performed against any element of an archived email — subject, address, body, attachments — or scoped to a specific field. By default, searches return results regardless of date, but a time frame can be applied to narrow the results.

Performing a Simple Search

A simple search looks for a single keyword or phrase across one or more fields.

1. In the sidebar, click Search.
2. Enter the word or phrase in the keywords field. The screen expands to show the term in every searchable field.
3. Choose how to scope the search:
   • To search across all fields, click Search.
   • To search a specific field (for example, Subject), click the field name.
4. To restrict the search to a specific time frame, click the date selector and choose a time period.
5. Click Search.

 To clear all or part of the search criteria, click Clear.

Tip: To add more than one term to a single search field, enter the additional term and press Return. The term is automatically added to the currently selected field. Repeat to add multiple terms to the same field.

Performing an Extended Search

An extended search allows multiple fields to be searched simultaneously with operator-based logic.

1. In the sidebar, click Search. All search options should be visible.
2. For each field to be included in the search, enter the keyword or phrase. By default, the field is searched for all of the entered keywords; an operator can be selected to change this behavior (see below).
3. Click Search.

 Press Tab to move between search fields in the extended search view.

Search operators

Searchable Fields

Search Examples

End users

To find all archived messages:

1. Click Search.

To find archived messages sent or received today:

1. Select Today from the date range.
2. Click Search.

To find messages sent to Jane Smith (jsmith@example.com) last month that mentioned "update" and "project":

1. Enter jsmith@example.com in the keywords field and click To.
2. Enter update in the keywords field and click Subject.
3. Enter project and press Return.
4. Set the date range to last month.
5. Click Search.

Discovery users

To find messages exchanged between Jane Smith (jsmith@example.com) and Bill Smith (bsmith@example.com):

1. Enter jsmith@example.com in the Mailbox field.
2. Enter bsmith@example.com in the To field.
3. Click Search.

To find messages received by any employee last month that contained the word "confidential":

1. From the Date list, select Between and set the date range to the previous month.
2. In the Content field, enter confidential.
3. Click Search.

Working with Search Results

Archived messages matching the search criteria are listed on the search screen, showing the subject line, date and time, "from" address, and "to" address. Clicking a message in the results displays the full message in the right panel.

A found message can be forwarded to another internal user (a user with an email address from the company domain). Click the forward icon and enter the destination email address.

Note: Messages that exceed 10 MB cannot be retrieved.

Sorting Search Results

Search results can be sorted by archived date, received date, or size.

To change the sort order:

1. Enter search criteria.
2. Click Search.
3. Click the column title to sort by that column.

 Click a column title once for newest/ascending, or twice for oldest/descending.

Saving a Search

Frequently-used search parameters can be saved for re-use.

1. Enter search criteria.
2. Click Search.
3. Click the save icon above the search results table.
4. When prompted, enter a name for the search and click Save.

Note: Messages are retained in the Archive for a specific period of time. Search results may differ when re-running a saved search if matching messages have been disposed from the Archive in the interim.

Exporting Search Results

Note: Only Discovery users can export search results. End users can view their own messages but cannot export them.

Exported data is delivered in .eml format inside a compressed .zip file. A maximum of 100,000 messages can be exported in a single export job. To export larger result sets, narrow the search using additional parameters such as mailbox or date range.

To export search results:

1. After performing a search, click the Export icon above the search results table.
2. When prompted, enter a name for the export.
3. Optionally, enter a password for the file.
4. Click Export.

The export job is added to the queue and the resulting .zip file is downloaded automatically by the browser.