View and Learn about Document Metadata
Document Viewer > Metadata
The following summarizes how to work with metadata:
- After indexing of data, you can display and search any of the metadata fields that are part of the index.
- The indexing state (representation level) for the data determines whether the index has just system (structural) metadata, file (embedded) and system metadata, or full system/file metadata and content. If you need a valid file MD5 value (contained in the filemd5 field) for deduplication purposes, you must minimally have a File Metadata Index. (Analytic metadata also applies to an Analytic Index and can be used for searching.) You can view metadata for any document in the Document Viewer.
- In addition to providing a file's MD5 value at import,
- The metadata fields you view are determined by the list of Metadata View Fields. The default list of Metadata View Fields includes common properties (such as email and document properties), but you can establish your own Metadata View Fields list.
- Metadata fields fall into one of the following types:
- Structural metadata fields represent information about the file itself, such as the file location or file size.
- Embedded metadata fields represent information that comes out of the document content, such as the subject or author. Note that the field content for embedded metadata fields such as filetype, author, and title is preserved in its original case instead of being displayed in all lowercase. Searching for this content remains as is (that is, search is not case-sensitive for tokenized fields that treat each term individually, or for fields that require all content but are not case-sensitive).
- Analytic metadata fields represent analytic information associated with Project Data and its views, such as Cluster Views, Group Views (Folders), and Tag Views.
- Prior to export, a user with Organization Administrator permissions can use the Export Fields to dictate which metadata fields appear in the export manifest, the order of the fields, and the field name. For example, to accommodate an eDiscovery work flow, the Administrator may want to order key export-only fields ahead of other fields and rename certain fields.
- After export, an Organization Administrator can view the complete set of system metadata fields (all indexed fields and export-only fields) in the appropriate file manifest (Concordance .DAT, .CSV, or EDRM XML). An EDRM XML file manifest additionally provides EDRM-specific fields.
About the Searchable Metadata Fields
By default, any term Search is a field Search for content (which uses a default field called contents), and the search is automatically expanded to search a subset of metadata fields.
You can also perform a metadata search for metadata field content only, in which you supply the metadata field name followed by :: (two colons) and the text or value for the field. In addition, you can also limit an entire content::<keyword> or content::(<keyword1> <keyword2> <keyword3>). For example, with Include Metadata enabled, the Standard Search syntax query war OR content::peace expands the search of the keyword war to include a common subset of metadata fields such as subject::war author::war, but restricts the search of the keyword peace to content-only. Note that for emails, a content:: search applies to both the email subject and the email body.
You can search indexed metadata fields. Consider the following when performing a metadata search:
- A tokenized metadata field is not case-sensitive and enables you to specify all or just a part of the field data, with or without wildcards. For example, you can search the tokenized author field using a first name (
author::jane), a last name (author::jones), or the entire name as a phrase (author::"jane jones"). - An untokenized metadata field requires you to specify all field content or use wildcards that address all field content. Some fields are also case-sensitive, such as
entryidandmessageid. Some fields, such aspatternvalue, are suitable for a literal search in single quotes. - You can use wildcards in a phrase search for metadata fields that observe standard tokenization (for example, bcc, cc, to, from, author, subject, title, comment, comments), but not the fields that observe path tokenization rules (for breaks on \ or /, such as the reviewfolder field). For example, you could use
subject::"advisory boar*"to find all emails with a subject that includes the phrase advisory board and advisory boards (because subject is standard tokenized), but you could not use"reviewfolder::"mail*"to find a path with mail because reviewfolder is path tokenized. You could usereviewfolder::mail*instead. - In general, if the metadata field content has spaces or special characters, you can put the entire field information in quotes. (This does not apply to fields with path information, such as the path-tokenized fields.)
- For metadata fields that take a date, you must use the complete date format
yyyy-MM-dd-HH-mm-ssif you are performing a search other than Advanced Search (for example, Freeform Search or Current Results). Use Advanced Search to get help entering complete dates.
About the Analytic Metadata Fields
A subset of fields are dedicated to reporting analytic information for documents within Project Data; that is, the information derived from analytic capabilities such as the identification of different types of Project Data views. For example, you can perform Searches on the following view-related Analytic Metadata fields, as described in Use the Standard Syntax for More Advanced Searches:
tag_viewcustodian_view(identifies the assigned Custodian view name or Unassigned, if no assignment has been made)batch_view(identifies the assigned batch view name or Unassigned, if no assignment has been made)mediaid_view(identifies the assigned mediaid view name or Unassigned, if no assignment has been made)group_viewcluster_viewdupe_fingerprint(a value that is computed based on the email deduplication settings for an email; for files that are not email, this is the file MD5 value). Thedupe_fingerprintvalue is available for export by default. See Manage Analytic Settings for the Project for more information about managing the email deduplication strategy.export_view(identifies an export stream and volume for a document subject to Export). You can search (for example, using a Freeform Search) using the formatexport_view::<stream_name>–[<vol_name>].export_view_docid
Another Analytic Metadata field called dateprimary provides a primary date value that accommodates dates from different types of source files (for example, documents found on disk versus email messages) in the Date column of document lists derived from Project Data.
Analytic Metadata fields support Email Survivorship, such as export_view_dupe_priority (for example, <export_stream>-VOL0001:0002), and export_view_reason_code (for example, <export_stream>-VOL0001:Search).
If you can view and manage Export information in your Project, an export-related Analytic Metadata field called export_view_docid reports a per-volume document ID to help you learn about a given document's export history (that is, which export streams and volumes are associated with the document). Uses the following format <export_stream_name>-<export_volume_name>-<per-volume-docid> to identify the document ID associated with a particular export volume of an export stream. You can search for a document using this field information (for example, export1-VOL0001-DOC0000000003 would return the document with document ID 0000000003 in export stream stream1 and export volume VOL0001). You can use wildcards for the different portions of the format, each separated by a - (for example, export_view_docid::*-*-DOC0000000003). You can use this field in range searches as well.
Of the Analytic Metadata fields, the following can appear in a view manifest (generated for a view of Project Data using the Create Manifest option with All Metadata Fields, or in a selected metadata template that includes the fields).
batch_view
cluster_viewcluster_view_plus_similaritycustodian_viewdateprimarydupe_fingerprintexport_viewexport_view_docidexport_view_reason_codeexport_view_dupe_priorityfamily_fingerprintfamily_handlegroup_viewmediaid_viewtag_viewthread_handle
For export, the custodian_view Analytic Metadata field can appear in an Export manifest (load file), if it is included in the Export Fields of the Project Export Fields (or template) used for an Export.
About the Export-Only Fields
Some metadata fields apply to Export only. In the metadata tables, the Export-only fields have a column called Export-Only Field set to Yes.Note the following about these Export-only fields:
- Export-only fields are in uppercase/lowercase (mixed case, or bumpy case) format. An example is DocID. All indexed system metadata fields are in lowercase.
- The set of Export-only metadata fields capture key document information for an eDiscovery work flow. These are considered special system metadata fields that may warrant a specific order in the appropriate load file.
- The Export-only fields are not intended for searching and apply only to the appropriate Export load file. Export-only fields are not visible or searchable in the Document Viewer.
Exported .CSV for Tag Details
Regardless of the export file manifest type, an additional .CSV file called <volume>-TagReasonCodes.csv is generated at export to provide more information about how exported Tags were applied (for example, to a Work Basket Search task). This .CSV file contains the following fields:
SearchID, which is an identifier for each Tag that is part of a Tagging operation.User, which identifies the user who performed the operation.Date, which provides the date and time that the operation was performed.Description, which provides details about the operation (for example, Search for filename:*.xls AND econom* in C1). Populated for when the operation is a Search, but not when Tagging is applied to a document, email Thread, or individual email message. When multiple tags are applied during an operation, the same description appears for each SearchID entry (one for each Tag).Comment, which identifies any comments added during the Tagging operation. When multiple tags are applied during an operation, the same comment appears for each SearchID entry (one for each Tag).
In the appropriate file manifest, a given document may report one or more Tags in the TagID field and one or more Search IDs in the SearchID field (one for each Tag applied).
Metadata Fields
The following table lists the metadata fields in alphabetical order and identifies those that are export-only. Note the following:
- System metadata-only fields are identified in the field description. These are the structural metadata fields that apply when the Index state is set to System Metadata. If a system metadata field has an MD5 value, that value is zeroed.
- Indexed field names (that is, fields populated at import) are displayed in lowercase.
- Field content for embedded metadata fields such as filetype, author, and title is displayed in its original case (for example, file types in the filetype field are displayed in mixed uppercase/lowercase). Searching this field content depends on whether the field makes each term in the field content searchable, or whether all field content must be provided (which means that the field may or may not be case-sensitive).
- Many fields in the following table are tokenized (as indicated), which means they support individual term search and you can search part or all of their content without regard to case, with or without wildcards. If a metadata field is untokenized, all of the information in the field must be accommodated in a search. Some fields are also case-sensitive when searched (for example, entryid and messageid), but many are not; review the field's description to determine this.
- As indicated, a metadata field either has a value or text.
- All date information is shown according to the Project time zone, either the default time zone of Coordinated Universal Time (UTC), or a time zone selected using the Project Preferences. Supporting fields identify the appropriate UTC offset and standard time zone, when available. Typically, the offset is populated and the time zone is not populated. When no offset is available to indicate a local time zone, the appropriate offset field displays -0000.
- Exported Date field information is by default stored in the format mm/dd/yyyy, but Excel shows the date without any padding (for example, as 4/4/2014 instead of 04/04/2014). The Excel style is shown in all Export Date field examples.
- When you set up an Export, the date and time format selections affect the load file format of the date-only Export metadata fields (for example, DateCreated), time-only fields (for example, TimeCreated), and the general fields that represent combined dates and times for load files other than EDRM XML. EDRM XML has its own format and does not observe your date/time format.
contents to enable any search for content. This special field is not selectable for viewing metadata or for Export Fields; it is available only in the content::<keyword> or content::(<keyword1> <keyword2> <keyword3>). See About the Search Metadata Fields and Use the Standard Search Syntax for Basic Queries for more information.
Remember that tokenized fields, as described above, can be searched for part or all of their content without regard to case, with or without wildcards.
