View a Search Results Report

Search Results > Reports  

Requires View Permissions to the Target View (for example, Imports - View or Project Data - View) and Project - Reports - View Permissions

The Reports tab for the most recently performed Search provides information about all documents that met the requirements of the Search query run against the selected Search Target. This Search Results view enables you to examine the population of documents returned by the Search and learn how these documents are distributed across file types, any assigned Custodians, and Tags.

The report is different based on the type of Search. Term-based searches, for example, always support all the main search options search options Include Families or Include Metadata. Different types of results report different information. For example, a Find More Like These reports the selected threshold but not search options such as Include Families or Include Metadata. Duplicate searches and Drill-through searches also do not use the search options Include Families or Include Metadata.

The following sections address the Summary information for the different types of Searches:

For more information about how search clauses are reported for term-based searches, see About Search Clauses in this topic.

For information about Data Set or Imports results document lists, see Document Information for Data Set or Imports Search Results.

For information about Project Data-based result document lists, see Document Information for Project Data-based Search Results.

Reports Tab Toolbar

The Reports tab toolbar provides the following:

  • Oldest report: yyyy-MM-dd HH:mm:ss – Identifies the full date and time based on the oldest report generated or updated for this view (for a date other than today or yesterday). The timestamp is shown in the local time zone. If the report was generated or updated today, the report will show Today HH:mm:ss; if it was generated or updated yesterday, it will show Yesterday HH:mm:ss.
  • Update – Click this button to recalculate the reports for this view with the latest information. You should click Update on reports generated prior to a change such as a Custodian or Custodian Priority change, a Dedupe setting change, or changes in the number of documents in the view. An update will also reflect any changes to the enabling/disabling of reports by your eDiscovery Administrator.

About Report Generation

  • For certain searches, such as Freeform Search, Advanced Search, and Bulk Search, you can use the Generate Reports option to have the reports generated at the time you perform the Search instead of waiting until the Reports tab is selected. (Your search may take longer initially, but you will not see a Generate Report task in the Work Basket when you click the Reports tab, and the reports should load more quickly.)
  • By default, a given Reports tab shows all reports that apply to that particular view. Your eDiscovery Administrator may decide to disable the generation of selected reports for Project Data views. Therefore, if you do not see all of the reports in your Project, consult your eDiscovery Administrator. Any report that has been disabled is identified in the Reports tab as a Report Disabled. You may want to click Update to ensure that the most recent enabled/disabled settings are reflected.
  • Reports for a large number of documents (for example, greater than 50,000) take time to generate, especially if all reports for a given view are generated. If report generation is taking a considerable amount of time, an In Progress Generate Report task appears in the Work Basket (for example, if you click the Reports tab without selecting the Generate Reports option at the time of the search). If you want, you can cancel the report generation.

Download a Query Based Search Summary Support

For any type of query based Search Summary report, you can click to download the Search Summary report in Excel (.xlsx) format. This format features a multi-tab workbook with detailed information. The XLSX by default includes per-Custodian and per-Batch sheets, but you can control whether or not these sheets are included using the Project Data Search Settings. For more information, see About the Download Report with Per-Clause Information.

Search Summary for Query Based Search Results

The Results Summary describes the query based Search that was performed using Freeform Search, Advanced Search, or Current Results.The summary information depends on the nature of the Search performed. Bulk Searches and Workflows have their own reports (Bulk Search Report and Workflow Report); individual searches from a Bulk Search or a Workflow Step do provide the search report summary on the Reports tab.

Note: For a Search based on a query, the Results Summary title and the title displayed in the downloaded XLSX (or CSV) for the chart identify which deduplication setting is being used to calculated the counts (for Dedupe Setting: Global) or (for Dedupe Setting: Custodial).

For a Search based on a query, the summary displays the query entered and executed, as well as the target and search settings used, as follows:

  • Search Type — The type of Search (for example, Freeform Search or Advanced Search). Freeform is reported for an individual search run as part of a Bulk Search, which has its own Bulk Search Report. In this case, the individual search appears in the tree as a child of the Bulk Search parent. Note that if you run a Bulk Search with typed or local file uploaded queries as a combined search, Freeform is the search type reported, but this search will not have a parent Bulk Search entry in the tree. (If you run a Bulk Search with a Connector file of queries as a combined search, the Connector file queries are subject to chunking, so you will see the parent Bulk Search Report entry in the tree and one or more child entries for the chunked Connector file queries, 1000 per chunk.)
  • Target — The target view selected to define the scope of the Search (for example, all of Project Data, or a Folder).
  • Filter by Data Sets — For applicable searches, a semicolon-separated list of the source Data Sets in Project Data that were selected for the Search (as part of selecting a Search Target). This option will be blank if no source Data Sets were selected. This option does not apply and therefore does not appear for Workflow searches or Workflow steps (that is, a Workflow search from Search History or a Workflow Step under Workflows), or for a Metadata Bulk Search (where you select the By Metadata Field option for a Bulk Search. For more information about filtering a search by Data Sets, see a Select Data Set(s) when selecting a Search Target.
  • Include Families — Indicates whether the search includes all members of a family (MAG or DAG). A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. Family members are included as long as the Include Families option is set for the Search. By default, this option is Enabled to ensure that all available family members are included in the results (a parent email, parent document, associated attachments, and embedded messages or documents). When enabled, it is possible that your results will include more documents than are reported in the Doc Count. This would indicate the inclusion of family members that are already in the source view but do not get scored in the results against the query. You can identify these documents in the Documents list because they all have a Score of 0. If you disable the Include Families option for an Advanced Search or Bulk Search, the results will report Disabled for the Family Expansion, and the results will include just the document that meets the Search criteria, not the family members. Note that this option is implicitly enabled for a Freeform Search or Current Results search.
  • Include Metadata — Indicates whether the search of each keyword in a query was expanded to include a set of metadata fields as well as content. A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. You can select the Search Fields you want to have searched automatically. When the Include Metadata option is enabled, all individual keywords as well as the keywords in phrases, and in special searches such as Proximity search, are subject to expansion. By default, this checkbox option is Enabled for Freeform, Advanced Search, as well as Bulk Search. It is always enabled for a Current Results Search. Your results report per-term Doc Count for the entire set of fields (not each field). Note that when this option is enabled, you can control the expansion on a per-term basis and limit the search of a given keyword to just content by specifying content::<keyword> for a given keyword or content::(<keyword1> <keyword2> <keyword3>)for a group of keywords. In this case, your per-keyword document counts will reflect how you issued the Search. For more information about the default Standard syntax, see the topic Use the Standard Search Syntax.
  • Expand Synonyms — Indicates whether the Advanced or Bulk Search was performed with Expand Synonyms enabled or disabled. A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. When Expand Synonyms is enabled, the search is performed with a list of synonyms for each specified term, and the terms appear when you open the Query Executed area. The Doc Count for all the synonyms for a term are reflected in the Clause table entry for that term (that is, cumulatively). Note that there is no metadata expansion performed on the synonyms that become part of the search, just on the user-provided terms. Note also that Expand Synonyms works for information in the contents, title, subject, comment, or comments fields. It will not work for terms accompanied by ~ or other syntax used for special Searches. By default, Expand Synonyms is disabled for Advanced and Bulk Search.
  • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the target, for example, a single view of Project Data or the entire contents of Project Data). For example, you may get 270 results out of 4343 documents overall in the searched view met the query.

