Search Parameters List

General parameters

  • name: Restricts the search to the names of files. The full word will need to be present (e.g. searching for "discovery" will not produce results with "ediscovery")
  • id: The file with the matching GoldFynch file ID will be retrieved. The entire file ID will need to be specified
  • body: Restricts the search to the body of the document. In the case of emails that are replies or forwards, this will include all quoted content from earlier emails in the email thread
  • content: lets you search for a specific term or phrase anywhere in your files irrespective of where it is found (email subject, file content, name, document notes, document annotations, etc. ) with one comprehensive "content" parameter.
  • type: Restricts the search to the file type of files
  • hash: Restricts the search to the hash value (file fingerprint) of files, i.e. the calculated md5 hash value. The md5 hash value is used to detect exact duplicates in GoldFynch
  • pstate:Restricts the search to one of the 7 processing states of the files:
  • Custodian: The custodian of a file. This is assigned by the user during upload
  • Source: The source of a file. This is assigned by the user during upload
  • name.ext: Restricts the search to the file extension of documents. Note that the "." before the extension should be left out (e.g. "name.ext = txt" not "name.ext = .txt")
  • name.term: Searches for the exact full name of a file (e.g. name.term = agreements/drafts/draft_v0.9.pdf)
  • name.dirs: Restricts the search to a particular directory (e.g. name.dirs = agreements) To search a subfolder, enter its full path (e.g. name.dirs = agreements/drafts) Note that when a parent directory is searched for, files in sub-folders are included as well
  • directory: Functions similarly to the 'name.dirs' parameter, but when used in the 'Advanced Search' view it provides a 'Browse' overlay to help you select a folder
  • tags: Restricts the search to the tags and codings that the case contains
  • body.date: Restricts the search to all dates found in the body of documents
  • date: Restricts the search to primary datesof files relative to an entered date (compared using the symbols =, >, <, >=, <=)
    • Note that unlike the Suggestions tab of the search bar, Advanced Searches require the date format "YYYY-DD-MM"
  • ingestion-date: Similar to the 'date' parameter, this restricts the search to the ingestion date of files relative to an entered date
  • attachment-depth: Checks the 'depth' of an attachment file or a file extracted from one. So a child of a child file (e.g. a text document that is extracted from a zip file, which is itself an attachment to an email) would have an attachment-depth = 2
  • family-role: Searches for files that are of a specific role in a file family's hierarchy (i.e. whether it's a container file, a file with attachments, an attachment, etc.)
  • child-count: Searches for files with a child-count relative to the value entered
  • pages: Looks for files with a specific number of pages
  • redacted: Searches for files with or without redactions based on the value selected. Note: This field can be set to either True or False. When set to True only files that have redactions will be retrieved. When set to False files that have no redactions will be retrieved
  • redactions: Retrieves files in which redactions exist or do not exist based on the value selected
  • privileged: Based on the value selected retrieves files either with privilege tags or files without privilege tags. Note: Similar to the redacted parameter this also can be set to either True or False. When set to True only files that have privilege tags will be retrieved. When set to False only files without privilege tags will be retrieved
  • privileged-category: Restricts the search to the various privileged categories that the case contains
  • production: Restricts the search to files relative to the selected production
  • review-set: Restricts the search to files associated with the selected review-set
  • reviewed: Searches for files that have been reviewed or not based on the value selected. Note: This field can be set to either True or False.
  • reviewed-by: Restricts the search to files reviewed by a particular user the case has been shared with
  • reviewed-in: Searches for files that have been reviewed within a particular review-set
  • in-review-set: Based on the value selected this parameter retrieves files that are either part of any review-set or those that are not in any review-set. This can be set to either True or False
  • size: Restricts the search to files that have a file size that is relative to the value entered. Note: The file size needs to be specified in Bytes for the search. 1KB is equal to 1000 bytes and 1MB is equal to 1,000,000 bytes.
  • system-tags:Searches for files relative to the system tags have been selected.
    • Corrupted file - rendered in extract mode: During automatic processing on upload, when GoldFynch encounters a corrupted Microsoft Excel file it cannot process and render, it attempts to open it using Excel's 'repair' mode. If it cannot, it attempts to directly extract cell text content. When this occurs, this system tag is added to the file to notify the user that a corruption exists, and any rendered information was obtained by extracting data
    • Corrupted file - rendered in repair mode: This tag is automatically added to a Microsoft Excel file when it has a corruption and cannot be processed regularly, and its information has to be obtained using Excel's 'repair' mode
    • DUPE: When you run the deduplication process this system tag is added to all files designated as 'dupes'
    • Rendered with repaired image: Sometimes EMF/WMF formatted images of Microsoft Word documents fail to print or "save to PDF" even when they can be opened and viewed without issue. GoldFynch can still process these files, but this tag is added to such files as a warning to users that some of the images may appear slightly different in our rendering (normally just some color or background color differences) and that the native file may not be printable/exportable if opened with Microsoft Word
    • Unrenderable hidden worksheet: GoldFynch attempts to force-unhide and render any hidden worksheets. But sometimes a hidden worksheet can be password protected so that it can't be unhidden. In that situation, GoldFynch adds this tag
    • Unusable as provided: sometimes eDiscovery software improperly detects file types, or treat binary files as plain text files, resulting in document productions containing very long and essentially useless document renderings of nonsense text (e.g., a CAD drawing in STEP format may be treated as a plain txt file, and provided as thousands of TIFF images of the raw STEP file text.) In some situations, GoldFynch can detect these types of files in incoming document productions, and it adds this tag to indicate the provided rendering is likely not very useful, and a native may need to be requested
    • UUEncoded attachment: UUEncoding is an old (and now quite rare) method of attaching files to emails by placing the attachment in a plain text format directly in the message body. Opening the native email in a program like Outlook will not show the attachment file and instead, just show the (sometimes very long) message body with the encoded attachment data. GoldFynch, however, detects these attachments and extracts them as separate files, adding this tag to notify users