| Metadata Field
(after import, or full metadata export) |
Export-Only? | Description | Tokenized? | Notes |
|---|---|---|---|---|
| acls |
|
|||
| AllPaths | Yes | For a master parent document, identifies a semicolon-delimited list of unique reviewfolder field values for all duplicates of the document in the Export Stream. Applies to all forms of Export Duplicates processing, and observes the current deduplication setting (Global or Custodial). Reports Windows-compatible path information (that is, with \ folder separators). | ||
| altbcc | For Lotus Notes emails, identifies all email recipients blind copied on the email using RFC 822/2822 style email addresses, each separated by a comma or semicolon. This file also applies to Bloomberg users (Bloomberg messages or Instant Bloomberg messages) if two email addresses are defined in the user information. | Yes | ||
| AltBcc_Address | Yes | For export of Lotus Notes emails, identifies the RFC 822/2822 style email address portion of an email recipient who was blind copied on the email (based on the altbcc field). Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| AltBcc_Name | Yes | For export of Lotus Notes emails using RFC 822/2822 format, identifies the name portion of an email recipient who was blind copied on the email (based on the altbcc field). Not populated often. Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| altcc | For Lotus Notes emails, identifies each email recipient who was copied on the email using RFC 822/2822 style email addresses, each separated by a comma or semicolon. This file also applies to Bloomberg users (Bloomberg messages or Instant Bloomberg messages) if two email addresses are defined in the user information. | Yes | ||
| AltCc_Address | Yes | For export of Lotus Notes emails, identifies the RFC 822/2822 style email address portion of an email recipient who was copied on the email (based on the altcc field). Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| AltCc_Name | Yes | For export of Lotus Notes emails using RFC 822/2822 format, identifies the name portion of an email recipient who was copied on the email (based on the altcc field). Not populated often. Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| altfrom | For Lotus Notes emails, identifies the sender of this email using an RFC 822/2822 style email address. For a Lotus Notes email sent on behalf of another person, thr value may identify the intended (impersonated) sender and may not match the altsender field value (the actual sender). This file also applies to Bloomberg users (Bloomberg messages or Instant Bloomberg messages) if two email addresses are defined in the user information. | Yes | ||
| AltFrom_Address | Yes | For export of Lotus Notes emails, identifies the RFC 822/2822 style email address portion of an email sender (based on the altfrom field). Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| AltFrom_Name | Yes | For export of Lotus Notes emails using RFC 822/2822 format, identifies the name portion of an email sender (based on the altfrom field). Not populated often. Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| altparticipants | For Lotus Notes emails, contains one or more RFC 822/2822 style email addresses, each separated by a comma or semicolon. If an email address is not complete, contains whatever content was discovered. The terms in the altparticipants field represent a subset of the altto, altfrom, altbcc, altcc |
Yes | ||
| altsender | For Lotus Notes emails, identifies the sender of this email using an RFC 822/2822 style email address (the actual sender, not an impersonated sender). | Yes | ||
| AltSender_Address | Yes | For export of Lotus Notes emails, identifies the RFC 822/2822 style email address portion of an email sender (based on the altsender field). Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| AltSender_Name | Yes | For export of Lotus Notes emails using RFC 822/2822 format, identifies the name portion of an email sender (based on the altsender field). Not populated often. Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and the similar _Address and _Name fields in the Project Export Fields template. | ||
| altto | For Lotus Notes emails, identifies each intended recipient of this email using RFC 822/2822 style email addresses, each separated by a comma or semicolon. This file also applies to Bloomberg users (Bloomberg messages or Instant Bloomberg messages) if two email addresses are defined in the user information. | Yes | ||
| AltTo_Address | Yes | For export of Lotus Notes emails, identifies the RFC 822/2822 style email address portion of an email recipient (based on the altto field). Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| AltTo_Name | Yes | For export of Lotus Notes emails using RFC 822/2822 format, identifies the name portion of an email recipient (based on the altto field). Not populated often. Since there is a potential performance impact associated with populating fields that break the email address into portions, you may want to omit this and similar _Address and _Name fields in the Project Export Fields template. | ||
| ancestordahandle | For any document that has been copied to document storage, or, in general, any child document (attachment or archive-extracted document), this field includes v and a entries (v is the parent dahandle value and a is the data area name). Not case-sensitive for the purposes of search for the parent dahandle value. | |||
| ApplicationName | Yes | For export, the source application, such as Microsoft Office Word. | ||
| AttachmentID | Yes | For export, a list of attachment document IDs, each separated by a semicolon. | ||
| AttachmentRange | Yes | For export, the range of attachment document IDs. |
||
| attachments | Lists the file names of the attachments of a parent email or Short Message Format (SMF) item, separated by semicolons. If a Bloomberg message attachment resides in the XML file but not in the attachment archive, it has a parsingstatus of Attachment Missing. | Yes | ||
| attachmentsmd5 | A value representing the attachment MD5 for an email. If two documents have the same attachmentsmd5 value, they have the same attachments (that is, the value represents an MD5 of all the combined attachments). Not case-sensitive when searched. | |||
| attendees | For an email Calendar item, provides a list of meeting attendees. | Yes | ||
| author | A name identifying the author of the document. | Yes | ||
| auxfiletype | For email, an auxiliary file type that provides additional information, such as msg, eml, or emlx. The auxfiletype msg applies to any type of Microsoft Outlook MSG file that is a regular email or a Calendar, Contact, Journal, or Task entry. The auxfiletype eml applies to other types of email, such as Lotus Notes. The auxfiletype emlx applies to Apple Mail 2.0 Messages. The auxiliary file type bloomberg-attachment-archive applies to the attachment archive (application/x-gzip) for a companion Bloomberg Message Dump (XML) file. | Yes | ||
| auxparsingstatus | Contains the auxiliary warning that was generated for a file on import or reprocessing(if any). For a list of possible values, see the Auxiliary Parsing Status Warning table in View Imports Reports. Not case-sensitive when searched. | New in 5.4.2.2 | ||
| averagenumberoftermsperpage | Contains a padded 5-digit value representing the average number of terms calculated per page. Populated for any document that has information in the pagecount field (for example, a PDF, or a Microsoft Word document). | |||
| batch | A System Metadata field with information that identifies a batch of imported data. When you set up an Import, you can specify a Batch name or number. If you do not specify a Batch name or number for Import, the Data Set name is used. Not case-sensitive when searched. | |||
| batch_view | An Analytic Metadata field identifying the batch view to which the document is assigned, or Unassigned if the document is not assigned to a batch. The value matches the batch field value unless you have changed the assignment after adding the document to Project Data. If you include this field in the Export Fields used for Export, the load file identifies the document's batch view at the time the Export load file was produced. | New in 5.4.0.0 | ||
| bcc | Lists the email recipients blind copied on an email. You can use the bcc field as part of an email deduplication strategy (set using the Analytic Settings or Analytic Settings template). When you display this field after import, each recipient is separated by a comma or semicolon, depending on the source data (for example, for Microsoft Outlook, donna.lolly@elron.com, sara.shack@elron.com). For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco). For export, each recipient is always separated by a semicolon (for example, donna.lolly@elron.com; sara.shack@elron.com; moira.wren@elron.com). |
Yes | ||
| bcc_identifier |
|
Yes | New in 5.4.1.0 | |
| bcc_name |
|
Yes | New in 5.4.1.0 | |
| BegAttach | Yes | For export, the starting attachment document ID (for example, for an email). | ||
| BegDoc | Yes | For export, the starting document ID. | ||
| blocksize |
|
|||
| bloombergdisclaimer | For a Bloomberg Message Dump (XML) file, a reference and text field associated with the disclaimerreference (disclaimer notice) of an email. | |||
| bloomberglanguage | For Bloomberg messages, text or a code representing the language or Bloomberg-specific font code page used when forming a given message, such as English, French, Code 65001). Not case-sensitive when searched. | |||
| bloombergtype | For Bloomberg messages, text representing the Bloomberg message type (CHAT, TMSG, or VMSG). Only CHAT, TMSG, or VMSG messages contain this field. Not case-sensitive when searched. | |||
| bloomberguser | For Bloomberg messages or Instant Bloomberg (IB) messages, detailed information about the user. A message may have many bloomberguser entries. Each section of this field is separated by a | (pipe character), and some sections may not be populated. All user entries for Instant Bloomberg messages start with ib. For Bloomberg messages from Message Dump files, the user is either identified as a recipient or a type of sender. When identifying a recipient, this field may identify additional recipients to which the message was forwarded. Recipient entries also include a delivery type, such as cc or bcc. When identifying a sender, this field may identify a user who sent a message as part of a Bloomberg shared message group (sharedmessenger), a user whose credentials were referenced to send a message (onbehalfof), or a user who originated a message (origsender). Not case-sensitive when searched. Bloomberg Message | |||
| bloombergversion | For a Bloomberg Message Dump (XML) file or a Bloomberg IB Dump (XML) file, identifies the appropriate Bloomberg version. Not case-sensitive when searched. | |||
| bytecount | A value representing the count (in bytes) for a document. | |||
| category | A status property used by Microsoft Office applications (for example, a categorization of content such as letter, proposal, or resume). | Yes | ||
| cc | Each email recipient who was copied on the email. When you display this field after import, each recipient is separated by a comma or semicolon, depending on the source data (for example, for Microsoft Outlook, don.lol@elron.com, sam.iam@elron.com). For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco). For export, each recipient is separated by a semicolon (for example, dora.lolly@elron.com; sam.stark@elron.com; mo.otoole@elron.com). |
Yes | ||
| cc_identifier | Provides the unique identifier of a recipient who was copied on this message. Sample values include phone numbers, email addresses, and usernames. |
Yes | New in 5.4.1.0 | |
| cc_name |
|
Yes | New in 5.4.1.0 | |
| charcount | A value representing the number of characters in a document. | |||
| charcountlongestword | A value representing the number of characters in the longest word of a document. Helps identify PDFs without searchable text. Uses a padded 5-digit value. | |||
| checkedby | A property used by Microsoft Office applications to identify the person or entity responsible for checking the document. | Yes | ||
| childcount | A value identifying the number of children directly extracted from a given parent file (for example, Mail Items, Mail Containers, Archives, Compressed Files, or Disk Images). Supports range searches and is automatically padded for searches (as shown in the Query Executed). The Document Viewer displays the value without padding. | |||
| client | A status property used by Microsoft Office applications to identify the client used. | Yes | ||
| Clusters | Yes | For export, identifies the cluster to which this document belongs. This export field is disabled by default. | ||
| cluster_view | An Analytic Metadata field that shows the cluster hierarchy (for example, the top-level cluster_view for Project Data, and the cluster to which the document belongs).Opening the folder used to represent the cluster_view shows individual view name and similarity fields with details, as well as the cluster_view for the document. If you search for a cluster view within Project Data, use only the name of the cluster. | |||
| cluster_view_plus_similarity | A special Analytic Metadata field that enables the display of the cluster view name plus the similarity field value indicating the document's similarity to the seed document for the cluster. Not intended to be searchable. | |||
| collaborators | The contents of a Google metadata field of the same name, identifying accounts and groups that have direct permission to edit the file or add comments; also includes users with indirect access to the file if this option is chosen during export. (In Google Vault, this field is part of the "Share a matter" functionality that allows a Vault user, usually a legal admin or investigator. to grant other users within their organization access to a specific matter.) | |||
| comment | (Legacy field; consolidated into comments, below) | Yes | ||
| comments | Text of a document or email comment. | Yes | ||
| company | A property used by Microsoft Office applications to identify a company or Organization. | Yes | ||
| container | A value identifying the document handle of a type of container archive file from which a file was extracted. Not case-sensitive when searched. | |||
| containerfolder | For import as well as export, the path internal to a container (e.g., zip or .pst) where the document was found. Not case-sensitive when searched. Does not support phrase search with wildcards. | Uses path tokenization rules (for word breaks on \ or /) |
||
| contentdescription | MIME protocol header text characterizing the document body content. | Yes | ||
| contentdisposition | MIME protocol header text accompanying an email message with attachments. Not case-sensitive when searched. | |||
| contentid | A MIME protocol header value representing the contents of an attachment. | |||
| contentlanguage | Text for a MIME Content-Language header specifying the natural language of the data. Not case-sensitive when searched. | |||
| contentmd5 | For files at the Content or Analytic Index level--that is, those from which content has been extracted--the contentmd5 is a hash code representing the content of a document, or the subject line and body text of an email. (By contrast, the filemd5 is a hash code based on the entire file, such as a .docx or .msg file.) You can search for content duplicates within a view, or content duplicates of a selected document. Files are a content match if they have matching content MD5 values. Document type and formatting are ignored. For example, a PDF and a Word document used to create that PDF would be a content match. Not case-sensitive when searched. | |||
| contentransferencoding | As defined by Microsoft, shows the encoding mechanism used when sending an object's contents over the network (for example, binary, 7bit, base64, and 8bit). Not case-sensitive when searched. | |||