Two tabs on the right enable you to see either the query you entered, or the query that was actually executed:

  • Query Entered (default tab) — The exact query entered by the user who performed the Search. If the Search was performed using Advanced Search, this query reflects what was built from your selections. Color is used to help identify items such as Boolean operators and special syntax.
  • Query Executed — The query as interpreted by the software, reflecting the actual criteria used in the Search. Studying the query executed helps you see how your Search query was interpreted and expanded. For example, if you keep the default setting for Include Metadata, you will see the set of common metadata fields that were searched for each keyword. Color is used to help identify items such as Boolean operators and metadata fields. Viewing the query executed can also help you identify syntax issues that prevented you from getting the results you expected. For more information about Standard Search syntax, see Use the Standard Search Syntax.

Results Summary

  • Results Summary (for Dedupe Setting: Global | Custodial)

    The columns shown in this table and in the download report are determined by the Project Search Settings. This information represents a Search Term report.

    Note that you cannot necessarily add up all the columns in the Results Summary table and get the total number of hits:

    • ID — An identifier for the search.
    • Clause — An entry for each clause or component of the Search query (see About Search Clauses for a summary of what constitutes a clause):
      • Doc Count — The number of documents or "hits" in the results that were responsive to the associated keyword (term) or clause.
      • Unique — The number of documents in the results that were uniquely responsive to the specific clause.
      • Clause Ratio — The percentage of the total document count providing "hits" (based on meeting the search criteria for the given clause).
      • Duplicates — Per clause, the number of documents that represent duplicates based on family membership (MAG or DAG). A document is a duplicate of another document only if both documents have the same dupe_fingerprint and their parents have the same dupe_fingerprint and have different parents.
      • Family Expansions — Per clause, the number of documents that represent any additional family members (of a MAG or DAG) that were included in the results but did not match this clause. This field will report NA for each clause if the Include Families option is not set for the Search.
      • Family Doc Count — Per clause, the number of families, where each family hit represents one of the following:
        • Each document that is not an email or from an email.
        • Each MAG, regardless of the number of email items in the MAG.

        Note: The dedupe counts and filesize are calculated and displayed according to the Project deduplication setting (under Analytic Index Settings), either the default of Global or Custodial. This setting, which applies for Project Data and views of Project Data, determines the processing of email, reporting of dedupe counts and size, and how email is handled for an Export that includes duplicates. For search results for an Imports view or a Data Set view, these counts have no meaning, as the dupe_fingerprint calculation comes into effect when documents are added to Project Data.

      • Total DeDuped Docs — Per clause, the number of documents that were responsive to the query, without including duplicate documents (that is, the responsive documents are deduped across all search terms).
      • Total DeDuped File Size — Per clause, the file size (in GB) of the documents that were responsive to the query, without including duplicate documents.
      • Total DeDuped Docs w/Family — Per clause, the number of documents that were responsive to the query, including all of their family members, but not including duplicate documents.
      • Total DeDuped File Size w/Family — Per clause, the file size (in GB) of the documents that were responsive to the query, including all of their family members, but not including duplicate documents.
      • Unique DeDuped Docs — Per clause, the number of documents that were uniquely responsive to the specific clause, without including duplicate documents.
      • Unique DeDuped File Size — Per clause, the file size (in GB) of the documents that were uniquely responsive to the specific clause, without including duplicate documents.
      • Unique DeDuped Families (unique deduped documents with family) — Per clause, the number of entire document families that were uniquely responsive to the specific clause, not including duplicate documents.
      • Unique DeDuped Families File Size (file size of unique deduped documents with family) — Per clause, the file size (in GB) of the entire document families that were uniquely responsive to the specific clause, not including duplicate documents.

      About Search Clauses

      When examining search clauses in the report, it is important to remember that Digital Reef evaluates operators in the following order:

      1. w/N (Proximity)
      2. OR
      3. AND

      In general, if your query consists of terms or phrases separated by OR operators only, the individual terms or phrases are reported as separate clauses. For example, the following query will be reported as three clauses:

      one OR two OR three

      one

      two

      three

      The same is true even if your query consists of terms or phrases separated by either OR operators only, and also includes a term preceded by a NOT. For example, the following query would report four clauses:

      one OR two OR three OR NOT six

      one

      two

      three

      NOT six

      If your query consists of terms or phrases separated by AND operators only, one clause will be reported. For example, the following query will be reported as one clause:

      one AND two AND three

      one AND two AND three

      As soon as your query includes a mix of operators, the clause breakdown depends on how the query is interpreted (for example, based on the order in which the operators are evaluated). For example, the following query, issued without explicit grouping, is reported as one clause:

      one AND this OR that

      This query is interpreted as the following:

      one AND (this OR that)

      The following query is also reported as one clause:

      one OR two AND reports

      This query is interpreted as the following:

      (one OR two) AND reports

      If your query includes one or more sets of explicitly grouped terms, the different components of that query are evaluated. For example, the following query would report two clauses:

      (brokerage w/25 agreement) OR memo

      (brokerage w/25 agreement)

      memo

      However, the following query reports one clause:

      (brokerage w/25 agreement) AND memo

      (brokerage w/25 agreement) AND memo

      The following query will report two clauses:

      (one AND two) OR (three AND four)

      one AND two

      three AND four

      However, the following query reports one clause:

      (one OR two) AND (three OR four)

      (one OR two) AND (three OR four)

      The following query will report two clauses:

      dog w/5 (cat OR bird) OR cat w/10 mouse

      (dog w/5 (cat OR bird))

      (cat w/10 mouse)

      However, the following query will report one clause:

      dog w/5 (cat OR bird) AND cat w/10 mouse

      (dog w/5 (cat OR bird)) AND (cat w/10 mouse)

      The following query would report one clause:

      ted AND (bob AND bill)

      ted AND (bob AND bill)

      The following query would also report one clause:

      apple AND NOT (worm OR bug)

      apple AND (NOT (worm OR bug))

      A proximity search or a date range search will appear as a Search Clause as well.

      The software currently supports top-level clauses only.

