Ah, the thrilling world of eDiscovery! It's like being a digital detective, hunting down electronic treasures for legal proceedings. Imagine yourself in a high-stakes investigation, equipped with a magnifying glass and a really cool trench coat. Now, let's dive into the most popular types of eDiscovery search requests that'll have you feeling like Sherlock Holmes in the digital realm. From finding those juicy electronic documents for litigation to unearthing hidden data gems, we've got it all covered. So put on your investigator hat, grab a cup of virtual coffee, and get ready for some eDiscovery adventures!
Please note that the examples provided here are meant to offer guidance and assist you in formulating effective queries. However, your actual search may vary based on specific requirements and preferences. We recommend carefully reviewing the results to ensure they meet your quality standards. Please reach out to support@logikcull.com for any help or questions. Happy searching!
01: Boolean Searches and Wildcards
Boolean operators (AND, OR, NOT, +, -) and single or multi-character wildcards (* asterisk, ? question mark) can be used to combine multiple search terms or refine search queries. Users may employ Boolean searches to find documents that meet specific criteria or exclude certain terms.
Examples:
football OR basketball | Documents that contain the term football or basketball |
football basketball | Documents that contain the term football or basketball |
football AND basketball | Documents that contain both football and basketball |
football AND NOT basketball | Documents that contain football but do not contain basketball |
+football OR basketball | Documents that must contain football and may contain basketball |
basketball -football | Documents that contain basketball but not football |
bean* | Documents that contain beans, beanies, beanbags, etc. |
b?t | Documents that contain bat, bet, bot, bit, etc. |
Important Considerations:
Ensure your Boolean queries are capitalized, otherwise Logikcull will search for the actual text of the operator "and, or, and not," etc.
While boolean operators require uppercase, search terms themselves are case-insensitive, meaning that it does not distinguish between uppercase and lowercase characters.
Spaces between a group of words without quotes are treated with the OR search behavior. i.e. football basketball will have the same results as football OR basketball
Logikcull has a limit of 1,024 Boolean operators per individual search (and a separate limit of 40,000 characters per search). You may opt to break a large search up into separate saved searches, then search on the combined saved searches, as a work-around to this limit.
Visit our Boolean search tips FAQ for more information
02: Proximity Type Searches
Proximity Searching is an advanced search technique that can help make your search more specific and efficient in your projects. Proximity search is a method that focuses on the relative distance or proximity between terms within a document or a specified range of text. It allows users to search for terms that appear close to each other or within a certain distance. This is particularly useful when searching for phrases, identifying relationships, or analyzing context.
Examples:
(front back)~2 | Documents that contain front within 2 words of back |
(discover* contract*)~8 | Documents that contain discover, discovered, discovers, discovering, etc. within 8 words of contract, contracts, contracting, etc |
(mvp “super bowl”)~5 | Documents that contain mvp within 5 words of the phrase “super bowl” |
(front back)~2 AND ((back right)~3 OR (front right)~3) | Documents that contain front within 2 words of back and at the same time, term results are within 3 words of right. Nested proximity example. |
Important Considerations:
The proximity value takes into account the order or placement of the words (from left to right) therefore the search (front back)~2 may not necessarily return exact same records as (back front)~2 due to the shift of adjacent words required for the match. Option to combine searches in reverse order using the OR operator or increase the proximity value to retrieve desired results.
(front back)~2 OR (back front)~2 VS. (front back)~3Visit related FAQ on Proximity searching
03: Text, Metadata or Special Field Searches
Metadata fields such as the Text field in Logikcull contains valuable information about documents, such as creation dates, authors, file types, tags, special or newly imported fields and more. Users may request searches based on specific metadata fields to narrow down the search results.
Examples:
text:dog OR dog | Documents that contain dog |
file_id:0020f959bfcaf232568c15fb | Document with Logikcull Unique ID 0020f959bfcaf232568c15fb |
email_sender:((joe cull)~3 OR joe.cull@company.com) | Documents with the value joe within 3 words of cull or the email address joe.cull@company.com in the Email Sender field. |
file_name:"My first search in Logikcull.doc" OR file_name:(search logikcull)~3 | Documents with the exact file name matches My first search in Logikcull.doc or file names where search is within 3 words of logikcull |
(file_path:"work folder" OR file_path:(personal folder)~3) AND document_type:Presentation | Documents having the exact value work folder in the File Path field or where personal is within 3 words of folder and Document Type field have the value Presentation |
tags:Responsive AND NOT tags:Privilege | Documents marked Responsive and not Privilege |
File_duplicate:false | Documents that are completely unique in Logikcull |
horizontal_duplicate:true | Documents identified as standalone or family-level duplicates that are not shown (sequestered) while in Global Dedupe view. Results may only be available while in No Dedupe view. |
vertical_duplicate:true | Documents identified as standalone or family-level duplicates that are not shown (sequestered) while in Custodian Dedupe view. Results may only be available while in No Dedupe view. |
custodian_name:"Joe Cull" | Documents with the value Joe Cull in the Custodian field |
processing_flag:Ocred | Documents marked OCRed |
family_status:"Is Parent" | Documents identified as Parent in Logikcull |
exports.download_name:"PROD 001" | Documents belonging to the production or download name PROD 001 |
_exists_:thread_id | Documents with a non-null value in the Email Thread ID field. The _exists_: portion of the syntax can be added to other fields in Logikcull. Eg. _exists_:fieldName |
email_fields.ipm_type:IPM.Appointment OR email_fields.ipm_type:IPM.Note | Documents that are MSFT Outlook appointment or calendar files |
Important Considerations:
Run a search against the Text field to find keywords captured/indexed in the body of a document. Note that Text field is the default field searched if no specific metadata fields are entered therefore the search text:dog will have the same results as the search for dog.