| contenttype | A status property used by Microsoft Office applications to identify the content type of the document (for example, text/plain). Can be used to identify an email alternative body. Not case-sensitive when searched. | |||
| conversationindex | For import as well as export, this field applies to Microsoft Outlook messages and provides a value indicating the position of the Outlook message within a given conversation. Not case-sensitive when searched. For details on this MAPI field value, see the Microsoft description for PR_CONVERSATION_INDEX. | |||
| conversationindexguid | For import as well as export, this field provides the GUID portion of the conversationindex that can be used to group emails in a downstream tool. Not case-sensitive when searched. | |||
| createdtime | A System Metadata field identifying the creation time of a file or item, including for Short Message Format (SMF) items. The value represents the timestamp (in yyyy-MM-dd-HH-mm-ss format) associated with the origin of the file or item — sometimes referred to as its "birthtime" — and is populated from the native creation time provided by the Connector. | |||
| custodian | Contains the name of the Custodian to whom this document is assigned at the time of Import. May also have the value partitioned for a disk image. Not case-sensitive when searched. |
|||
| custodian_view | An Analytic Metadata field identifying the Custodian view to which the document is assigned, or Unassigned if the document is not assigned to a Custodian. The value matches the custodian field value unless you have changed the Custodian assignment after adding the document to Project Data. If you include this field in the Export Fields template used for Export, the load file identifies the document's Custodian view at the time the Export load file was produced. | |||
| dafilesource | A System Metadata field identifying the source of this file. For an initial import location, matches importpath information. For a subsequent file location, identifies where the file came from. This is an information-only field that cannot be searched, and its format is not always suitable for construction into an actual path. It is not eligible for Export. | |||
| dafilestate | A System Metadata field identifying the current state of the file (imported, copied, deleted, encrypted, or converted). Not case-sensitive when searched. | |||
| dafilestatetime | A System Metadata field with a |
|||
| daghandle | A value representing the document handle of the parent document representing all documents in a Document Attachment Group (DAG). Not case-sensitive when searched. | |||
| dahandle | A System Metadata field identifying the data area handle where this instance of the file is located. Not case-sensitive for the purposes of search for the dahandle value. Appears under a location entry in the Metadata panel of the Document Viewer. When this field includes v and a entries, v is the dahandle value and a is the data area name. | |||
| darelativepath | A System Metadata field identifying the file's path relative to the path of the data area. The mount point, data area directory, and this value can be combined to address the document. | |||
| date | Contains an email's date, which is a sent date, if available, or a received date otherwise, in the format yyyy-MM-dd-HH-mm-ss. Values aside from yyyy are padded when necessary. | Date | ||
| dateaccessed | Deprecated. [Timestamp for the document’s date accessed (in Coordinated Universal Time), yyyy-MM-dd-HH-mm-ss.] | |||
| DateAccessed | Yes | Deprecated. [For export, the date portion of the embedded metadata field dateaccessed (time is reported in another field, TimeAccessed). The default format is mm/dd/yyyy.] | ||
| datebackedup | Timestamp for the document’s backup date (in Coordinated Universal Time), yyyy-MM-dd-HH-mm-ss. | |||
| DateBackedUp | Yes | For export, the date portion of the embedded metadata field datebackedup (time is reported in another field, TimeBackedUp). The default format is mm/dd/yyyy. | ||
| datecompleted | A property used by Microsoft Office applications to provide a timestamp for the document’s completion date (in Coordinated Universal Time), yyyy-MM-dd-HH-mm-ss. | |||
| DateCompleted | Yes | For export, the date portion of the embedded metadata field datecompleted (time is reported in another field, TimeCompleted). The default format is mm/dd/yyyy. | ||
| datecreated | An embedded metadata field that contains a timestamp for the document's creation date, yyyy-MM-dd-HH-mm-ss. | |||
| DateCreated | Yes | For export, the date portion of the embedded metadata field datecreated (or, if datecreated is unavailable, the createdtime field). Time is reported in another field, TimeCreated. The default format is mm/dd/yyyy. | ||
| DateCreateSystem | Yes | For export, the date portion of the System Metadata field createdtime (for CIFS), reporting the date on which the file was created (time is reported in another field, TimeCreateSystem). The default format is mm/dd/yyyy. | ||
| datedue | For an email Task, the due date for a task using the format yyyy-MM-dd-HH-mm-ss. | |||
| DateDue | Yes | For export, the date portion of the embedded metadata field datedue (time is reported in another field, TimeDue). The default format is mm/dd/yyyy. | ||
| dateedited | Timestamp for the document's date edited using the format yyyy-MM-dd-HH-mm-ss. | |||
| DateEdited | Yes | For export, the date portion of the embedded metadata field dateedited (time is reported in another field, TimeEdited). The default format is mm/dd/yyyy. | ||
| dateended | For an email Calendar item, the date a meeting ended using the format yyyy-MM-dd-HH-mm-ss. For an Instant Bloomberg message, the date a CHAT ended. | |||
| DateEnded | Yes | For export, the date portion of the embedded metadata field dateended, reporting when an email Calendar item or Bloomberg CHAT ended (time is reported in another field, TimeEnded). The default format is mm/dd/yyyy. | ||
| DateEWFAcquired | Yes | For export, the date portion of the embedded metadata field ewfdateacquired, reporting the EWF acquisition time (time is reported in another field, TimeEWFAcquired). The default format is mm/dd/yyyy. | ||
| DateExported | Yes | For export, the date a document was Staged for export, using the fixed format mm/dd/yyyy. If a document is re-staged (for example, because a document was originally a container reference, or because a volume was disabled), then the document's DateExported is updated with a new DateExported value. |
||
| DateFlagCompleted | Yes | For export of Microsoft Outlook items, the date portion of the field flagcompleted, reporting the date on which the flagged item was marked by the user as complete. The default format is mm/dd/yyyy. | ||
| DateFlagDue | Yes | For export of Microsoft Outlook items, the date portion of the field flagdue, reporting the due date set by the user for the flagged item. The default format is mm/dd/yyyy. | ||
| DateFlagStarted | Yes | For export of Microsoft Outlook items, the date portion of the field flagstarted, reporting the date on which the flag was applied to an item. The default format is mm/dd/yyyy. | ||
| DateLastAccessed | Yes | For export, the date portion of the NFS/CIFS System Metadata field lastaccesstime, reporting the date on which the document was last accessed (time is reported in another field, TimeLastAccessed). The default format is mm/dd/yyyy. | ||
| DateLastChanged | Yes | For export, the date portion of the NFS/CIFS System Metadata field lastchangetime, reporting the date on which the document was last changed (time is reported in another field, TimeLastChanged). The default format is mm/dd/yyyy. | ||
| DateLastMod | Yes | For export, the date portion of the embedded metadata field datemodified (or the field lastmodifiedtime, if no datemodified value is available). Reports the date on which a document was last modified (time is reported in another field, TimeLastMod). The default format is mm/dd/yyyy. | ||
| DateLastModSystem | Yes | For export, the date portion of the NFS/CIFS System Metadata field lastmodifiedtime, reporting the last date on which the file was modified (time is reported in another field, TimeLastModSystem). The default format is mm/dd/yyyy. | ||
| DateLastPrinted | Yes | For export, the date portion of the embedded metadata field dateprinted, reporting when a document was last printed (time is reported in another field, TimeLastPrinted). The default format is mm/dd/yyyy. | ||
| DateMediaCreated | Yes | For export, the date portion of the embedded metadata field mediacreationtime (time is reported in another field, TimeMediaCreated). The default format is mm/dd/yyyy. | ||
| datemodified | An embedded metadata field that contains a timestamp for the document date modified, yyyy-MM-dd-HH-mm-ss. | |||
| dateoffset | Use this field with the date field. It identifies the offset from Coordinated Universal Time for a dated email's time using the format sHH:mm, where: s is a + or - sign indicating whether time of day is ahead of (east of) or behind (west of) , HH: identifies the offset hours, and mm identifies the offset minutes. This is commonly known as the UTC offset (+ or - UTC, for example, -0400). Not affected by the time zone selected for the Project or for Export. | |||
| dateprimary | An Analytic Metadata field providing a primary date value for each document added to Project Data (it does not appear in Data Set views).
The value is derived from other date fields based on document type; for example, for email, the sent date is used if available, with received date as the fallback.
The field's value is propagated from parent files to their child files (and the children have that primary date only, not their own). |
|||
| DatePrimary | Yes | For export, the date portion of the dateprimary field information (time is reported in another field, TimePrimary). The default format is mm/dd/yyyy. | ||
| dateprinted | A property used by Microsoft application to provide a timestamp for the date printed (in Coordinated Universal Time), in the format yyyy-MM-dd-HH-mm- ss. | |||
| DateProcessed | Yes | For export, the date portion derived from the datescanned field, reporting when the document was imported (time is reported in another field, TimeProcessed). The default format is mm/dd/yyyy. | ||
| DateReceived | Yes | For export, |
||
| DateRecorded | Yes | For export, the date portion of the embedded metadata field recordeddate (time is reported in another field, TimeRecorded). The default format is mm/dd/yyyy. | ||
| datescanned | A System Metadata field with a timestamp (in Coordinated Universal Time) for the date scanned, in the format yyyy-MM-dd-HH-mm-ss. | |||
| DateSent | Yes | For export, |
||
| datestarted | For an email Calendar item, the date a meeting started using the format yyyy-MM-dd-HH-mm-ss. For an Instant Bloomberg message, the date a CHAT started. | |||
| DateStarted | Yes | For export, the date portion of the embedded metadata field datestarted, reporting when an email Calendar item or Bloomberg CHAT started (time is reported in another field, TimeStarted). The default format is mm/dd/yyyy. | ||
| datetaken | For image files such as JPGs, the date the image was taken using the format yyyy-MM-dd-HH-mm-ss. Populated for image files if the date taken information is present. | New in 5.2.5.x | ||
| DateTaken | Yes | For export, the date portion of the datetaken field information, reporting when an image (such as a JPG) was taken (time is reported in another field, TimeTaken). The default format is mm/dd/yyyy. | New in 5.2.5.x | |
| datezone | For email, use this field with the date field. When available, it identifies an acronym (for example, EST or EDT) representing a dated email’s time zone in Coordinated Universal Time, UTC. Not case-sensitive when searched. Not affected by the time zone selected for the Project or for Export. | |||
| deliveredto | Identifies the person to whom this email was delivered. Not case-sensitive when searched. | |||
| deliveryreportrequested | Boolean indicating whether an email requested a report of when the email was delivered. Applies to an MSG or an EML. | |||
| department | A status property used by Microsoft Office applications to identify the author’s department. Not case-sensitive when searched. | |||
| depotfile | A Boolean that identifies when a file resides in Document Depot (for example, expanded or uploaded files have a field value of Y). | |||
| description | A property used to describe the document. Not case-sensitive when searched. | |||
| destination | A status property used by Microsoft Office applications to identify a document’s destination. Not case-sensitive when searched. | |||
| dirchildcount | For a given directory, reports the number of documents or directories found in the directory when the directory was scanned. A value of 0 identifies an empty directory. Supports range searches and is automatically padded for searches (as shown in the Query Executed). Not case-sensitive when searched. The Document Viewer displays the value without padding. | |||
| disclaimerreference | For Bloomberg messages, identifies a value representing a given Bloomberg firm or account disclaimer reference number in an email. Not case-sensitive when searched. | |||
| diskpartitions | Populated for a partitioned disk type with multiple partitions, including MBR and GPT. Provides a semicolon-separated list of the partition types in the raw image (such as linux;extended;linuxswap;bitlocker). | Yes | ||
| diskpartitionstatus | Populated for a partitioned disk type with multiple partitions, including MBR and GPT. Value is a semicolon-separated list identifying the processing status of each partition as success, error, or skipped (for example, success;skipped;skipped). | Yes | ||
| disposition | A status property used by Microsoft Office applications. Not case-sensitive when searched. | |||
| division | A status property used by Microsoft Office applications. Not case-sensitive when searched. | |||
| docannotations | Identifies a document with annotations (Excel_Auto_Filter, Excel_Comments, Excel_Protected_Worksheets, Excel_Protected_Workbook, Excel_Track_Changes, Pdf_Comments, Word_Comments, Word_Revisions (to flag edits, even when track changes is disabled), PowerPoint_Comments, or PowerPoint_Notes. Multiple values are separated by semicolons and a space. You can search for any part of this field (for example, docannotations::word* finds all Word documents with comments or revisions). |
Yes | ||
| docclass | Contains the document classification: Message, Message_Attachment, Message_OLE_Attachment, EDoc (files that are not email, any kind of attachments, or archives, or do not fit into any of the other categories), EDoc_OLE_Attachment, Message_Archive, Archive, Disk_Image (such as EWF), or Directory. Not case-sensitive for the purposes of search, but you must either specify the entire name of the class or use wildcards (since the field does not treat each term individually). | |||
| DocDate | Yes | For export, the date that applies to the given type of document, either the date an email was sent, or the datemodified date of an eDoc (or the lastmodifiedtime date of an eDoc, if datemodified is unavailable). (DocTime reports the time information.) The default format is mm/dd/yyyy. | ||
| docext | Contains the document extension portion of the filename metadata. Not case-sensitive when searched. Contains the file extension in an EDRM load file based on the text that appears after the last dot in the filename. For example, for my.text.html, html is the file extension. | |||
| DocID | Yes | For export, the value representing the assigned document ID. If page-level numbering is enabled, each page of a document has its own, incrementally numbered document ID. Family members (a parent and its children) have sequential document IDs. | ||
| docnum | As used by eDiscovery, a System Metadata field that identifies a three-part number in the format C.V.N, where C =A Data Collection (Data Set) number, unique per Organization, V =A Data Collection Checkpoint Value, unique per Data Collection, and N = A document number, unique within the Data Collection Checkpoint. When searching this field, specify the entire value, since wildcards are not supported for this field. You can also use a range search. | |||