      If you want to search by domain lists, providing only one clause in the query for sentdomains::<domainlist> or participantdomains::<domainlist> ensures that you will see a doc count for each domain in the list. However, if your query includes more than the single clause, you will see one clause and doc count for the domain list as a whole. Even a clause with zero for a Doc Count is listed in the table.

      About the Download Report with Per-Clause Information

      The downloaded XLSX file for a search report provides key information over multiple tabs, as follows:

      • Glossary — This tab applies to all search result views and contains both a Glossary and a Legend. The Glossary helps you follow the Search Term Hit Count information in columns of the Total tab as well as the appropriate Batch and/or Custodian tabs that apply to the Search Result view. The Legend section identifies the prefixes used for each Batch and Custodian tab that applies to the search results view. For example, B1 may be the prefix used to represent a Batch called data1 (where the tab name is B1-data1), and C1 may be used to represent a Custodian called mikeg (where the tab name is C1-mikeg).
      • Summary — This tab applies to all search result views and summarizes the key counts for the searches, such as the Total Records in the search target view, the Total Dupes in that search target view (where Global refers to Global deduplication and Custodial refers to Custodial deduplication), the Total Search Hits (Deduped), and the Total Search Hits with Family (Deduped). This tab also reserves a section for a logo and other job and client information, and identifies the Search Settings for the search (for example, the Search Target, Query Entered, Include Families, and Include Metadata). A note is included if the entered query is truncated to meet the XLSX cell length restrictions.
      • Total — This tab provides the Search Term Hit Count information (per Clause, as it appears on the Reports tab, with the appropriate columns based on your selected Search Term Report Settings). An additional TOTAL line provides the statistics for the overall search (that is, all clauses in the search, combined).
      • Per-Custodian sheets — When included, these provide per-Custodian Hit Count details for the search results view. Custodian sheets apply only to Project Data and views of Project Data. Only Custodians that are responsive to the search will have tabs. An additional TOTAL line provides the per-Custodian statistics for the overall search (that is, all clauses in the search, combined). If you do not want to include the per-Custodian sheets in your downloaded search report, you can disable the Include Per-Custodian Sheets option in the Project Search Settings.
      • Per-Batch sheets —When included, these provide per-Batch (imported Data Set) Hit Count details for the search result view. Only Batches that are responsive to the search will have sheets. An additional TOTAL line provides the per-Batch statistics for the overall search (that is, all clauses in the search, combined). If you do not want to include the per-Batch sheets in your downloaded search report, you can disable the Include Per-Batch Sheets option in the Project Search Settings.

    Combined Search Summary

    For a Combined Search based on two or more queries, the summary displays the following information:

    • Search Type — The type of Search, Combined.
    • Target — The target view selected to define the scope of the Search (for example, all of Project Data, or a Folder).
    • Filter by Data Sets — If applicable, a semicolon-separated list of the source data sets in Project Data that were selected for the Search.
    • Include Families — Indicates whether the search includes all members of a family (MAG or DAG). A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. Family members are included as long as the Include Families option is set for the Search. By default, this option is enabled to ensure that all available family members are included in the results (a parent email, parent document, associated attachments, and embedded messages or documents). When enabled, it is possible that your results will include more documents than are reported in the Doc Count. This would indicate the inclusion of family members that are already in the source view but do not get scored in the results against the query. You can identify these documents in the Documents list because they all have a Score of 0. If you disable the Include Families option for an Advanced Search or Bulk Search, the results will report Disabled for the Family Expansion, and the results will include just the document that meets the Search criteria, not the family members. Note that this option is implicitly enabled for a Freeform Search or Current Results search.
    • Include Metadata — Indicates whether the search of each keyword in a query was expanded to include a set of metadata fields as well as content. A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. You can select the Search Fields you want to have searched automatically. When the Include Metadata option is enabled, all individual keywords as well as the keywords in phrases, and in special searches such as Proximity search, are subject to expansion. By default, this checkbox option is Enabled for Freeform,Advanced Search, as well as Bulk Search. It is always enabled for a Current Results Search. Your results report per-term Doc Count for the entire set of fields (not each field). Note that when this option is enabled, you can control the expansion on a per-term basis and limit the search of a given keyword to just content by specifying content::<keyword> for a given keyword or content::(<keyword1> <keyword2> <keyword3>)for a group of keywords. In this case, your per-keyword document counts will reflect how you issued the Search. For more information about the default Standard syntax, see the topic Use the Standard Search Syntax.
    • Expand Synonyms — Indicates whether the Search was performed with Expand Synonyms enabled or disabled. A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. When Expand Synonyms is enabled, the Search is performed with a list of synonyms for each specified term, and the terms appear when you open the Query Executed area. The Doc Count for all the synonyms for a term are reflected in the Clause table entry for that term (that is, cumulatively). Note that Expand Synonyms works for information in the contents, title, subject, comment, or comments fields. It will not work for terms accompanied by ~ or other syntax used for special Searches.
    • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the target, for example, a single view of Project Data or the entire contents of Project Data). For example, you may get 270 results out of 4343 documents overall in the searched view met the query.

    Two tabs on the right enable you to see either the query you entered, or the query that was actually executed:

    • Query Entered (default tab) — The exact query entered by the user who performed the Search. If the Search was performed using Advanced Search, this query reflects what was built from your selections. Color is used to help identify items such as Boolean operators and special syntax.
    • Query Executed — The query as interpreted by the software, reflecting the actual criteria used in the Search. Studying the query executed helps you see how your Search query was interpreted and expanded. For example, if you keep the default setting for Include Metadata, you will see the set of common metadata fields that were searched for each keyword. Color is used to help identify items such as Boolean operators and metadata fields. Viewing the query executed can also help you identify syntax issues that prevented you from getting the results you expected. For more information about Standard Search syntax, see Use the Standard Search Syntax.

    Drill-through Summary

    A drill-through search performed by double-clicking an entry in a report on the Reports tab provides the following information (note that it does not support Include Families or Include Metadata; it operates on just the entry):

    • Search Type — The type of Search for drill-through searches with a query, Drill-through.
    • Target — The target view selected to define the scope of the Drill-through Search (for example, Imports, all of Project Data, or a Folder).
    • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the target, for example, a single view of Project Data or the entire contents of Project Data). For example, you may get 270 results out of 4343 documents overall in the searched view met the query.

    Note: Depending on the report, drill-through results may yield a higher count than the original report entry, since the drill-through search is generally more inclusive, looking for all records containing the associated value in some format.

    Two tabs on the right enable you to see the query that was performed for the drill-through search. Usually, these two tabs match (with perhaps some uppercase/lowercase differences) for a drill-through search:

    • Query Entered (default tab) — The drill-through query performed for you when you double-clicked an entry in a report table.
    • Query Executed — The drill-through query as interpreted by the software.