Become familiar with Logikcull's searchable metadata fields as well as imported new fields migrated from other platforms.
Use Logikcull's file ID field to find specific documents based on a unique Logikcull ID assigned.
Explore using quotes or proximity type search with metadata fields
Use parentheses, quotes, wildcards or proximity search to build complex or nested parameters.
Use the tags field to search documents with specific tags or combination of tags
Use Logikcull's duplicate field to search for documents that are the first or only copy of a document.
Test your searches, review results and use the Clear button when necessary to start a new search.
04: Multiple Keyword Searches
Users may request searches based on specific keywords or phrases that are relevant to the case or investigation. This involves searching for documents containing those keywords within a specified scope.
Examples:
(football OR basketball OR "super bowl" OR teamwork OR team* OR wom?n OR (jo* cull)~3 OR ("mary jane" cull)~3 OR progra*ing) | Documents with football, basketball, super bowl, teamwork or teammate or teamsite or teamtalk etc. or women or woman or joe cull or joseph cull or jonathan cull etc., or mary jane cull or programing or programming |
Important Considerations:
Use multi or single character wildcards to capture various word forms or spelling variations.
Encapsulate a group of words or a phrase with double quotes " " to search exactly that combination of words.
Use proximity type search to find words within a specific distance of one another.
05: PII Searches
Users may request PII searches to ensure compliance with data protection regulations, protect privacy rights, minimize data exposure, respond to data subject access requests, and mitigate the risk of data breaches. By proactively addressing PII concerns during eDiscovery, organizations can uphold legal obligations, respect individuals' privacy, and maintain data security throughout the legal process.
Examples:
(ssn "???-??-????")~3 OR "social security number" OR SSN OR (soc sec no)~3 OR (social security number*)~3 | Documents with ssn within 3 words of a social security number typical format separated by hyphen or social security number or ssn or soc sec no or the terms social security number within 3 words of each other |
imported_fields.field_name:(drivers license)~3 OR (DL no)~3 OR (state id)~3 | Documents with drivers within 3 words of license or DL within 3 words of no or state within 3 words of id populated in a imported new field |
“123-44-6789” OR imported_fields.field_name:(123 44 6789)~3 | Documents with 123-44-6789 in the Text/Body field or 123 44 6789 within 3 words of each other populated in a imported new field |
Important Considerations:
Use Bulk Keyword Search feature to run, compare results and refine your PII search terms using boolean operators, wildcards and proximity searches
Leverage Logikcull's PII Detection to identify PII content/patterns that can be incorporated into your search syntax
Explore running PII searches against other fields in Logikcull such as newly imported fields
06: Date or Date Range Searches
Users may need to search for documents within a specific date or a date range to focus on relevant information during a particular time period. Here’s an example date range syntax
fieldName:[startDate TO endDate]
Replace fieldName with the name of the field containing the date values you want to search within. startDate and endDate should be in the format YYYY-MM-DD or any other valid date format.
Other examples:
family_date:2023-03-15 | Documents where Family Date field is on March 15, 2023 |
document_date:>=2023-01-01 | Documents where Document Date field is on or after January 1, 2023 |
email_fields.time_sent:<=2023-01-01 | Documents where Email Sent Date field is on or before 01/01/2023 |
family_date:[2022-08-01 TO 2022-12-31] | Documents where Family Date is between August 1, 2022, and December 31, 2022 |
family_date:>=2022-08-01 AND family_date:<=2022-12-31 | Documents where Family Date is on or after August 1, 2022, and on or before December 31, 2022 |
family_date:[2022-01-01 TO *] | Documents where Family Date is equal to or later than January 1, 2022 |
family_date:[* TO 2022-12-31] | Documents where Family Date is earlier than or equal to December 31, 2022 |
document_date:0 | Documents with invalid or no dates |
Important Considerations:
Use Logikcull’s Family date field to account for grouping of documents such as emails and their attachments. Family date searching allows you to assess the context and interdependencies of documents, helping you determine their importance to the case or investigation. This can be useful for identifying key communications, establishing patterns, or spotting inconsistencies.