| documentnumber | A Microsoft Office or WordPerfect property identifying the document number. | |||
| DocumentRange | Yes | For export, the range of document IDs (for example, from an email). | ||
| DocTime | Yes | For export, the time that applies to the given type of document, either the time an email was sent, or the time portion of the datemodified value of an eDoc (or the time portion of the lastmodifiedtime value of an eDoc, if datemodified is unavailable). (DocDate reports the date information.) The default format is HH:mm:ss. | ||
| dominantlanguage | A language code for the language detected as the dominant language (the largest occurrence of the languages detected) for the document. RFC 3066 and ISO 639-1 define the Language field information, primary language codes such as en for English. Many codes consist of two letters. Not case-sensitive when searched. To search this field, specify dominantlanguage:<language_code> (for example, dominantlanguage:ja searches for documents for which Japanese is the dominant language). See the topic Supported Languages for Language Detection for a list of languages that can be detected when language detection is enabled. | |||
| dr_loc | This special |
|||
| drcontaineroffset | This special |
|||
| drrelativepath | This special |
|||
| dupe_fingerprint | For email, a value computed according to the Email deduplication Settings, which applies to views of Project Data. For files that are not email, this is always the file MD5 value. Email deduplication Settings are defined as Analytic Settings at the Project level or in an Organization template. The dupe_fingerprint value is available for export by default. Not case-sensitive when searched. | |||
| DupeFingerprintSha1 | Yes | For email, a SHA-1 value computed at export according to the Email deduplication Settings and populated in the appropriate export load file. For files that are not email, this is always the file SHA-1 value. | ||
| Duplicate | Yes | For export, value is M for the master duplicate in a group of duplicates, Y for an identified (regular) duplicate, and N for a non-duplicate document. | ||
| DuplicateCustodian | Yes | For export, a semicolon-delimited list of the Custodians for which this document was a duplicate. This includes the Primary Custodian, if applicable (for example, if the Primary Custodian has multiple duplicates of this document). Note that this field applies to Global (Horizontal) deduplication only (where |
||
| DuplicateCustodianOther | Yes | For export, a semicolon-delimited list of the Custodians for which this document was a duplicate, except the Primary Custodian. Note that this field applies to Global (Horizontal) deduplication only (where |
||
| Duplicate_Source_DocID | Yes | For export, the document ID of a Duplicate source document. | ||
| E_MailClient | Yes | For export, the email Parent Type (for example, MS Outlook). | ||
| editor | For Web archives, a property used by Microsoft Office applications to identify the document editor. | Yes | ||
| edocsubject | Text that describes the document subject | Yes | ||
| edrmdupeid | Aids in the identification of email duplicates across multiple platforms. It follows the EDRM standard, which involves use of the MD5 hash value of an email Message ID metadata field called EDRM Message Identification Hash (MIH). The calculation is based on the first messageid value in the email header. Not case-sensitive when searched. | New in 5.4.3.0 | ||
| emailheader | Includes the entire email header for an email, including custom header fields, if the |
Yes | ||
| embeddedchildren | Boolean indicating whether a document has embedded children (documents, images, and/or web image links). For embedded documents, this field contains the value ole. For embedded images (for example, a GIF) in an image. (By default, embedded images are identified but not extracted.) Note that a given document may have multiple embeddedchildren fields if it supports more than one type (for example, one for ole and one for image). |
|
||
| embeddedlink | Contains an embedded link to a file (for example, a Microsoft OneDrive file) within an MSG |
New in 5.1.0.3 | ||
| embeddedparent | Contains the document handle for the parent of an embedded document that was extracted during import (an embedded document is either an EDoc_OLE_Attachment or Message_OLE_Attachment). A parent of an embedded document can be one of the following: EDoc, Message_Attachment, EDoc_OLE_Attachment, or Message_OLE_Attachment. Also identifies the handle for the parent (scanned image) of a child document from an Image Pro load file. Not case-sensitive when searched. | |||
| EndAttach | Yes | For export, the ending Attachment Document ID (for example, for an email). | ||
| EndDoc | Yes | For export, the ending Document ID. | ||
| entryid | Populated for files extracted directly from PST files as a 24-byte value (48 characters) in which the first 4 bytes are flags and zeroed, the next 16 bytes are the Provider UID for the PST, and the next 4 bytes are the internal identifier for the entry. Case-sensitive for the purposes of search. | |||
| ewfcasenumber | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), the Case Number, if one was specified during use of an EWF generation utility such as FDK Imager. All EWF segment files for a given raw image contain the same ewfcasenumber value. When the primary EWF segment file is processed, this field is propagated to all children (and their children) extracted from the EWF. | Yes | ||
| ewfdateacquired | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), this field reports the date (in Coordinated Universal Time, as yyyy-MM-dd-HH-mm-ss) on which the EWF files were generated by an EWF generation utility such as FDK Imager. | |||
| ewfevidencenumber | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), the Evidence Number, if one was specified during use of an EWF generation utility such as FDK Imager. All EWF segment files for a given raw image contain the same ewfevidencenumber value. When the primary EWF segment file is processed, this field is propagated to all children (and their children) extracted from the EWF. Also populated for Logical Evidence Files (LEF). | Yes | ||
| ewfexaminername | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), the Examiner Name, if one was specified during use of an EWF generation utility such as FDK Imager. All EWF segment files for a given raw image contain the same ewfexaminername information. Also populated for Logical Evidence Files (LEF). | Yes | ||
| ewfmd5 | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), the MD5 Hash Code of the raw image calculated when the EWF files were generated. All EWF segment files for a given raw image contain the same ewfmd5 value. Not case-sensitive when searched. | |||
| ewfmediasize | For EWF (Expert Witness Compression Format) files (for example, Encase or SMART), the size, in bytes, of the EWF raw image. All EWF segment files for a given raw image contain the same ewfmediasize value. Also populated for Logical Evidence Files (LEF). Not case-sensitive when searched. | |||
| Exception | Yes | For export, Boolean indicating whether a document has an exception. | ||
| ExceptionDescCode | Yes | For export, an explanation of the exception (for example, CONNECTOR_FAILURE). | ||
| exceptiontext | Boolean indicating whether |
|||
| ExportDupePriority | Yes | For duplicates at export, reports the priority of the duplicate based on the execution of Survivorship Model queries. When a document matches more than one of the queries, it is assigned the priority of the query it matched first. | ||
| Exported | Yes | Boolean indicating whether a file was expected to be exported. A value of Y does not guarantee that the eligible file was exported successfully, since an unexpected exception such as a Connector failure may prevent the file from actually being exported. | ||
| ExportedVolName | Yes | For export, the Volume name of an exported document (for example, V0001). | ||
| export_view | An Analytic Metadata field that provides information for an Export Stream. Entries for a given export_view show the stream viewname field, and an export view for the stream name followed by a hyphen and then a volume ID, and additional export view fields such as export_view_reason_code and export_view_docid. | |||
| export_view_docid | An Analytic Metadata field that identifies the DocId for a file in an Export Volume of an Export Stream. |
|||
| export_view_dupe_priority | An Analytic Metadata field that identifies the deduplication priority associated with a document subject to export. Populated when Survivorship queries are set with a priority for document deduplication at Export (when the Export Duplicates Processing option Remove Duplicates from Export and Load File is set). Not intended to be searchable in its entirety. | |||
| export_view_enddoc | An Analytic Metadata field that identifies the ending Doc ID of a record exported using page-level numbering. | |||
| export_view_reason_code | An Analytic Metadata field that identifies the reason code associated with the exported file. Not intended to be searchable in its entirety. | |||
| extbegattach | The external starting attachment document with a document number (for example, for an email). For a DAT Load file document parent, this field identifies the parent document. | |||
| extbegdoc | For a Concordance DAT Load File, identifies the appropriate starting document with a document number (the parent number for a parent, or the child number for an attachment). | |||
| extdahandle | Contains the handle of the data area where an externally processed file is located. Not case-sensitive when searched. | |||
| extdarelativepath | Contains the path to an externally processed file in the Document Storage Depot, relative to the path of the export data area. | |||
| extdocattachrange | For a Concordance DAT Load File parent document,identifies the document numbers of the starting and ending attachments, separated by a - (hyphen). This range starts with the parent document and includes all pages of all child documents (for example, all children with multiple pages of images). | |||
| extdocrange | For a Concordance DAT Load File, identifies the document numbers of the starting and ending documents, separated by a - (hyphen). For a parent Image Pro document, this includes all children and any images representing the pages of each multi-page child document. For a parent DAT file document, this is the starting and document for the parent itself, which includes the total number of pages for the parent. For any multi-page child document, this includes any images representing the pages of the child document. | |||
| extendattach | The external ending attachment document with a document number. For a Load File parent document, identifies the last page of the last attachment. | |||
| extenddoc | For a Concordance DAT Load File, identifies the ending document with a document number. For a parent document, this is the parent document itself if it is one page, or a number representing the last page of a multi-page parent document. For a child document, this is either the child document itself (if it is a single page) or the image (or document number) representing the last page of the multi-page child document. | |||
| extendedfilename | Appears after import for each document extracted from a file archive. Contains a nested filename, where the file archive name precedes the document path and filename (using ? as a delimiter). Applies to the contents of a file archive or nested file archives. Available as an export field. To search this field, you can place a portion of the value in quotes, not including any ?, such as the portion appearing after the last ? (for example, for a field value of OfficeFiles.zip?angel/angels-pics.html.1, you can search as follows: extendedfilename:"angel/angels-pics.html.1"). |
Yes | ||
| extendedproperties | For email Contacts and Calendar items, a consolidated list of metadata fields. Upon export, the load file shows the information as a new-line delimited listed of fields. |
Yes | ||
| extnumpages | For a Load File document, identifies the number of pages detected for a multi-page document (for example, the number of pages for an attachment in a Load File Image PDF). | |||
| extprocessed | Identifies a file that is a child of an archive processed externally. | |||
| ExtReprocessed | Yes | For export, a Boolean indicating whether a file has been processed externally and then loaded back into the Project
(that is, whether the extdahandle field is present for the file). External Processing enables you to process OCR Candidates, parent encrypted/protected files, or unsupported format files outside the Project environment and then reload them. |
||
| family_fingerprint | An Analytic Metadata Field that identifies the dupe_fingerprint value of the parent in a Message Attachment Group (MAG) or Document Attachment Group (DAG). | |||
| family_handle | An Analytic Metadata Field that identifies the appropriate handle value of the family, either the maghandle value for a Message Attachment Group (MAG) or the daghandle value for a Document Attachment Group (DAG). | |||
| fileattr | A CIFS-only field with a value representing the CIFS file attributes (for example, system, hidden, read only, and archive attributes). | |||
| filemd5 | This System Metadata field contains the document's file MD5, a hash code that represents both the content and the embedded metadata for the document. Present but not populated with actual file MD5 values in a System Metadata Index (it is all zeros). Not case-sensitive when searched. | |||
| filemode | For NFS only, a System Metadata field with a value for permissions. Not case-sensitive when searched. | |||
| filename | A System Metadata field identifying the name of the document. In general, you can search for any part of this field. For a directory, this is the relative path of the directory. Not case-sensitive when searched. | Yes | ||
| filesha1 | A System Metadata field with a 40-digit value representing the document's calculated SHA-1 value. (SHA-1 is a Secure Hash Algorithm developed by the United States National Security Agency.) Not populated in a System Metadata Index. Not case-sensitive when searched. | |||
| filesha256 | A System Metadata field with a value representing the document's calculated SHA-256 value. (SHA-256 is a Secure Hash Algorithm developed by the United States National Security Agency for cryptographic security.) Not populated in a System Metadata Index. Not case-sensitive when searched. | New in 5.4.3.0 | ||
| filesubtype | In Parsing Library V2 Projects, identifies additional information for the file type, such as the version for Microsoft Excel, PowerPoint, and Word documents. For possible values, see Supported File Types for Analysis. | Yes | New in 5.2.5.x. | |
| filetype | Text representing the proper name for a given document file type |
Yes | ||
| flagcompleted | For items from Microsoft Outlook, the date on which the flagged item was marked by the user as complete. Uses the format yyyy-MM-dd-HH-mm-ss. | |||
| flagdue | For items from Microsoft Outlook, the due date set by the user for the flagged item. Uses the format yyyy-MM-dd-HH-mm-ss. | |||
| flagstarted | For items from Microsoft Outlook, the date on which the flag was applied to an item. Uses the format yyyy-MM-dd-HH-mm-ss. | |||
| forwardto | Identifies the person to whom the email was forwarded. | Yes | ||
| from | Identifies the sender of this email or the first user in an Instant Bloomberg message. For an email sent on behalf of another person, this field value may identify the intended (impersonated) sender and may not match the sender field value (the actual sender). For Microsoft Outlook, this field may contain both a name and address (for example, Jim Brown <jbrown@mynetwork.com>). For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco). | Yes | ||