Email-specific metadata parameters

  • subject: Restricts the search to the subject line of each email in the case
  • sent-date: Restricts the search to the sent date of each email in the case
  • received-date: Restricts the search to the received date of each email in the case
  • to.address: Restricts the search to the 'to' field of the email
  • from.address: Restricts the search to the 'from' field of the email
  • cc.address: Restricts the search to the 'cc' (carbon copy) email addresses
  • bcc.address: Restricts the search to the 'bcc' field of the email
  • recipient.address: Restricts searches to the 'to', 'cc' and 'bcc' fields at the same time, without needing to construct and link each parameter in the query with an 'OR' operator
  • participant.address: Restricts searches to the 'to', 'cc', 'bcc' and 'from' fields at the same time, without needing to construct and link each parameter in the query with an 'OR' operator (it functions identically to recipient.address but also includes the 'from' parameter)
  • fromOriginal.address: Retrieves the "X-Google-Original-From" header (explained here) of emails that were sent using an unverified gmail alias
  • savedBy.address: Retrieves emails that were saved or exported by the email address entered
  • sender.address: Retrieves emails that have been sent on behalf of someone (e.g. in Gmail you may see "sent from person1@gmail.com VIA person2@gmail.com". In Outlook the phrasing is reversed, "From person1@outlook.com ON BEHALF OF person2@outlook.com" ). GoldFynch only indexes this field when the sender header has a value that is different from the 'From' address
  • (field).address.domain: Restricts the search to the 'domain' component of the email (e.g. the query "from.address.domain is gmail.com" would display emails sent from addresses like "ross@gmail.com") The valid domain fields are 'from', 'to', 'cc', 'bcc', 'recipient', 'participant', 'FromOriginal', 'savedBy', and 'sender'.
  • (field).addressNorm: Retrieves the normalized email address. The normalized email address is one where the aliases or modifiers have been removed. This covers text following a "+" symbol and in the case of gmail addresses it will remove instances of the "." character (e.g. support+test@goldfynch.com will be read as support@goldfynch.com and g.o.l.d.f.y.n.c.h@gmail.com will become goldfynch@gmail.com). All email fields like 'to', 'from', etc. can be searched with their normalized versions.
  • (field).x500: Restricts the search to the Exchange x500 address of an email address, entered as a string value. All email fields like 'to', 'from', etc. can be searched with as x500 address versions. Note: GoldFynch stores LegacyExchangeDN values in the x500 address fields. Find out more about x500 addresses here.
  • (field).name: Restricts the search to the 'name' component of the email address (e.g. the query "to.name is john doe" would display all emails to John Doe irrespective of whether it is JohnDoe@gmail.com or johndoe@yahoo.com). The valid name fields are 'from', 'to', 'cc', 'bcc', 'recipient', 'participant', 'fromOriginal', 'savedBy', and 'sender'.

 Note: Email addresses must be complete addresses that exist in the case as part of the metadata of the email. Partial or misspelled emails are not supported in the search condition. E.g. If searching for emails from info@goldfynch.com, the search will return results only for info@goldfynch.com and not for info@goldfynch or @goldfynch.com.

Correct usage for email metadata parameters - full email address Correct usageWrong usage for email metadata parameters - incomplete email (.com is missing) Incomplete email address - not '.com'

Wrong usage for email metadata parameters - incomplete email (no name before @) Incomplete email address - no name

 Note: Only free text search results from the search bar (basic quick searches) and searches with the "body" parameter are highlighted within the body of the document - GoldFynch does not separately highlight instances of metadata parameters used, so a search for an email parameter like "from.address" will not be highlighted. If you wish to search for an email address in the body of the document, run a quick search or use the "body" parameter with the email address as the value.