    Note: For users with Imports -View and Project - Reports - View permissions, note that a drill-through of the Total OCR Candidates entry in the OCR Candidates report does not provide all of the standard drill-through search information, since it is not associated with a query.

    Metadata Bulk Search Summary

    A Bulk Search that is performed using the By Metadata Field option has its own report summary. (A regular Bulk Search without this option generates the standard Bulk Search Report.)

    • Search Type — The type of Search, Metadata Bulk Search.
    • Target — The target view that was selected to define the scope of the Search (for example, all of Project Data, or a Folder).
    • Input File (if applicable) — The name of the uploaded text file that contains the values specified by the Bulk Search by Metadata operation.
    • Metadata Field — The name of the metadata field searched (for example, docnum, filemd5, messageid, entryid, or unid).
    • Include Families — Indicates whether the search includes all members of a family (MAG or DAG). A indicates that the setting was enabled for the search; an indicates that the setting was disabled for the search. Family members are included as long as the Include Families option is set for the Search. By default, this option is Enabled to ensure that all available family members are included in the results (a parent email, parent document, associated attachments, and embedded messages or documents).
    • In the table shown to the right, Result Category and Count columns display the following:
      • Provided — Identifies the total number of values supplied for this type of Metadata Bulk Search.
      • Matched — Identifies the number of values that had just one document match.
      • Not Matched — Identifies the number of values that did not match any documents.
      • Multiple Matches — Identifies the number of values that had multiple document matches.

      — You can optionally save the Metadata Bulk Search information to an XLSX file). This XSLX file contains a Metadata Bulk Search Summary tab with basic count information per category and tabs that contain the values for each individual category (Matched, Not Matched, and Multiple Matches).

Find Exact or Content Duplicates of a Document Summary

This summary will display the following:

  • Search Type — The type of Search, either Exact Duplicate Document or Content Duplicate Document (which is a search for Exact or Content Duplicates of a selected document).
  • Target — The target view selected to define the scope of the Search (for example, all of Project Data or a Folder.
  • Source Document — The name of the Source (pivot) document. For an email, this is the name of the file (for example, 000017221.eml). (The task always displays the subject of the email instead.)
  • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the target, for example, a single Folder or the entire contents of Project Data). For example, 4 of 100 means that 4 documents of 100 documents in the searched view were exact or content duplicates of the selected document.

Find Near Duplicates of a Document Summary

This summary will display the following:

  • Search Type — The type of Search, Near Duplicate Document.
  • Target — The target view selected to define the scope of the Search (for example, all of Project Data, or a Folder.
  • Threshold— The similarity threshold that was used to perform the operation. The default is 80.
  • Source Document — The name of the file used as the Search pivot document to search for documents that are very close to the document you selected. For an email, this is the name of the file (for example, 000016550.eml). (The task always displays the subject of the email instead.)
  • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the target, for example, a single Folder or the entire contents of Project Data). For example, 60 of 1000 means that 60 documents of 1000 documents in the searched view met the Near Duplicate Document similarity threshold. Note that if the only responsive document is the pivot document (the document you used for the search), then that document is the only hit listed (for example, 1 of 1000).

Exact Duplicates Group/ Content Duplicates Group Summary

This summary will display the following:

  • Search Type — The type of Search, either Exact Duplicate Group or Content Duplicate Group (which is a search for Exact or Content Duplicates in a view).
  • Target — The target view selected to define the scope of the Search (for example, a Data Set shown to a user with the appropriate permissions).
  • Results — The number of documents returned in the results.

Find More Like These Summary

This summary will display the following:

  • Search Type — The type of Search, More Like These.
  • Target — The target view that was selected to define the scope of the Search.
  • Threshold— The similarity threshold that was used to perform the operation. The default is 20.
  • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (the selected documents and the target (for example, a single Folder or the entire contents of the Project Data). For example, 25 of 500 means that the 25 of the 500 documents in the target view met the specified similarity threshold.

If the set of Results have been tagged (using the Tag option on the Work Basket toolbar), the appropriate tag icons appear on all of the documents view in the All Docs tab of the results. You can also use the Tag menu in the All Docs tab of the results to Tag one or more documents.

Search by Synthetic Document Summary

This summary will display the following information:

  • Search Type — The type of Search, By Synthetic Document.
  • Target — The target view that was selected to define the scope of the Search (for example, a Custodian or a Folder).
  • Threshold— The similarity threshold that was used to perform the operation. The default is 20.
  • Source Synthetic Document — The name of the generated Synthetic Document (a text file) compared to a target view.
  • Results — The number of documents returned in the results and the total number of documents included in the scope of the Search (for example, a Custodian or Folder). For example, 25 of 500 means that the 25 of the 500 documents in the target view met the Synthetic Document's specified similarity threshold.

Sample Summary

A Sample is a type of Search Result. Depending on how you create the Sample, you will see a Summary with either Sample by Size or Sample by Confidence Level.

Sample by Size

This type of Sample shows the following information:

  • Search Type — The summary displays Sample by Size.
  • Target — The target view selected to define the scope of the Sample (for example, all of Project Data, or a Folder).
  • % of Documents — For a Sample created using By Sample Size, the selected percentage of documents requested for the Sample.
  • Include Families — Indicates whether the Sample includes all members of a family (MAG or DAG). Family members are included as long as the Include Families option is set for the Sample.
  • Sample All Custodians — Indicates whether the Sample covered all Custodians in the target view.
  • Results / Sample Size — The number of documents returned in the results and the total number of documents included in the Sample.

Sample by Confidence Level

This type of Sample shows the following information:

  • Search Type — The summary displays Sample by Confidence Level.
  • Target — The target view selected to define the scope of the Sample (for example, all of Project Data, or a Folder).
  • Confidence Level — Identifies the selected Confidence level for the Sample, which can be a value in the range 90-99%.
  • Margin of Error — Identifies the selected Margin of Error value (also known as the Confidence Interval, or CI) for the Sample. This value can be in the range 1-5.
  • Include Families — Indicates whether the Sample includes all members of a family (MAG or DAG). Family members are included as long as the Include Families option is set for the Sample.
  • Sample All Custodians — Indicates whether the Sample covered all Custodians in the target view.
  • Results / Sample Size — The number of documents returned in the results and the total number of documents included in the Sample.

How to Use Charts

You can use the charts to get detailed information about the data in the Search Results.

Drill-through Support

For the Summary sections and charts, you can generally use the drill-through capabilities to get additional information, as follows:

  • Double-click an entry in a chart to perform a drill-through that generates an additional search result view focusing on the information you selected. You can drill-through a particular entry in a Summary (for example, Mail Container Errors) or a pie chart section or entry in the legend (for example, a Document Types entry). When you drill through an entry, an additional search is generated, and a task is generated in Work Basket for this new drill-through search result view. The drill-through search result view launches automatically to list the documents responsive to the search, based on the entry into which you drilled.