| from_identifier |
|
Yes | New in 5.4.1.0 | |
| from_name |
|
Yes | New in 5.4.1.0 | |
| fullparticipants | This consolidated field applies to common email types and formats, and contains all information from the following fields: altbcc and bcc, altcc and cc, altfrom and from, altsender and sender, altto and to. If an email address is not complete, this field contains whatever content was discovered. In the Document Viewer, a separate entry appears for each unique email address. A manifest with this field contains a semicolon-delimited list of unique values. To search for a value this field, you can use wildcards. |
Yes | ||
| fullparticipants_identifier | Provides the unique identifiers of all participants who sent or received this message (as extracted from the fullparticipants field). Sample values include phone numbers, email addresses, and usernames. On export, the contents of this field are sorted alphanumerically in ascending order. | Yes | ||
| fullparticipants_name | Provides the names of all participants who sent or received this message (as extracted from the fullparticipants field). On export, the contents of this field are sorted alphanumerically in ascending order. | Yes | ||
| fullpath | Contains the full path to the file. Not visible in the user interface; however, it is captured in the manifest at export. | |||
| greeting | For Bloomberg messages, identifies the Bloomberg greeting information (email signature). | Yes | ||
| group | A status property used by Microsoft Office applications. | Yes | ||
| group_view | An Analytic Metadata field that identifies a manually created Folder that you populate with files). Appears in the metadata display for a document in a Folder and is searchable, but it does not appear in a manifest. | |||
| handle | A System Metadata field representing the document handle. Not case-sensitive when searched. Every document in an imported set/collection of documents is assigned a unique document handle, used to identify the document. The 64-character handle is composed of two parts: the 32-character file MD5 (the value of the filemd5 field), which is used by the system for a variety of internal processing operations, followed by a randomly-generated 32-character value, which guarantees that every handle is unique despite the possibility that two files can have the same MD5. | |||
| HasMSReviewInfo | Boolean indicating whether the MS Review Information is present in one or more of these fields: msreviewcycle, msreviewemailsubject, msreviewauthoraddr, msreviewauthorname, and msreviewprevcycle. | |||
| hastransportheader | For MSGs, Boolean indicating whether a valid Message Transport Header is present for a document. If the value is N, the Transport Header for the MSG is either not present (in which case, the emailheader field, when enabled, would not be populated) or is invalid (in which case, the emailheader field, when enabled, might be populated with some information). | |||
| hiddendata | Indicates detected hidden data (Excel_Hidden_Columns, Excel_Hidden_Rows, Excel_Hidden_Worksheets, Excel_VeryHidden_Worksheets, PowerPoint_Hidden_Slides, or Word_Hidden_Text). Multiple values are separated by semicolons and a space. You can search for any part of the field content (for example, hiddendata::excel* finds all Excel documents with hidden content). |
Yes | ||
| hiddenslidecount | A status property used by Microsoft Office applications to identify the number of hidden slides in the document. | |||
| image_exception | This Analytic Metadata field contains true for a document in Project Data that is considered an Image Exception because it matches the configured Image Exception queries (default queries find different types of hidden content, document annotations, and track changes flags). Such documents may warrant special handling before any production versions are generated. | |||
| importance | Indicates the importance (High, Medium, Low) of an email (or Calendar item, Task, or Journal entry). Not case-sensitive when searched. | |||
| ImportArea | Yes | For export, a value (GUID) representing the Connector import data area. | ||
| ImportDevice | Yes | For export, a URL indicating the Connector type and import mount location. | ||
| importpath | A System Metadata field identifying the import location label and/or the method of import and archive information, if applicable. To search this field, start a standard syntax search with importpath::*\: (to represent the Data Area) followed by the relative path information, either the entire relative path or a portion of it, depending on what you want to find. Remember to use the \ character to escape any colons (:) and spaces in the relative path, and use wildcards as needed. For example, to search for the file <DataArea>:johnb/Endpoint1/104/Task 1/doc24.txt, type importpath::*\:johnb/Endpoint1/104/Task\ 1/doc24.txt. You could also type importpath::*\:johnb/Endpoint1* to search for all files at Endpoint1. | |||
| ImportPathInfo | Yes | An export-only field that provides the import path information without the handle. | ||
| ImportURL | Yes | For export, combines the import mount location and import path (importpath metadata field) as a source URI. If the file is extracted from an archive, it is identified as such. | ||
| inode | For NFS only, a System Metadata field (untokenized) with the inode identifier of the file. | |||
| inreplyto | For email, the MessageID of the message to which this message was a reply. | Yes | ||
| isattach | Boolean indicating whether an item is an attachment. Not case-sensitive when searched. | New in 5.4.1.0 | ||
| journalemailhandle | For Microsoft Exchange journaled emails, contains the handle value of the journal wrapper email for all members in the original email family of one of these wrappers. Not case-sensitive when searched. | |||
| journalemailparent | For Microsoft Exchange journaled emails, the top-level emails extracted from the wrapper populates this field with the original parent handle value when the Split Journaled Emails option is enabled. Not case-sensitive when searched. | |||
| journalemailtype | For Microsoft Exchange journaled emails, this field always identifies the type of parent journaled email |
|||
| keywords | A property used by Microsoft Office applications to provide a list of keywords, typically separated by commas. | Yes | ||
| KFT | Yes | For export, Boolean indicating whether the MD5 hash code matches an MD5 hash code for a file type in the National Software Reference Library (NSRL), a database provided by the National Institute of Standards and Technology (NIST). NIST files are often system-related files that provide no value for a Project. | ||
| kftdesc | Identifies the source of a known file type in the reference library (NSRL) from NIST. (A file may have multiple sources, but only one is captured here.) Not case-sensitive when searched. | |||
| language | Identifies one or more languages detected in a document. RFC 3066 and ISO 639-1 define the primary language codes (many with two letters), such as en for English. Not case-sensitive when searched. To perform a search of this field, specify language:<language_code> (for example, language:zh* searches for documents with traditional or simplified Chinese). For a list of languages that can be detected when language detection is enabled, along with their codes, see Supported Languages for Language Detection. | |||
| lastaccesstime | For NFS/CIFS only, a System Metadata field providing the last time the file or Short Message Format (SMF) item was read or accessed (yyyy-MM-dd-HH-mm-ss). | |||
| lastchangetime | For NFS only, a System Metadata field providing the last time the inode information (e.g., owner or group) changed for this file (yyyy-MM-dd-HH-mm-ss). | |||
| lastmodifiedtime | For NFS/CIFS, a System Metadata field providing the last time the file or Short Message Format (SMF) item was modified (yyyy-MM-dd-HH-mm-ss). | |||
| linecount | Contains the number of lines in the document. | |||
| linksdirty | A Boolean status property used by Microsoft Office applications to identify custom links that are dirty. Not case-sensitive when searched | |||
| loadfiledocsource |
|
Yes | ||
| location | Reports the meeting/appointment location in an email Calendar item. |
Yes | ||
| maghandle | Provides the document handle of the parent email message to which a file is attached. You can search using the maghandle to quickly find all documents in a Message Attachment Group (MAG), such as maghandle::1111. An embedded document parent that is part of a MAG inherits the maghandle. Otherwise, the embedded document parent and its children are part of a DAG and inherit the daghandle instead. A document has either a maghandle or daghandle, but not both. Not case-sensitive when searched. | |||
| mailcategories | Provides a semicolon-delimited list of named categories in an Outlook item. | Yes | ||
| mailcontainer | Provides the document handle of the top-level mail container serving as the originating mailstore for a file, such as a PST, NSF, or MBOX. Not case-sensitive when searched. | |||
| mailcontainererror | Provides the error message returned by an attempt to access a mail container that has local access protection (is encrypted/protected), generates an error for another reason, or is an empty archive. | |||
| mailflags | Provides a single flag or a semicolon-delimited list of flags set on an MSG emails. When this field contains multiple flags, you can search using a wildcard or by placing the set of flags within quotes. Not case-sensitive when searched. | |||
| mailfolder | For import and export, identifies the appropriate folder (for example, Inbox) in the mailstore for a container file such as a PST. For an email in a PST, this could be Top of Personal Folders, which represents the top mailbox folder name. Although the field information may appear after import as a Linux-compatible path, it is always exported as a Windows-compatible path (that is, any / folder separators in the path are changed to \). Not case-sensitive when searched. Does not support phrase search with wildcards. When searching this field, be sure to use the \ character to escape any colons (:) or spaces in the path. If you search for a Windows-compatible path, remember to escape the \ character (for example, use \\). | Uses path tokenization rules (for word breaks on \ or /) |
||
| mailfolderpath | For import and export, provides the relative path to the mail NSF/PST container and the mail folder name. Populated for any file with a document class of Message as well as its children. Uses the format <rel_path>:<mail_folder> for messages (other than loose messages and messages from email archives that do not have folders, such as Bloomberg archives). For loose messages and messages from email archives that do not have folders, such as Bloomberg archives, mailfolderpath does not include the GUID/colon. Loose files also do not include the separator/container filename. The field information may appear after import as a Linux-compatible path, but is always exported as a Windows-compatible path (any / folder separators in the path are changed to \). Not case-sensitive for the purposes of search and does not support phrase search with wildcards. When searching this field, use the \ character to escape any colons (:) or spaces in the path (for example, mailfolderpath::nsf/MG_PWC_Internet.nsf\:Inbox). To search for a Windows-compatible path, escape the \ character (e.g., use \\). | Uses path tokenization rules (for word breaks on \ or /) |
||
| mailpriority | An email priority for both MSGs and EMLs, such as High, Normal, or Low. Not case-sensitive when searched. | Yes | ||
| mailstop | A status property used by Microsoft Office applications to identify a mail stop location. Not case-sensitive when searched. | |||
| MailStore | Yes | For export, the name of the mail store (email container) as it appears on disk. | ||
| manager | A property used by Microsoft Office applications to identify the manager of the document. | Yes | ||
| markuphistory | Applies to Microsoft Office documents and PDFs. |
Yes | ||
| Matter | Yes | For export, the Project/Matter identifier, as derived from the Matter Number in the Project Index Settings (if set). | ||
| mboxfromline | For an email extracted from an MBox, the From line information from the MBox header. Tokenized, supports wildcard searching. | Yes | ||
| mediacreationtime | For an identified audio, video, or image file, the appropriate creation time, yyyy-MM-dd-HH-mm-ss. | |||
| mediaencoder | For an identified audio, video, or image file, the media encoder used. | |||
| mediaformat | For an identified audio, video, or image file, identifies the media format used. | |||
| mediaid | An ID for the media (for example, PST), derived from the eDiscovery Project Index settings that specify the directory hierarchy position relative to the importpath metadata field. Not case-sensitive when searched. | |||
| mediaid_view | An Analytic Metadata field identifying the mediaid view to which the document is assigned, or Unassigned if the document is not assigned to a mediaid value. The value matches the mediaid field value unless you have changed the assignment after adding the document to Project Data. If you include this field in the Export Fields used for Export, the load file identifies the document's mediaid view at the time the Export load file was produced. | New in 5.4.0.0 | ||
| messageid | For email, a unique ID (alphanumeric value) that identifies an email message. You can use the message ID as part of an email deduplication strategy (set using the Project Analytic Settings or Organization Analytic Settings template). May also identify a Bloomberg-specific message identifier for a Bloomberg message. Case-sensitive for the purposes of search. | |||
| mimeversion | The MIME version for the document. Not case-sensitive when searched. | |||
| mmclipcount | For a Microsoft Office document, a value representing the number of multimedia clips in the document. | |||
| modernattachmentlinks | For parent emails of Modern Attachments, this field provides links to the attachments stored in Microsoft OneDrive and SharePoint |
New in 5.4.2.2 | ||
| modifiedby | Text identifying an author who last modified the document. | Yes | ||
| msgclass | For the file types of email, MS Outlook |
|||
| msgsource | Provides the appropriate source classification for an email: Lotus_Notes (for emails and other items extracted from Lotus Notes NSF files), Outlook (for emails and other items extracted from Microsoft PST/OST files), Bloomberg (for Bloomberg messages extracted from Bloomberg Message Dump XML files), Bloomberg_IB (for Instant Bloomberg messages), MBox (for emails extracted from RFC 822 Mailboxes), Exchange (for email and other items from an Exchange Server), msg (for loose MSGs), and eml (for loose EMLs). |
|||
| msoutlookmessageclass | Contains the appropriate Microsoft Outlook MAPI message class. Most sent and received messages are part of the interpersonal message (IPM) message class and have an IPM subclass with an IPM identifier, such as IPM.Note for a note message, IPM.Contact for a contact message, and IPM.Schedule.Meeting.Request for a message schedule meeting request. You may also see Report items, such as REPORT.IPM.NOTE.DR for a normal delivery report or REPORT.IPM.NOTE.NDR for a nondelivery report. |
|||
| msoutlooktextsources |
|
New in 5.2.5.x | ||
| msreviewauthoraddr | A Document property providing the email address from which this Microsoft Office document was sent as an Outlook attachment. The information in this field is derived from the Microsoft _AuthorEmail field. Supports up to 256 characters, including the terminating NULL character. | Yes | ||
| msreviewauthorname | A Document property providing the display name of the email address from which this Microsoft Office document was sent as an Outlook attachment. The information in this field is derived from the Microsoft _AuthorEmail field. Supports up to 256 characters, including the terminating NULL character. | Yes | ||
