Vault can search through email messages and also text-based attachment files, like those ending in .doc or .pdf, but be aware that it won't work for video, audio, images, or binary content. The email search page looks as follows:
Once you have selected Mail as the target for your search, follow these steps:
- Choose a data source from the All Data drop-down menu, as shown in the preceding screenshot. The following is a list of the data source options:
- All Data: Will cover everything available in the organization
- Held Data: Will focus the search on the data that is on litigation hold for the associated matter
- Unprocessed Data: This will use data that is not currently indexed; since it's not processed yet, you cannot use terms to narrow down the results on this data
- Define the scope for the search from the All Accounts drop-down, as shown in the preceding screenshot. The following is the list of options:
- All Accounts will use all accounts that are backed up in Vault within the organization
- Specific Accounts will narrow down the search to one specific user's data
- Organizational Unit will narrow down the search to the user's data within an organizational unit
- If you need to be more specific, you can filter all messages before or after a certain date, as well as within a date range, by filling the appropriate date range in the Sent date and to fields.
- Optionally, you can also define a Time zone for this search. You might need this if your team or clients are within different time zones since it can affect a date range.
- You can also define Terms if you need to narrow down your search to very specific content. This is particularly useful when you have too many unnecessary records matching your search.
The next step is to click on the Search button, but since the flow is the same for all types, we will continue from that step and beyond when we get to the Executing search and exporting results section.
In the next section, you will learn what to do when an investigation requires searching drive files.