Note: The document count displayed for a given report entry may not always match the document count calculated for the drill-through search of that entry. Depending on the report, the drill-through search results may yield a higher count than the original report entry, since the drill-through search is generally more inclusive, looking for all records containing the associated value in some format. Note also that if you try to perform drill-through searches on the reports for a Shared Data Set (assuming you have permissions to do so), you may need to click Update to update the report information appropriately for use in the current Project.

Disabled Reports

Any report that has been explicitly disabled in the Report Settings is identified in the Reports tab as Report Disabled.

Reports without Data to Display

Any report for which there is no data to display is identified on the Reports tab as No Data to Display.

Hover Text Support

  • You can hover over any bar, pie, or column section to get more information about that section.

View by Count or Size

  • For charts that can be based on either a Count or Size, you can use a drop-down menu to select either Count or Size, depending on which one is already active. For example, if Size is active, you can select Count.

Chart Download

  • For most charts in a report, you can click at the top right of a chart to download to a CSV file (or XLSX, for charts such as the Search Results Summary).
  • Some charts may take time to download. During report downloads, a message will appear at the top of the screen to notify you about the number of downloads in progress. You can hover over the in-progress message to see the individual downloads in progress.

View Chart Details

  • For most charts in this report (except Document Classification), you can click at the top right of a chart to view a Details pop-up with the document count and size information for the appropriate items. The Details pop-up for a chart supports Save, Tag, and Remove actions. The Details pop-up does not apply to the Search Results Summary or the Document Classification chart. For most charts, the Details popup shows you the name, count, and size of documents for an item, such as a Tag, Date, or Custodian. Some Multi-Tab Details, for example, for Domains, Languages, and Email Addresses, provide multiple tabs of information.

Note: Digital Reef .CSV files are generated using UTF-8 encoding. If the content includes non-ASCII or multi-byte characters, opening the .CSV using Microsoft Excel will not render the multi-byte characters properly (because Excel uses a different default encoding). To address this issue, change the extension of the downloaded file from .CSV to .TXT. When you open Excel and then open the file, change the File Origin to UTF-8 and add the Comma as a delimiter. For example, on Microsoft Windows, the selection is 65001: Unicode (UTF-8).

Document Classification Chart

This chart shows how document classification can help you further reduce the amount of content for review.

Document Classification Information

The Document Classification chart provides key count and size information based on document class.

Important Notes:

Note: For an all Imports or Data Set view, the values shown in this chart will reflect file MD5 deduplication, since the Deduplication Settings under Analytic Settings and calculations based on family membership apply only to views of Data (and initially calculated when data is added to Data by a user with Permissions).

  • For document classes subject to deduplication, the deduplicated count and size values are calculated and displayed according to the appropriate Deduplication setting (under Analytic Index Settings), either the default of Global or Custodial). This setting, which applies for Data and views of Data, determines the processing of email, reporting of de-dupe counts and size, and how email is handled for an Export that includes duplicates.
  • The Document Classification chart title and the title displayed in the downloaded CSV for the chart identify which deduplication setting is being used to calculated the counts (for Dedupe Setting: Global) or (for Dedupe Setting: Custodial). If you change the de-dupe mode after initially generating the report, you must click Update to recalculate based on the new setting.
  • The deduplication is calculated based on document class and family membership (MAG or DAG). For example, if the same Word document serves as a Message Attachment to two different email msgs, it is counted twice, once per message family.

Note: Keep in mind that reports will only be accurate if you keep the Families intact when running searches and saving documents to different views. This means that you must keep the Include Families checkbox enabled to ensure that Families remain intact.

  • The entries in the table now support the double-click drill-through capability.
Document Class Count Size Deduplicated Count Deduplicated Size
Container Files

The number of Container files (Archives, Message Archives, and Disk Images) in the view.

The size (by default, in bytes) of Container files in the view.

Container files are not subject to this deduplication analysis; therefore, this column is empty. Container files are not subject to deduplication.
Directories The number of directories in the view. The size (by default, in bytes) of directories in the view. Directories are not subject to this deduplication analysis. Therefore, for directories, this column will be empty. Directories are not subject to this deduplication analysis. Therefore, this column will be empty.
EDOC OLE Attachments The number of EDoc OLE attachments in the view. The size of EDoc OLE attachments in the view. The count of EDoc OLE attachments in the view after deduplication (based on family membership). The size (for example, in GBytes) of EDoc OLE attachments in the view after deduplication (based on family membership).
Message Attachments The number of message attachments in the view. The size (by default, in bytes) of message attachments in the view. The count of message attachments in the view after deduplication (based on family membership). The size (for example, in GBytes) of message attachments in the view after deduplication (based on family membership).
Messages The number of messages in the view. The size (by default, in bytes) of messages in the view. The count of messages in the view after deduplication. The size (for example, in GBytes) of messages in the view after deduplication.
Message OLE Attachments The number of Message OLE attachments in the view. The size of Message OLE attachments in the view. The count of message OLE attachments in the view after deduplication (based on family membership). The size (for example, in GBytes) of message OLE attachments in the view after deduplication (based on family membership).
NIST EDoc Files The number of EDocs that are NISTClosed The National Institute of Standards and Technology (NIST), which provides the National Software Reference Library (NSRL). The NSRL includes a Reference Data Set of digital signatures for known, traceable software applications. The list is used to identify files with no evidentiary value. Digital Reef provides the NSRL database to support detection of files with signatures (hash codes) matching those in the NSRL database upon import. DeNIST refers to the removal of any file that has a digital signature matching one in the NIST NSRL list. files in the view. The size (by default, in bytes) of EDocs that are NIST files in the view. NIST EDOC files are not subject to this deduplication analysis; therefore, this column is empty. NIST EDOC files are not subject to deduplication; therefore, this column is empty.
Non-NIST EDoc Files The number of non-NISTClosed The National Institute of Standards and Technology (NIST), which provides the National Software Reference Library (NSRL). The NSRL includes a Reference Data Set of digital signatures for known, traceable software applications. The list is used to identify files with no evidentiary value. Digital Reef provides the NSRL database to support detection of files with signatures (hash codes) matching those in the NSRL database upon import. DeNIST refers to the removal of any file that has a digital signature matching one in the NIST NSRL list. EDocs (that is, EDocs that are not NIST files) in the view. The size (by default, in bytes) of non- NIST EDocs in the view. The count of non-NIST EDocs (that is, EDocs that are not NIST files) in the view after deduplication. The size (for example, in GBytes) of non-NIST EDocs (that is, EDocs that are not NIST files) in the view after deduplication.
Total Documents The total number of documents in the view. The total size (in bytes) of documents in the view. Calculated regardless of whether the values for Directories, Container Files, and NIST EDocs are 0. Calculated regardless of whether the values for Directories, Container Files, and NIST EDocs are 0.