| msreviewcycle | A Document property providing the unique identifier of a Microsoft Office document sent for review as an Outlook email attachment. The information in Derived from the Microsoft AdHocReviewCycleID field. | |||
| msreviewemailsubject | A Document property providing the subject of the email from which this Microsoft Office document was sent as an Outlook attachment. The information in this field is derived from the Microsoft _EmailSubject field. Supports up to 256 characters, including the terminating NULL character. | Yes | ||
| msreviewprevcycle | A Document property providing the original review cycle identifier of a Microsoft Office document previously sent and then resent for review as an Outlook email attachment. The information in Derived from the Microsoft_PreviousAdHocReviewCycleID field. | |||
| NativeLink | Yes | For export, the path to the renamed Native file. By default, this field uses a prefix of DR\. The path is Windows-compatible (using \ to separate folders). The format of this field is configurable in the Export dialog, so it may contain the full path of the Volume directory, including a base path, Volume label and Volume #, document ID prefix, and starting ID (using the appropriate Pad size), and then the file extension. | ||
| NativeLinkBytes | Yes | For export, the size (in bytes) of the file produced by the export (that is, the size of the Native (or HTML-formatted email) file whose path is identified in the NativeLink field). | ||
| NativeLinkExt | Yes | For export, the file extension of the Native (or HTML-formatted email) file whose path is identified in the NativeLink field. | ||
| NearDupe | Yes | For export, whether this document is a Near Duplicate of another document, Y or N. Can also contain ASSOC if the document is part of a Message Attachment Group (MAG), part of which is a near dupe of another document. | ||
| NearDupePivotDocID | Yes | For export, the document ID of a Near Duplicate source document. Populated for any Near Duplicate of the source document as well as the source document itself. | ||
| NearDupePivotSimilarity | Yes | For export, the calculated Near Duplicate Similarity value (the calculated similarity of the document to the pivot document (for example, 1). | ||
| NearDupePivotSource | Yes | For export, boolean indicating whether this document is a Near Duplicate source document. | ||
| notescount | Contains the number of notes in the document. | |||
| nsfform | For items extracted from Lotus Notes NSF files, identifies the appropriate Form field type. For emails, the form can be Document, Response, Memo, Reply, NonDelivery Report, Return Receipt, Delivery Report, Reply with History, ArchiveStub, or Phone Message. For Calendar items, the form can be Appointment, Notice, or (ReplyNotice). Other types include Task, JournalEntry, and Person (which is a vCard contact). If the Form field type is not present, it is listed as Unavailable. Unsupported or unknown form types generate the appropriate parsingstatus, either Unsupported Lotus Note (error code 00043) or Unknown Lotus Note (error code 00044). | Yes | ||
| nsftemplate | For Lotus Notes NSF files, identifies the name of the template used when creating the NSF file or Unavailable if the template information does not exist. Helps characterize NSF data. | Yes | ||
| nsfunavailableformdetails | For Lotus Notes NSF files for which the Lotus Notes Form type is not present, identifies the additional information derived by |
Yes | ||
| NumAttach | Yes | For export, the number of attachments to the parent email or other item. | ||
| numemailparticipants | For email, a |
|||
| numemailrecipients | For email, a |
|||
| ocraverageconfidencelevel | A value in the range 0-100 indicating the average OCR Confidence level calculated for a document subject to OCR processing. A value of 0 is the lowest confidence level and a value of 100 is the highest confidence level. this field uses a padded 5-digit value (for example, 00010 is Confidence level 10) to support range searching. For example, to search for documents whose average OCR Confidence level is in the inclusive range 20-60, you would specify ocraverageconfidencelevel::[00020~~00060]. |
|||
| ocrlowestconfidencelevel | A value in the range 0-100 indicating the lowest OCR Confidence level calculated for any page in a document. Uses a padded 5-digit value (for example, 00010 is Confidence level 10) to support range searching. For example, to search for documents whose lowest OCR Confidence level is in the inclusive range 0-10, you would specify ocrlowestconfidencelevel::[00000~~00010]. |
|||
| ocrpath | Provides the external OCR path, which includes the Data Area information and the document handle for a given OCR-processed file. Not available for Export. | |||
| ocrstatus | Text and value indicating the status of an OCR operation, either OCR (to indicate success), EXTOCR (for external OCR processing from a load file),or an exception (OCRFAIL, OCRTIMEOUT, CONVERTFAIL, NOTXT, or UNINITIALIZED). A metadata search of a value and/or text in this field is not case-sensitive. A document with a status of EXTOCR is not subject to OCR processing again during indexing. : OCR | Yes | ||
| ocrsuspectwords | Contains the number of words the OCR software flags as potentially suspect (that is, they might not be valid words) after OCR processing. | |||
| ocrtotalpages | Contains the total number of pages after OCR processing. | |||
| ocrvalidpages | Contains the number of pages considered valid pages after OCR processing. | |||
| ocrwords | Contains the number of extracted words after OCR processing. | |||
| office | A status property used by Microsoft Office applications. Not case-sensitive when searched. | |||
| OLEChildID | Yes | For export, the document ID of each child embedded document of a given parent, separated by semicolons. | ||
| OLEParentID | Yes | For export, the document ID of the parent document for a given child embedded document. | ||
| OrderByDate | Yes | For export, the email Message Attachment Group Order (MAGORDER) value. | ||
| origdocext | For import and export, this field is populated when the file's doc extension does not match its file type (e.g., for a doc.zip, which should have been an exe, this field contains exe to indicate what the extension should have been, and docext contains zip, which indicates the way it was seen on disk). Not case-sensitive when searched. | |||
| origparsingstatus | For import as well as export, this field is populated for a file that has been reprocessed or externally processed, to report the original parsing status after import. Also populated after OCR processing. (Note that for export, only the parsing status text, not the code, is provided.) | Yes | ||
| osfolder | For import and export, a System Metadata field with the OS path to the document (if not part of a container). It is essentially the import path minus the folders used for custodian and mediaid. Although the field information may appear after import as a Linux-compatible path, it is always exported as a Windows-compatible path (that is, any / folder separators in the path are changed to \). Not case-sensitive when searched. Does not support phrase search with wildcards. When searching this field, be sure to use the \ character to escape any colons (:) or spaces in the path. | Uses path tokenization rules (for word breaks on \ or /) |
||
| owner | Tex t identifying the owner of the document. | Yes | ||
| ownergroup |
|
|||
| owneruser |
|
|||
| pagecount | Contains the number of pages in a document. Can be populated for Microsoft Office documents and PDFs. | |||
| PageCount | Yes | If page-level numbering is selected for an Export Stream, this field reports the number of pages produced for each document in the export. | ||
| paragraphcount | Provides the document paragraph count. | |||
| parent | A value representing an email parent. Not case-sensitive when searched. | |||
| ParentContainer | Yes | For export, the document ID of the parent container, or blank if NA. | ||
| ParentContainerType | Yes | For export, the device type indicating the email archive (for example, application/msoutlook). | ||
| ParentID | Yes | For export, the document ID of each parent. | ||
| parseduration | Contains the amount of time (in milliseconds) it took to parse the document. This can aid in troubleshooting. You can search this field using a regular field search with a value, or using a range search. The value reported is in milliseconds (ms). | New in 4.3.11.0 | ||
| parserversion | Contains the release number. | |||
| parsingstatus | The parsing status assigned to each document during import or reprocessing, indicating whether the system's attempt to parse the document succeeded, failed, or completed with warnings, and the nature of the failure or warning if applicable. Each status includes a codes and a text term; examples include 00000 SUCCESS, 00017 FILE_ZERO_LENGTH (failed), and 00005 NODATA (succeeded with warning). For the full list, see the Parsing Status Warnings and Errors table in View Imports Reports. On reprocessing, each document's current parsingstatus value is stored in the origparsingstatus field. Not case-sensitive when searched. | Yes | ||
| participantdomains | For email, text identifying the domain portion of any email participant (for example, company.com). For Lotus Notes, this field includes all unique sending or receiving domains identified in the from, altfrom, bcc, altbcc, cc , altcc, |
Yes | ||
| participants | This consolidated field applies to common email types. For Microsoft Outlook, it contains a list of SMTP style email addresses representing each email participant, separated by a semicolon. For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco). If an email address is not complete, this field contains whatever content was discovered. The terms in the participants field therefore typically represent a subset of the to, from, bcc, cc, and sender fields. Supports wildcards for searching. |
Yes | ||
| password | For a document subject to password cracking as part of reprocessing, or a BitLocker-encrypted disk partition subject to password cracking or processing/reprocessing using a Container Key file, this field contains either the password used to open, parse, and render the document, or the 48-digit key or password used to decrypt and process the partition (the password or key discovered first is the one that appears in the password field). Multiple BitLocker-encrypted partitions yield multiple password field entries, where each entry reports the password or key used. The password field entries appear for a parent EWF, Virtual Hard Drive (VHD), or file representing a decrypted partition (for example, from an LEF with a BitLocker-encrypted partition). For users with Organization Administrator permissions only, the password appears in the Metadata portion of the Document Viewer |
|||
| pattern | Applies to a document with Pattern matches to enabled Project Patterns, as long as the document is part of a new Data Set import, an update of Patterns, or subject to reprocessing. In the Document Viewer, a pattern field entry appears for each enabled Pattern (for example, one for Pattern unc, one for Pattern uri, and one for Pattern email). In a manifest, this field contains a semicolon-delimited list of Pattern names for the matching, enabled Patterns (once per enabled Pattern). To search this field, use the format pattern::<patternname> and type the Pattern name in either lowercase or uppercase format, since |
New in 4.3.11.0 | ||
| patternvalue | Applies to a document with Pattern
matches to Project Patterns that are both enabled and have values
stored, as long as the document is part of a new Data Set import, an update of Patterns, or subject to reprocessing. In the Document Viewer, a patternvalue field entry appears for each value stored (for example, one for an email address, one for a UNC path, and one for a given URL). In a manifest, this field contains a semicolon-delimited list of unique, matching values. To search for a value this field, use a literal search in which you place the full value within single quotes. |
New in 4.3.11.0 | ||
| PDFLink | Yes | The path to a PDF converted file, if the option was selected on export. Uses a prefix of DR\. The path is Windows-compatible (using \ to separate folders), and the PDF converted file always ends in .pdf (e.g., DR\00001\ DOC00000001.pdf). The format of this field is configurable in the Export dialog, so it may contain the full path of the Volume directory, including a base path, Volume label and Volume #, document ID prefix, and starting ID (using the appropriate Pad size), and then the file extension. | ||
| PDFLinkBytes | Yes | For export with PDF versions requested, the size (in bytes) of the PDF produced by the export (that is, the size of the file whose path is identified in the PDFLink field). | ||
| processedstatus | Reports the status of a reprocessed file that was loaded back to the system from an external location (export data area). Possible values are UPDATED_ORIGINAL, EXT_REPROCESSED, or EXT_ORIGINAL. If the load operation includes the Update Native option, UPDATED_ORIGINAL indicates that the original native file at the export data area was updated when the file was loaded back to the system. If the load operation does not include the Update Native option, EXT_ REPROCESSED indicates that the native file was externally reprocessed at the export data area (but the original native was not updated when loaded back to the system). EXT_ORIGINAL is reported for children of reprocessed native files. | Yes | ||
| ProducedCustodian | Yes | For export, a semicolon-delimited list of the Custodians for which this document was produced. | ||
| project | A status property used by Microsoft Office applications to identify the project associated with the document. Not case-sensitive when searched. | |||
| ProjectMatterName | Yes | For export, the Project or Matter Name derived from the Matter Name (in the Project Index Settings). If a Matter Name is not set, the Project Name is used. | ||
| pstheader | (Legacy field) | |||
| publisher | Identifies the entity responsible for making the document available (a person, an Organization, or an application such as Acrobat Distiller 8.0.0). | Yes | ||
| rcvddomains | For all email, identifies the domain part of an email (received). For Lotus Notes, this field also includes unique received domains in the altbcc, altcc, and altto fields as well as the bcc, cc, and to fields. Multiple domains are separated by a semicolon. | Yes | ||
| readreceiptrequested | Boolean indicating whether an MSG or EML email requested a receipt on being read. | |||
| received | Provides the received date of the email (YYYY-MM-DD-HH-mm-ss). | |||
| receivedexists | Boolean indicating whether an email had its own received value. If so, this field's value is Y, if not it is not populated. | |||
| receivedoffset | Provides the offset from UTC for an email's received time using the format sHHmm, where: s is a + or - sign indicating whether time of day is ahead of (east of) or behind (west of) Coordinated Universal Time. (UTC). Not affected by the time zone selected for the Project or for Export. | |||
| receivedzone | An acronym (for example, EST or EDT) representing an email’s received time zone in Coordinated Universal Time (UTC) when this information is available. Not case-sensitive when searched. Not affected by the time zone selected for the Project or for Export. | |||
| receiveheader | Provides the email receive header information. | |||
| recipient | Identifies an email recipient. Currently applies to Short Message Format (SMF) data. |
Yes | ||
| recipient_identifier | Provides the unique identifier of a message recipient. Currently applies to Short Message Format (SMF) data. Sample values include phone numbers, email addresses, and usernames. |
Yes | New in 5.4.1.0 | |
| recipient_name | Provides the name of a message recipient. Currently applies to Short Message Format (SMF) data. |
Yes | New in 5.4.1.0 | |
| recipientsmd5 | A value representing the MD5 for the recipients of an email. This field is stored but not searchable. | |||
| recordedby | Identifies the entity or program responsible for recording the file (for example, video data). Not case-sensitive when searched. | |||
| recordeddate | Provides the document’s recorded date, yyyy-MM-dd-HH-mm-ss. | |||
| reference | A status property used by Microsoft Office applications to identify a document reference. Not case-sensitive when searched. | |||
| references | Provides a list of references for an email. Not case-sensitive when searched. | |||
| Responsive | Yes | Indicates why the document is part of the export, either SEARCH (tagged documents and MAGS), ND_ASSOC (documents near-duped), ND_ASSOC_MAG (MAG part of which is near-duped), or TR_ASSOC (thread associated to a tagged MAG). | ||
| returnpath | For RFC-822, identifies a path (for example, address) back to the originator of the message. Not case-sensitive when searched. | |||
| reviewfolder | For import and export, a metadata field with path information in a format that facilitates folder creation in a downstream review tool (for example, Relativity). All members of an email family (MAG) or all members of an email mailbox have the same reviewfolder information. Although the field information appears after import as a Linux-compatible path, it is always exported as a Windows-compatible path (that is, any / folder separators in the path are changed to \). Not case-sensitive when searched. Does not support phrase search with wildcards. For example, reviewfolder::"*jjones*" is not valid, but reviewfolder::*jjones* is valid. In general, use this search without quotes for any single part of a path with or without wildcards, or for any consecutive parts of a path without wildcards (for example, reviewfolder::jjones/email is valid). If you need to use wildcards to find more parts of a given path, you can use importpath instead to search across the directories in the path. | Uses path tokenization rules (for word breaks on \ or /) |
||
| revision | A status property used by Microsoft Office applications to identify the document revision number (for example, 2). Not case-sensitive when searched. | |||
| scale | A status property used by Microsoft Office applications (for example, for images), identifies yes or no. Not case-sensitive when searched. | |||
| sdcontrol |
|
|||
| SearchID | Yes | For export, one or more IDs (separated by a semicolon). Each ID represents an individual Tag applied (for example, to a Work Basket Search task). The <volume>-TagReasonCodes.csv contains an entry for each Search ID. Each entry identifies the User who performed the operation, the Date and time of the operation, the associated Work Basket Description, and Comments applied during the Tagging operation. | ||
| searchterms | Yes | For a document that is part of an Export set up to Generate Search Reports based on a list of submitted search queries, this field provides a semicolon-separated list of the matching search terms/queries. | ||
| sender | Identifies the sender of this email (the actual sender, not an impersonated sender). For Microsoft Outlook, this field may contain both a name and address (for example, Jim Brown <jbrown@mynetwork.com>). For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco) | Yes | ||
| sender_identifier |
|
Yes | ||
| sender_name |
|
Yes | ||
| sensitivity | For email Calendar items, Tasks, or Journal entries, identifies the sensitivity of the item. For example, for Outlook, this could be Normal, Personal, Private, or Confidential. | Yes | ||
| sent | Provides the sent date of the email or Short Message Format (SMF) item, yyyy-MM-dd-HH-mm-ss. | |||
| sentdomains | For all email, identifies the domain part of the sent email. For Lotus Notes, this field also includes all unique received domains in the altfrom or altsender field as well as the from or sender field. Multiple domains are separated by semicolon. | Yes | ||
| sentexists | Boolean indicating whether an email had its own sent value. If so, this field's value is Y; if not, it is not populated. | |||
| sentoffset | Provides the offset from UTC for an email's sent time using the format sHHmm, where: s is a + or - sign indicating whether time of day is ahead of (east of) or behind (west of) Coordinated Universal Time, HH identifies the offset hours, and mm identifies the offset minutes. This is commonly known as the UTC (+ or - UTC, for example, -0400). Not affected by the time zone selected for the Project or for Export. | |||
| sentzone | When available, an acronym (for example, EST or EDT) representing an email’s sent time zone in Coordinated Universal Time(UTC). Not affected by the time zone selected for the Project or for Export. Not case-sensitive when searched. | |||
| size | A System Metadata field (untokenized) that provides the size of the document. The default unit of measure is Bytes. | |||
| slidecount | Contains the count of slides in a Microsoft PowerPoint document. | |||
| source | A reference to a resource from which this document resource is derived, or an application, such as Microsoft Excel. Not case-sensitive when searched. | |||
| status | A status property that identifies information about the document status, if applicable. Not case-sensitive when searched. | |||
| stored_image | Indicates whether a document has stored images available for use during Export/Production. Populated once images have either been generated for Export (Internal) or imported as baseline images as part of an External Image Import or Load File Import (External). It contains one of the following values: Internal (generated internally), Internal - <timezone> (for a document affected by the Export time zone selected for Export, such as emails or Calendar items), External (imported images from an External Image Import or Load File Import), or Error (for a document that failed conversion, for example, if |
|||
| subject | Text that describes the email subject. (For a document subject, see the edocsubject field instead.) For Instant Bloomberg Messages, the subject identifies the chat Room ID, which includes whether the Room Type is PCHAT (Persistent CHAT in which the chat room stays open even when the last person leaves) or CHAT (normal CHAT in which the chat room closes after the last person leaves). | Yes | ||
| TagID | Yes | For export, one or more tags that were applied to the document separated by semicolons. | ||
| tag_view | An Analytic Metadata field for the name of the Tag view. | |||
| TextLink | Yes | Within the export hierarchy, the path to a produced text file. By default, this field uses a prefix of DR\. The path is Windows-compatible (using \ to separate folders), and the text file always ends in .txt (e.g., DR\00001\ DOC00000001.txt). The format of this field is configurable in the Export dialog, so it may contain the full path of the Volume directory, including a base path, Volume label and Volume #, document ID prefix, and starting ID (using the appropriate Pad size), and then the file extension. | ||
| TextLinkBytes | Yes | For export with Text versions requested, the size (in bytes) of the Text file version produced by the export (that is, the size of the file whose path is identified in the TextLink field). | ||
| thread_handle | An Analytic Metadata field for the handle of the Email Thread. | |||
| thread_inclusive | A value of Y indicates that an email has unique content within an email thread, making it worthy of review, N that it does not. The Analytic Index Settings determine whether the evaluation of "inclusive" is limited to email messages only or both email messages and their attachments. Often, an Inclusive email has the most complete snapshot of thread content. The field is blank for non-email or email that is not part of a thread. A value of Unknown indicates that you must rethread existing email before you can see this field populated (because threads from earlier builds are not upgraded automatically). | |||
| threadgroupid | Contains the DocId portion of the ThreadID field. The purpose of threadgroupid is to group all members of the thread in a given Export Volume. Note that the ThreadGroup fields are not populated for any attachments that are part of the Thread Group unless the ThreadGroup includes Attachments option is set in the Export dialog. | |||
| ThreadGroupID | Yes | For export to Relativity, |
||
| ThreadGroupIndent | Yes | For export to Relativity, this field can be sorted to organize the emails in a thread by date and thread response hierarchy. Can be used with the Relativity Thread GroupIndent to create an Indented List Relativity View. | ||
| ThreadGroupSort | Yes | For export to Relativity, this numeric field indicates an email’s depth in a thread response hierarchy. Can be used to control the indent level of an Indented List Relativity View sorted by ThreadGroupSort. | ||
| ThreadID | Yes | For export, the document ID followed by a period and numeric sequence representing an email in a thread. | ||
| ThreadIDOrphanRef | Yes | For export, the list of document IDs for Orphan threads separated by a semicolon. | ||
| ThreadIDParent | Yes | For export, identifies the status of an email in a thread, either Y (for parent), N, Child, or Orphan. | ||
| ThreadIDParentRef | Yes | For export, the document ID for the parent of an email thread. | ||
| ThreadInclusive | Yes | For export, |
||
| threadindex | For email, represents the threadindex extracted from the imported email. Not case-sensitive when searched. | |||
| threadtopic | For email, a value indicating the thread topic ID. | Yes | ||
| TimeAccessed | Yes | Deprecated. For export, the time portion of the embedded metadata field dateaccessed, reporting when the document was accessed. The default format is HH:mm:ss. | ||
| TimeBackedUp | Yes | For export, the time portion of the embedded metadata field datebackedup, reporting when the document was backed up. The default format is HH:mm:ss. | ||
| TimeCompleted | Yes | For export, the time portion of the embedded metadata field datecompleted, reporting when the document was completed. The default format is HH:mm:ss. | ||
| TimeCreated | Yes | For export, the time portion of the embedded metadata field datecreated (or the field createdtime, if no datecreated value is available), reporting when the document was created. The default format is HH:mm:ss. | ||
| TimeCreateSystem | Yes | For export, the time portion of the System Metadata field createdtime (for CIFS), reporting when the file was created. The default format is HH:mm:ss. | ||
| TimeDue | Yes | For export, the time portion of the embedded metadata field datedue, reporting when the document was due. The default format is HH:mm:ss. | ||
| TimeEdited | Yes | For export, the time portion of the embedded metadata field dateedited, reporting when the document was edited. The default format is HH:mm:ss. | ||
| TimeEnded | Yes | For export, the time portion of the embedded metadata field dateended, reporting when an email Calendar item or Bloomberg CHAT ended. The default format is HH:mm:ss. | ||
| TimeEWFAcquired | Yes | For export, the time portion of the embedded metadata field ewfdateacquired, reporting the EWF acquisition time. The default format is HH:mm:ss. | ||
| TimeFlagCompleted | Yes | For export of Microsoft Outlook items, the time portion of the field flagcompleted, reporting when the flagged item was marked by the user as complete. The default format is HH:mm:ss. | ||
| TimeFlagDue | Yes | For export of Microsoft Outlook items, the time portion of the field flagdue, reporting when the due date was set by the user for the flagged item. The default format is HH:mm:ss. | ||
| TimeFlagStarted | Yes | For export of Microsoft Outlook items, the time portion of the field flagstarted, reporting when the flag was applied to an item. The default format is HH:mm:ss. | ||
| TimeLastAccessed | Yes | For export, the time portion of the NFS/CIFS System metadata field lastaccesstime, reporting when the document was last accessed. The default format is HH:mm:ss. | ||
| TimeLastChanged | Yes | For export, the time portion of the NFS/CIFS System metadata field lastchangetime, reporting when the document was last changed. The default format is HH:mm:ss. | ||
| TimeLastMod | Yes | For export, the time portion of the embedded metadata field datemodified (or the field lastmodifiedtime, if no datemodified value is available). Reports when the document was last modified. The default format is HH:mm:ss. | ||
| TimeLastModSystem | Yes | For export, the time portion of the NFS/CIFS System Metadata field lastmodifiedtime, reporting the last time the file was modified. The default format is HH:mm:ss. | ||
| TimeLastPrinted | Yes | For export, the time portion of the embedded metadata field dateprinted, reporting when the document was last printed. The default format is HH:mm:ss. | ||
| TimeMediaCreated | Yes | For export, the time portion of the embedded metadata field mediacreationtime, reporting the media creation time. The default format is HH:mm:ss. | ||
| TimePrimary | Yes | For export, the time portion of the dateprimary field information. The default format is HH:mm:ss. | ||
| TimeProcessed | Yes | For export, the time portion derived from the datescanned field, reporting when the documented was last processed. The default format is HH:mm:ss. The export-only field DateProcessed contains the date portion. | ||
| TimeReceived | Yes | For export, for documents that have a receivedexists value, the time portion of the received field, reporting when an email was received. T he default format is HH:mm:ss. | ||
| TimeRecorded | Yes | For export, the time portion of the recordeddate field, reporting when the document was recorded. The default format is HH:mm:ss. | ||
| TimeSent | Yes | For export, for documents that have a sentexists value, the time portion of the sent field, reporting when an email was sent. The default format is HH:mm:ss. | ||
| TimeStarted | Yes | For export, the time portion of the datestarted field, reporting when an email Calendar item or Bloomberg CHAT started. The default format is HH:mm:ss. | ||
| TimeTaken | Yes | For export, the time portion of the datetaken field, reporting when the image (such as a JPG) was taken. The default format is HH:mm:ss. | New in 5.2.5.x | |
| TimeZone | Yes | For export of email, identifies the time zone for the exported dates. | ||
| TimeZoneOffset | Yes | For export, the hour offset of the selected export time zone (as identified in the TimeZone field). If the document is an email, and that email has sent field metadata, the offset reflects any daylight savings time rules in effect at that sent time for the selected time zone. The offset is a whole number. | ||
| title | Text identifying the title of the document. | Yes | ||
| to | For email, identifies each intended recipient of this email. For Microsoft Outlook, this field may contain both a name and address (for example, mike.barnett@uk.pwcglobal.com, mark.cole@uk.pwcglobal.com). For Lotus Notes, this field typically contains one or more fully qualified names (for example, CN=John Doe/OU=US/O=someco). When you display this field after import, each recipient is separated by a comma or semicolon, depending on the source. For export, each recipient is always separated by a semicolon (for example, jason.smith@uk.pwcglobal.com; bill.stark@uk.pwcglobal.com; mona.wall@uk.pwcglobal.com). |
Yes | ||
| to_identifier |
|
Yes | New in 5.4.1.0 | |
| to_name |
|
Yes | New in 5.4.1.0 | |
| trackchanges | A boolean identifying Microsoft Word documents that have the Track Changes feature enabled. Populated and set to true when track changes is detected in Word documents, and you can search for trackchanges::true. For Parsing Library V2, trackchanges is supported for .docx files only (that is, XML-based Word documents), not .doc files (Word documents that are not XML-based). Note: Excel Track Changes is reported by the docannotations field. | |||
| typist | A status property used by Microsoft Office applications to identify the document typist. Not case-sensitive when searched. | |||