About the Downloaded Document Class CSV File

You can name and download the Document Classification table as a CSV file. The file contains additional entries, including a top entry for Total Documents. The CSV entries use the document class name, where applicable. Entries for directories, archives, message archives, and disk images will not show counts in views of Data as long as the uses the default set of Exclusion Searches. However, for the Imports view, or for a Data Set Scan Report view, these entries will report counts.

Note: All entries in the CSV file report Count and Size values. For document classes that support deduplicated count and size values, you will also see values populated in columns representing the Deduplicated Count and Deduplicated Size.

  • Total_Documents — The total document count and size for the view.
  • EDoc — The count and size of EDocs in the view.
  • Non-NIST_EDoc — The count and size of non-NIST EDocs in the view. For this entry, the Deduplicated Count and Deduplicated Size columns report the count and size of non-NIST EDocs in the view after deduplication.
  • EDoc_OLE_Attachment — The count and size of EDoc OLE Attachments in the view. For this entry, the Deduplicated Count and Deduplicated Size columns report the count and size of EDoc OLE Attachments in the view after deduplication (based on family membership).
  • Message — The count and size of Message Families (MAGs) in the view. For this entry, the Deduplicated Count and Deduplicated Size columns report the count and size of messages (Message Families, or MAGs) in the view after deduplication (based on family membership).
  • Non-NIST_Message_Attachment — The count and size of non-NISTClosed The National Institute of Standards and Technology (NIST), which provides the National Software Reference Library (NSRL). The NSRL includes a Reference Data Set of digital signatures for known, traceable software applications. The list is used to identify files with no evidentiary value. Digital Reef provides the NSRL database to support detection of files with signatures (hash codes) matching those in the NSRL database upon import. DeNIST refers to the removal of any file that has a digital signature matching one in the NIST NSRL list. Message Attachments in the view.
  • Message_Attachment — The count and size of all Message Attachments in the view. For this entry, the Deduplicated Count and Deduplicated Size columns report the count and size of Message Attachments in the view after deduplication (based on family membership).
  • Directory — The count and size of directories in the view (for example, the Imports view or a Data Set Scan Report view).
  • NIST_EDoc — The count and size of EDocs that are NIST files in the view.
  • Message_OLE_Attachment — The count and size of Message OLE Attachments in the view. For this entry, the Deduplicated Count and Deduplicated Size columns report the count and size of unique Message OLE Attachments in the view after deduplication (based on family membership).
  • Archive — The count and size of files that are File Archives or in compressed format in the view (for example, a GZIP, ZIP, RAR, or TAR file found on disk). This entry applies to a view that includes archive files (for example, the Imports view or a Data Set Scan Report view).
  • Message_Archive — The count and size of Message Archives in the view (for example, the Imports view or a Data Set Scan Report view).
  • NIST_Message_Attachment — The count and size of Message Attachments that are NIST files in the view.
  • Disk_Image — The count and size of Disk Images in a view that includes disk images (for example, the Imports view or a Data Set Scan Report view).

Note that NIST information is reported in the kftdesc metadata field.

Document Class

By default, this chart shows you the information based By Size (descending order) in GB, MB, or KB, depending on the size of the data.

What you see for document classes depends on the population of data for your selected view. The document classes are as follows (in display format, not the official search format):

Note: When you search for a document class using the docclass metadata field (which is not case-sensitive, but not tokenized), you must either specify the entire name of the class (for example, Message_Attachment, Message_OLE_Attachment, eDoc_OLE_Attachment, Message_Archive) or use wildcards.

  • EDoc – The total number and size of files imported that are not an email, not from an email, and not any type of archive (for example, not a file or email archive). These are files that do not fall into any of the following other document classes: emails, email archives (containers) such as PST, OST, and NSF, file archives (compressed files such as ZIP), or disk images. A Word document on disk is an EDoc, as is an Excel document found in a ZIP file at the import location, or a Word document that has an embedded email.
  • Message – The total number or size of email messages (but not their attachments). An email file on disk or an email file found in a ZIP file at the import location falls into this category. Email attachments and archive container files such as PST, OST, and NSF are not counted in this category.
  • Message Attachment – The total number or size of all imported email attachments. Examples include an image file or Word document attached to an email, or an archive such as a ZIP file attached to an email.
  • Message OLE Attachment – The total number or size of all files embedded within a Message_Attachment (or another Message_OLE_Attachment). These embedded files are extracted during import. You can drill through this entry to see a list of documents that were embedded within a Message_Attachment (or another Message_OLE_Attachment). An example of this document class is a document embedded within a Word document that is attached to an email.
  • EDoc OLE Attachment – The total number and size of all files that were embedded within an EDoc (or another EDoc_OLE_Attachment). These embedded files are extracted during import. You can drill through this entry to see a list of documents that were embedded within an EDoc (or another EDoc_OLE_Attachment). Examples include a Word document within another Word document, or even an email embedded within a Word document.
  • Message Archive – The total number or size of documents that are Email Archives (email container files such as PST, OST, NSF found on disk). By default, email archives are excluded from Data by an Exclusion Search.
  • Archive – The total number or size of documents that are file archives found on disk or in compressed format (for example, a GZIP, ZIP, RAR, or TAR file found on disk). By default, compressed and file archive types are excluded from Data by an Exclusion Search.
  • Disk Image – The total number or size of documents that are disk images, such as an Expert Witness Compression Format File (for example, for EnCase and SMART). By default, disk images are excluded from Data by an Exclusion Search.
  • Directory – The total number and size of directories present for the imported data (empty, populated, skipped, or with access errors). By default, note that directories are excluded from Data by an Exclusion Search.

— If you have permissions, you can optionally download the document class report information to a CSV file (by default, DigitalReefReport.csv). When you select this option, you can name the CSV file, and you can select where to save the file locally. The CSV also provides a Directory column with the total number and size of any directories present for the imported data (empty, populated, or with access errors).

Document Types

By default, this report shows you the information based By Size (descending order) in GB, MB, or KB, depending on the size of the data.

Note: The Document Types report provides information to the Billing Summary.