| unid | Populated for files extracted directly from Lotus Notes NSF files. The unid is a 16-byte value (32 characters) in which the first 8 bytes represent the file (database) component and the second 8 bytes represent the Notes component (essentially, both components are internal timestamps). Not case-sensitive when searched. | |||
| virus | If Detect Viruses is enabled in a Project's Index Settings, the name of a virus detected in a document. Note that if a virus is detected in an attachment, both the attachment and its parent report the virus detected in this field. For information about using an exclusion search to prevent files in which a virus was detected from being added to Project Data, see View and Manage Analytic Settings for the Project. | Yes | ||
| VolName | Yes | For export, identifies the volume in which this document ID was assigned (not necessarily produced). It may not always match the value of the ExportedVolName field. | ||
| wordcount | A value representing the document word count. this field typically applies to Microsoft Office documents. |
Short Message Format Fields
The following table lists the Short Message Format (SMF) fields, which were largely introduced in the 5.4.1.0 release to support Cellebrite, 5.4.3.0 to support MS Teams, 5.5.2.0 to support RSMF (derived from RSMF-embedded JSON)
| Metadata Field
(after import, or full metadata export) |
Export-Only? | Description | Tokenized? | Notes |
|---|---|---|---|---|
| smf_all_attachments | The identifiers of any attachments linked to the current document. | New in 5.5.2.0.0 | ||
| smf_application | The software used to create or edit the current document, such as Teams or Slack. | New in 5.5.2.0.0 | ||
| smf_attachmentcount | Contains the number of attachments linked to the current document. | New in 5.5.2.0.0 | ||
| smf_call_duration | The length of the call. | New in 5.5.2.0.0 | ||
| smf_called_number | The phone number that was called. | New in 5.5.2.0.0 | ||
| smf_cellebrite_description | A description provided by Cellebrite extraction tools. | New in 5.5.2.0.0 | ||
| smf_cellebrite_lastactivity | The last recorded activity according to Cellebrite extraction tools. | New in 5.5.2.0.0 | ||
| smf_cellebrite_name | The name assigned by Cellebrite extraction tools. | New in 5.5.2.0.0 | ||
| smf_cellebrite_starttime | The start time recorded by Cellebrite extraction tools. | New in 5.5.2.0.0 | ||
| smf_cellebrite_subdir | Subdirectory information provided by Cellebrite. | New in 5.5.2.0.0 | ||
| smf_cellebrite_type | The type of data provided by Cellebrite. | New in 5.5.2.0.0 | ||
| smf_channel_name | The unique name of a |
Yes | New in 5.4.3.0 | |
| smf_chatid |
|
|||
| smf_containsdeleted | Boolean indicating whether the document contains deleted content. | New in 5.5.2.0.0 | ||
| smf_containsedited | Boolean indicating whether the document has been edited. | New in 5.5.2.0.0 | ||
| smf_conversation_calltype | The type of call within the conversation (e.g., video, voice). | New in 5.5.2.0.0 | ||
| smf_conversation_timezoneeverywhere | Boolean indicating whether timezone data is consistent across the conversation. | New in 5.5.2.0.0 | ||
| smf_conversation_timezoneoffset | The timezone offset for the conversation timestamp. | New in 5.5.2.0.0 | ||
| smf_conversationtype | The type of conversation (e.g., instant message, email). | New in 5.5.2.0.0 | ||
| smf_custodian | The individual or entity from whom the document or data was collected. | New in 5.5.2.0.0 | ||
| smf_datatype | The data type or format of a Short Message Format (SMF) item, such as Cellebrite_ChatMessage or Teams_Meeting. Not case-sensitive when searched. | |||
| smf_deleted | Boolean indicating whether an object was Deleted or is Intact. Not case-sensitive when searched. | |||
| SMF_DeletionDate | Yes | For export, the date portion of the smf_deletiondatetime field. The default format is mm/dd/yyyy. |
||
| smf_deletiondatetime | The full timestamp on which a file was deleted. The format is yyyy-MM-dd-HH-mm-ss. | |||
| SMF_DeletionTime | Yes | For export, the time portion of the smf_deletiondatetime field. The default format is HH:mm:ss. | ||
| smf_direction | The direction of the communication (for example, Outgoing, Incoming, or Missed). Not case-sensitive when searched. | |||
| smf_event_attendees | The list of attendees (participants) for an event. | Yes | ||
| smf_event_availability | The user availability during the event (for example, Busy or Free). | |||
| smf_event_category | The type of event for a Cellebrite_CalendarEntry (for example, US Holidays or Birthdays). Not case-sensitive when searched. | |||
| smf_event_details | The user-provided details for an event (for example, a link to a site or information about the event). | Yes | ||
| smf_event_id | The identifier for a specific event. | New in 5.5.2.0.0 | ||
| smf_event_location | The location for a calendar event, as provided by the user during event creation. | Yes | ||
| smf_event_repeatday | Information about the day(s) of the week that this event repeats, if any. Not case-sensitive when searched. | |||
| smf_event_repeatinterval | Indicates the number of times the RepeatRule interval must repeat between events. | |||
| smf_event_repeatrule | Indicates how frequently this event repeats (for example, Weekly, Monthly, or Yearly). Not case-sensitive when searched. | |||
| smf_event_type | The type of event recorded. | New in 5.5.2.0.0 | ||
| smf_eventCollectionid | The identifier for a collection of events, such as an email thread or chat conversation. For Slack channels, the value is the Slack channel ID. | New in 5.5.2.0.0 | ||
| smf_fileid | The standalone file ID that corresponds to an attachment or voicemail. Not case-sensitive when searched. | |||
| smf_filepath | The filesystem path for a given file. | Uses path tokenization rules (for word breaks on \ or /) |
||
| smf_filesystem | The ID of the file system in which this file exists. Not case-sensitive when searched. | |||
| smf_folder | The name of the phone source folder containing the message (for example, Recents, Sent, Inbox, or Drafts), if applicable. Not case-sensitive when searched. | Uses path tokenization rules (for word breaks on \ or /) |
||
| smf_fullparticipants_identifier | Full identifier for all participants of the communication. | New in 5.5.2.0.0 | ||
| smf_generator | The software that generated the document. | New in 5.5.2.0.0 | ||
| smf_hash | A unique digital fingerprint of the file used to ensure data integrity. | New in 5.5.2.0.0 | ||
| smf_id | A unique identifier assigned to each document. | New in 5.5.2.0.0 | ||
| smf_imei | International Mobile Equipment Identity, a unique identifier for a mobile device. | New in 5.5.2.0.0 | ||
| smf_importance | Indicates the importance level of an email (e.g., high, normal, low). | New in 5.5.2.0.0 | ||
| smf_imsi | International Mobile Subscriber Identity, identifying the user of a cellular network. | New in 5.5.2.0.0 | ||
| smf_informational | Boolean indicating whether the document contains informational content. | New in 5.5.2.0.0 | ||
| smf_iscarved | Boolean indicating whether an item has been carved (reassembled via reconstruction of fragments indicating the absence of file system metadata). Not case-sensitive when searched. | |||
| smf_isinfected | Boolean indicating whether an item has been infected with a virus. Not case-sensitive when searched. | |||
| smf_message_body | The actual text of the body of a Cellebrite or Teams message without any header values. | Yes | New in 5.4.1.1 | |
| smf_message_deleted | Boolean indicating whether a message was Deleted or is intact, or Unknown. Not case-sensitive when searched. | |||
| smf_message_status | The message status (for example, Sent, Read, or Delivered). Not case-sensitive when searched. | |||
| smf_message_type | The service (carrier) through which this message was sent or received (for example, AppMessage, IMessage, MMS, or SMS). Not case-sensitive when searched. | |||
| smf_messagedirection | The direction of the message (e.g., incoming, outgoing). | New in 5.5.2.0.0 | ||
| smf_messagestatus | The status of the message (e.g., read, unread, sent). | New in 5.5.2.0.0 | ||
| smf_msisdn | Mobile Station International Subscriber Directory Number, a number uniquely identifying a subscription in a GSM or UMTS mobile network. | New in 5.5.2.0.0 | ||
| smf_overflow | Contains any additional fields discovered in the XML that do not currently map to an existing field. Can also identify models, which can contain multiple fields or other models. Contains the name of each overflow field and its value, one pair per line. | Yes | ||
| smf_participant_display | Display name for a participant in a communication. | New in 5.5.2.0.0 | ||
| smf_participant_id | Identifier for a participant. | New in 5.5.2.0.0 | ||
| smf_participant_status | The status of a participant (e.g., active, inactive). | New in 5.5.2.0.0 | ||
| smf_participantcount | Contains the number of participants. | New in 5.5.2.0.0 | ||
| smf_phone_owner | The owner of the phone. | New in 5.5.2.0.0 | ||
| smf_platform | The device platform this message was sent from (for example, PC, Mobile, or Web). Not case-sensitive when searched. | |||
| smf_relatedfilepaths | File path information (for example, related to voicemails) for RelatedNodes and Related Models items in sections of a source Cellebrite XML file. | New in 5.4.3.0 Uses path tokenization rules (for word breaks on \ or /) |
||
| smf_relativity_attachmentid | Identifier for an attachment linked to the current document. | New in 5.5.2.0.0 | ||
| smf_role | The role of a participant (e.g., sender, receiver). | New in 5.5.2.0.0 | ||
| smf_source | The origin of the document or data. | New in 5.5.2.0.0 | ||
| smf_source_application | The source application from which this message was sent or received (for example, Native Messages, Discord, WhatsApp, or Snapchat). Not case-sensitive when searched. | |||
| smf_sourcefile | The data area handle (for location) and name of the source XML file for this record. | Yes | ||
| smf_sourcefilename | The name of the source XML file for this record. | Yes | ||
| smf_sourcefilepath | The full internal path to the source XML file for this recoed. | Uses path tokenization rules (for word breaks on \ or /) |
||
| smf_sourceindex | The source index value. Not case-sensitive when searched. | |||
| smf_sourcemodels | One or more sets of information for the source models field in a source Cellebrite XML file. Each set of this information consists of name and value pairs in the format <key1>: <value1>, <key2>: <value2>, ... Type: <type>, ID: <guid>, where each set is separated by a semicolon. The name and value pairs can include information such as the Direction (Outgoing or Incoming) and Type (for example, InstantMessage) in the context of an ID (GUID value). Not case-sensitive when searched. | New in 5.4.3.0 | ||
| smf_sourcerecordid | A GUID identifying the source record of a Short Message Format (SMF) item. Not case-sensitive when searched. | |||
| smf_tags | A Tag indicating the file purpose or location (for example, Archives, Audio, Configuration, Image). Not case-sensitive when searched. | |||
| smf_team_name | The name of a source chat, channel, or subchannel in Teams. Not case-sensitive when searched. | New in 5.5.0.0. | ||
| smf_threadcount | Contains the number of emails or messages in a conversation thread. | New in 5.5.2.0.0 | ||
| smf_threaddeleted | Boolean indicating whether an email thread has been Deleted or is Intact. Not case-sensitive when searched. | |||
| SMF_ThreadLastActivityDate | Yes | For export, the date portion of the smf_threadlastactivitydatetime field. The default format is mm/dd/yyyy. | ||
| smf_threadlastactivitydatetime | The full timestamp on which activity ended for this thread. The format is yyyy-MM-dd-HH-mm-ss. | |||
| SMF_ThreadLastActivityTime | Yes | For export, the time portion of the smf_threadlastactivitydatetime field. The default format is HH:mm:ss. | ||
| smf_threadname | The name of this chat, if applicable. | Yes | ||
| smf_threadsource | The application on which this chat thread took place (for example, Snapchat, Discord, WhatsApp, ooVoo, Native Messages, or Facebook Messenger). Not case-sensitive when searched. | |||
| SMF_ThreadStartDate | Yes | The date portion of the smf_threadstartdatetime field. The default format is mm/dd/yyyy. | ||
| smf_threadstartdatetime | The full timestamp on which activity started for this thread. The format is yyyy-MM-dd-HH-mm-ss. | |||
| SMF_ThreadStartTime | Yes | For export, the time portion of the smf_threadstartdatetime field. The default format is HH:mm:ss. | ||
| smf_timezone | The timezone of the document's timestamps. | New in 5.5.2.0.0 | ||
| smf_user_name | The display name or unique identifier of the Slack user associated with a specific channel, message, action, or event. The value defaults to that of the from_name metadata field; if from_name is unavailable, it falls back to the Slack handle and then to the Slack user ID. |
New in 5.5.4.0 | ||
| smf_version | The version number of the document. | New in 5.5.2.0.0 | ||
| smf_video_call | Boolean indicating whether the call was a video call. | New in 5.5.2.0.0 |
Export Exceptions
The following table summarizes the Export Exceptions that can be reported in the Export metadata field ExceptionDescCode . For a more detailed list of these exceptions along with their associated import (parsing and OCR) warnings/errors (where applicable), see "Export Exceptions" in the Export Overview topic.
| Export Exception Code | Description |
|---|---|
| CONNECTOR_FAILURE | Indicates a Connector failure (for example, the file could not be retrieved using the Connector and location). This failure may also occur if the Connector itself could not be read. |
| CONNECTOR_READ_ERROR | Indicates that either the document or directory could not be read, or the document or directory has illegal (invalid) characters in the name. |
| CONVERSION_FAILURE | Indicates a failure during conversion to HTML, MHTML, or HTML/MHTML, depending on what is selected for the Export . This error may also occur for a Special File (that is, a file that is not a directory or regular file). |
| CORRUPT | Indicates a file identified as corrupted or damaged in some way during the parsing process. |
| ENCRYPT | Indicates an encrypted or password-protected file. |
| INVFILETYPE | Indicates a file identified as having an undetermined file type or unsupported file type during parsing. |
| NATIVEFILE_NOT_FOUND | Indicates that the native file could not be found (that is, the document or directory does not exist and the document is considered missing). |
| NO_TEXT_FOUND | Identifies all files that did not have text extracted during processing. These have a parsingstatus of NODATA. |
| OCR_ERROR | Indicates an OCR error. For a list of these errors, see the section on OCR Errors in View a Scan Report. |
| OCR_INVIMAGE | Indicates an OCR processing error, most likely because the image was in a format that could not be handled. |
| PARSING_ERROR | Indicates the appropriate import (parsing) error, as identified in the Scan Report. For a list of the import errors, see the section on Warnings and Errors table in View Data Set Reports. |
| PDF_HIGHLIGHT_WARNING | Indicates that search term highlighting failed during generation of a PDF for export. The PDF was still generated, just without highlighting. |
| SETUP_ERROR | Indicates an installation or setup error (for example, that Lotus Notes or OCR is not installed or licensed). |
| SKIPPED | Indicates excluded, or skipped, files, identified with the Excluded category in the Scan Report. This exception means that archive files (.zip, .tar, and .pst) were excluded from the archive extraction process during import. |
| SUCCESS | Indicates success. |
| SYSTEM_ERROR | Indicates a system error. |
| UNEXPECTED_CONVERSION_FAILURE | Indicates an unexpected conversion-related issue. For example, if you select PDF for Export, |
| UNKNOWN | Indicates an unknown error or unexpected error. |