The document types are categorized as follows:

  • Disk Images – The total number or size of documents that are disk images, such as a Logical Evidence File (LEF) or Expert Witness Compression Format File (for example, for EnCase, an E01). See Container Files for a complete list of disk image types. By default, disk images are excluded from Data by an Exclusion Search.
  • Email Archives – The total number or size of documents that are email archives (email container files such as PST, OST, NSF found on disk). See Container Files for a complete list of email archive types. By default, email archives are excluded from Data by an Exclusion Search.
  • Email Messages – The total number or size of all email documents, including loose emails (such as msg or eml files), emails from an email archive, or email attachments. Documents that are not identified as emails, such as email archives (email container files), are not counted in this category.
  • File Archives – The total number or size of documents in that have a compressed type or file archive type (for example, GZIP, ZIP, RAR, and TAR). See Container Files for a complete list of compressed types and file archive types. By default, compressed and file archive types are excluded from Data by an Exclusion Search.
  • Images – The total number and size, in MBytes (MB), of files identified as image files (supported image types, such as PNG, JPEG, and TIFF). For a list of supported file types, see Supported File Types for Analysis.
  • Office Files – The total number or size of Microsoft Office documents (including Microsoft Office supported file types and versions, such as Microsoft Word, Excel, PowerPoint, Write, and Works). For a list of supported file types, see Supported File Types for Analysis.
  • PDF – The total number and size of documents in Adobe Acrobat (PDF), Adobe Indesign, or PDF Image format.
  • Other – The total number or size of documents that do not fall into any of the other categories (for example, a Text 7-Bit File, Internet HTML files, and directories (by default, directories are excluded from Data by an Exclusion Search).
  • Unknown – The total number or size of documents that are of a type not recognized by the system (for example, the Unknown format file type).

— If you have permissions, you can optionally download the detailed document type report information (the file types) to a CSV file (FILETYTPE.csv). When you select this option, you are prompted to confirm or name the CSV file, and you can select the directory to which you save the file.

  • The File Type tab provides a list of the official file types, such as Internet HTML or Adobe Acrobat (PDF). Clicking will download a FILETYTPE.csv with the information.
  • The File Extension tab provides a list of the extensions for the files (for example, txt, pdf, and docx). For text/plain and unknown file types, the file extension is the actual extension of the file; for all other file types, the file extension is the standard extension associated with that file type. Not present represents files for which there is no discernible extension (for example, a directory does not have an extension). A blank entry indicates that the file had an empty extension (for example, just a space). Clicking will download a DOCEXT.csv with the information.
  • The Exceptions tab provides a list of extension exceptions to provide information about what would be affected if you decide to change the current file extension to the recommended extension. This chart provides columns for the Current extension, the Recommended extension, as well as the Count and Size. The default sort order is by Count. Clicking for this tab will download a DOCEXT_CONFLICT.csv with the information.

OCR Confidence

For any documents in the view that have been subject to OCR processing, this table displays the calculated OCR Confidence Level (a Name or numeric range, the associated document Count, and the associated document Size).

The information in this chart is reported as follows:

  • Not present identifies documents that were not subject to OCR Processing.
  • unknown identifies documents for which the OCR Confidence level could not be determined.
  • Each OCR Confidence Level is represented using a numeric range: 0-10 (Lowest Confidence), 11-20, 21-30, 31-40, 41-50, 51-60, 61-70, 71-80, 81-90, and 91-100 (Highest Confidence).

Each letter in each page of a document has an OCR Confidence level, and an average Confidence level is computed based on all pages of a document from which text was extracted. (Pages from which no text was extracted do not contribute to the average.)

The average OCR Confidence level for a document is reported in the ocraverageconfidencelevelfield using a value in the range 0-100. A value of 0 is the lowest confidence level and a value of 100 is the highest confidence level. The lowest confidence level calculated for any page in a document is reported in the ocrlowestconfidencelevel metadata field. The ocrlowestconfidencelevel and ocraverageconfidencelevel fields use a padded 5-digit value (for example, 00010 is Confidence level 10) to support range searching. For example, to search for documents whose average OCR Confidence level is in the inclusive range 20-60, you would specify the following search (using the Standard search syntax):

ocraverageconfidencelevel::[00020~~00060]

If you want to see the average number of terms calculated per page, check the averagenumberoftermsperpage metadata field.

Click to save the OCR Confidence information to a CSV file. When you select this option, you can name the CSV file, and you can select where to save the file locally.

Custodians

For a result view of Project Data, this chart shows up to 10 entries for Custodians ranked By Size or By Count for the total number documents that are assigned within the current result view. If all documents are assigned to one or more Custodians, then all 10 entries will be for those Custodians. If some or all documents are not yet assigned to a Custodian, the documents will be in an Unassigned entry. (The Unassigned entry for a Project Data view appears in the report as long as there is at least one other Custodian present in the system.) Remember that specifying a non-zero value for the Custodian and Media Directory locations in the Project Index Settings enables you to auto-discover Custodians to add to the Project; otherwise, you will need to add Custodians to the Project. Note that Project Data views include the Custodians report; the Custodian Directories report applies to Imports and Data Set views only.

Click to download a CSV with the Custodian information.

For this chart, you can click to see Details with a detailed document size and count for all of the Custodians with documents assigned, not just the top 10.

Sources

This chart shows the By Size or By Count of each source of data that was imported into the Project. This chart focuses on the top five Data Areas for data added to Project Data.

Tags

This chart shows the top 5 Tags that apply to the current results view of Project Data, as ranked by the total size or count of documents tagged with that value.

Click to download a CSV with the Tags (Tags Summary) information.

For this chart, you can click to see Details with a detailed document count and size for the Tags.

Sending Domains

This chart shows the top 5 sending Domains associated with Project Data, based on the number of email messages sent from each Domain. A given Domain list can have a maximum of 1000 Domains.

Click to download a CSV with the Sending Domain information.

For this chart, you can click for details about the document size and count information for each Sending Domain.

Receiving Domains

This chart shows the top 5 receiving Domains associated with Project Data, based on the number of email messages received by each Domain. A given Domain list can have a maximum of 1000 Domains.

Click to download a CSV with the Receiving Domain information.

For this chart, you can click for details about the document size and count information for each Receiving Domain.

Dominant Languages

This chart shows the document count by dominant language (using the standard ISO 639-1 code for the language, such as en for English). The language-related charts apply if language detection was enabled at the time of import (for each Data Set under Imports).

Document count by dominant language is reported as follows:

  • The chart displays each language (Top 10) using its language code (many are two letters).
  • You can hover over an entry in the chart to see the language name and the total document count and size for a given language code.
  • If a document has multiple languages, the document will be counted for the dominant language only (instead of counted for each language detected).
  • unknown identifies documents for which the language could not be determined.
  • Not present identifies documents that were not subject to Language Detection at import, either because the feature was disabled at import for some of the data, or the documents did not have content, were identified as binary files such as images (when OCR processing is disabled at import), or were not parsed successfully.
  • Click to download a CSV with the dominant language information.
  • Click for Details about the document count by dominant language.

Languages

This chart shows the document count per language (using the standard ISO 639-1 code for the language, such as en for English). These charts apply if language detection was enabled at the time of import (for each Data Set under Imports).

Document count by language is reported as follows:

  • The chart displays each language (Top 10) using its language code (many are two letters).
  • You can hover over an entry in the chart to see the language name and the total document count and size for a given language code.
  • If a document has multiple languages, the document will be counted for each language detected.
  • unknown identifies documents for which the language could not be determined.
  • Not present identifies documents that were not subject to Language Detection at import, either because the feature was disabled at import for some of the data, or the documents did not have content, were identified as binary files such as images (when OCR processing is disabled at import), or were not parsed successfully.
  • Click to download a CSV with the language information.
  • Click for details about the document count by language.

See Supported Languages for Language Detection for a list of languages that can be detected when language detection is enabled, along with their codes.

Email Sent Date and Email Received Date

The Email Sent Date and Email Received Date reports enable you to see the volume of files associated with a range of email sent or received dates. This can help you make decisions about emails that need to be reviewed more carefully based on the date they were sent or received and how much email was involved (for example, you may focus on a large volumes of emails sent 9 months ago).

Note: The document count displayed for a given entry (bar) in the Email Sent Date report or Email Received Date report represents one document per family (the parent message for each family). For these reports, when you double-click to perform a drill-through on a given bar, the drill-through search will include each document in each family matching the date range (both messages and attachments) and will have a higher count than the original entry. The document count displayed for a given entry (bar) in the Project Data-based Date report is calculated differently, and includes each document in each family (messages and attachments). Therefore, a drill-through of an entry in the Date report will have the same count as the original entry.

Email Sent Date and Email Received Date Options

Both the Email Sent Date and Email Received reports provide a number of options that enable you to work with start and end ranges. You can either use the start and end dates in effect when you initially view the report (which is derived from the earliest and latest dates for the view), or you can specify your own start and end dates.

On the left:

  • – Enables you to type a start date in the box or click the Calendar icon to use a calendar to specify zero-day email sent or email received date criteria.
  • – Enables you to type an end date in the box or click the Calendar icon to use a calendar to specify zero-day email sent or email received date criteria.
    1. To use the Calendar, click the icon to the right of the Start or End box.
  1. Click the date you want, either the current date or the date you typed (highlighted for you), or select another day in the current month.
  2. Click the left or right arrows in the top corners on either side of the month name to move back and forward a month.
  3. Click the month and year in the center, and then use the arrows to go back and forward a year. You can also select another month in the year shown.
  4. Once you make a complete date selection, the Calendar closes and you see the date formatted properly in the box.
  • – Click this button to have the report reset to the originally displayed date range (the default start and end date for the report).

On the right:

  • Previous Period – Moves the histogram information to the previous period. The period of time is dictated by your Start and End zero-day dates.
  • Next Period – Moves the histogram information to the next period. The period of time is dictated by your Start and End dates.

Chart Download, Zero Day Details, and Details Options

If you hover over a date block in the Email Sent Date or Email Received Date histogram, you will get a summary of the information for the block. For example, the hover text for the bar of a 2008 entry in the Email Sent histogram might display 2008: 113. A tooltip tells you that you can click to drill down or double-click to drill through. If you click once on a sent or received date block to drill down, you can get more date information for that sent or received date block. If you double-click to drill through an item in the report, the software performs a drill-through search. You can perform the drill-through search at any drill-down level. Also, from either the Email Sent Date or Email Received Date histogram, you can click the following:

  • — Enables you to download all available information to a CSV. The CSV always contains all available data (the data initially shown in the chart based on the earliest and latest dates found in the view). The CSV content does not change based on your selected start date or end date.
  • — Displays a Zero Day Details popup that enables you to select and view zero-day dates for which there was no document processed). You have the option hide weekend days.

Date Report

The Date report enables you to see the volume of files associated with a range of dates. This Date Report is based on the dateprimary field, which populates the Date column of document lists derived from Data and accommodates the date information for different types of source files (such as dates from documents on disk or email dates).

Note: The Date report document counts are calculated differently than the Email Sent Date and Email Received Date reports. The Date Report counts include each document in each family, while the Email Sent and Received counts include one document per family.

This report can help you make decisions about documents or emails that need to be reviewed more carefully based on a date and how much data was involved (for example, you may focus on a large volumes of documents modified this year).

Date Options

The Date report provides a number of options that enable you to work with start and end ranges. You can either use the start and end dates in effect when you initially view the report (which is derived from the earliest and latest dates for the view), or you can specify your own start and end dates.

On the left:

  • – Enables you to type a start date in the box or click the Calendar icon to use a calendar to specify zero-day email sent or email received date criteria.
  • – Enables you to type an end date in the box or click the Calendar icon to use a calendar to specify zero-day email sent or email received date criteria.
    1. To use the Calendar, click the icon to the right of the Start or End box.
  1. Click the date you want, either the current date or the date you typed (highlighted for you), or select another day in the current month.
  2. Click the left or right arrows in the top corners on either side of the month name to move back and forward a month.
  3. Click the month and year in the center, and then use the arrows to go back and forward a year. You can also select another month in the year shown.
  4. Once you make a complete date selection, the Calendar closes and you see the date formatted properly in the box.
  • – Click this button to have the Date report reset to the originally displayed date range (the default start and end date for the report).

On the right:

  • Previous Period – Moves the histogram information to the previous period. The period of time is dictated by your Start and End zero-day dates.
  • Next Period – Moves the histogram information to the next period. The period of time is dictated by your Start and End dates.

Chart Download, Zero Day Details, and Details Options

If you hover over a date block in the chart, you will get a summary of the information for the block. For example, the hover text for the bar of a 2007 entry in the Date Report might display 2007: 750. A tooltip tells you that you can click to drill down or double-click to drill through. If you click once on a date block to drill down, you can get more date information for that date block. If you double-click to drill through an item in the report, the software performs a drill-through search. You can perform the drill-through search at any drill-down level. Also, from the bottom of the Date report, you can click the following:

  • — Enables you to download all available Date information to a CSV. The CSV always contains all available data (the data initially shown in the chart based on the earliest and latest dates found in the view). The CSV content does not change based on your selected start date or end date.
  • — Displays a Zero Day Details popup that enables you to select and view zero-day dates for which there was no document processed). You have the option hide weekend days.

Email Addresses Sent and Email Addresses Received

The Email Addresses Sent and Received reports enable you to see the top 10 email addresses associated with sent and received email. This can help you make decisions about emails that need to be reviewed more carefully based on the email addresses.

An Email Address Sent entry is based on the from and sender metadata fields.

An Email Address Received is based on the to, bcc, and cc fields.

From either the Email Addresses Sent or Email Addresses Received report, you can click the following:

  • — Enables you to download all available Email Address Sent or Received information to an XLSX file. The download file always contains all available data. By default, the file is called DigitalReefReport.xlsx, but you can select the appropriate name when you save the file.
  • — Displays with more information about the email addresses.