Explore searching against all available Logikcull Date fields such as Email Sent Date, Email Received Date, and File Creation Date.
Sort documents in chronological order based on the individual document or family date, oldest to newest (asc)* or newest to oldest (desc)* to review and verify search results
Consider expanding date range searches for one day to account for time zone differences
07: Name Searches
Users may request searches for a specific person’s name or email address to identify relevant or privileged documents.
Examples:
"Joe Cull" | Documents with exact match for the name Joe Cull |
(Jo* Cull)~3 | Documents with Joe or John or Jonathan or Johnathan within 3 words of Cull |
Documents with the email address joe.cull@company.com | |
email_sender:(“Joe Cull” OR (Jo* Cull)~3) | Documents with exact match for the name Joe Cull or Joe or John or Jonathan or Johnathan within 3 words of Cull in the Email Sender field |
file_fields.author:(Jo* Cull)~3 | Documents with Joe or John or Jonathan or Johnathan within 3 words of Cull in the File Author field |
("Joe Cull" OR (Jo* Cull)~3 OR joe.cull@company.com) OR email_sender:(“Joe Cull” OR (Jo* Cull)~3 OR joe.cull@company.com) | Documents where the Text field or Email Sender field contain Joe Cull or name variations beginning with Jo* using the multi-character wildcard within 3 words of Cull or the email address joe.cull@company.com |
Important Considerations:
Research and identify all possible formats or variations of a person's name/contact for searching such as nicknames, alternative email addresses to avoid missing relevant documents.
Use category filters such as Email From or Email To in order to help identify other variations of the name or email address.
Use quotes to find the exact match of the names, if necessary.
Use single (?) or multi-character (*) wildcard, or explore using fuzzy searching to account for different spellings or variations of the name. This may come useful for handling typographical errors, accommodating different language variants, dealing with incomplete information, and increasing search recall.
Use proximity type searches where necessary to find a person's first name within a specific distance of their last name to also account for name variations.
Search for names in other metadata fields such as Email Sender or File Author in addition to the Text field
Use parentheses where necessary to help group different search methods for the name
08: Email Sender/Recipient Searches
Users may request searches for emails or other communication records involving specific senders or recipients who are relevant to the case.
Examples:
(email_sender:((Joe Cull)~3 OR joe.cull@emailAddress.com) AND ONLY email_recipients:((Jane Cull)~3) OR jane.cull@emailAddress.com) OR (email_sender:((Jane Cull)~3 OR jane.cull@emailAddress.com) AND ONLY email_recipients:((Joe Cull)~3 OR joe.cull@emailAddress.com)) | Email documents where Email Sender have the name Joe Cull or the email address joe.cull@emailAddress.com and where Email To, CC or BCC ONLY have the name Jane Cull or the email address jane.cull@emailAddress.com or vice versa.
|
(email_sender:((Joe Cull)~3 OR joe.cull@emailAddress.com) AND ONLY email_fields.smtp_to:((Jane Cull)~3) OR jane.cull@emailAddress.com) OR (email_sender:((Jane Cull)~3 OR jane.cull@emailAddress.com) AND ONLY email_fields.smtp_to:((Joe Cull)~3 OR joe.cull@emailAddress.com)) | Email documents where Email Sender have the name Joe Cull or the email address joe.cull@emailAddress.com and where Email To field ONLY have the name Jane Cull or the email address jane.cull@emailAddress.com or vice versa. |
ONLY email_recipients:((joe cull)~3 OR joe.cull@emailAddress.com) | Email documents where joe cull or the email address joe.cull@emailAddress.com is the ONLY metadata in the Email From/To/CC/BCC fields |
email_participants:((Joe Cull)~3 OR joe.cull@emailAddress.com) | Email documents where Joe is within 3 words of Cull or the email address joe.cull@emailAddress.com is in the Email From/To/CC/BCC fields |
Important Considerations:
Similar to name searching, research and identify all possible formats or variations of a person's friendly name or SMTP email address such as nicknames, alternative email addresses to avoid missing relevant documents.
Use category filters Email From or Email To to help identify email address variations of the sender and recipient
Use single (?) or multi-character (*) wildcard, or explore using fuzzy searching to account for different spellings or variations of the name
Use proximity type searches where necessary to find person's first name within a specific distance of their last name to also account for name/email address variations
Explore searching against Logikcull’s Email metadata fields such as Email From or Email Sender or Recipients (aka Email Participants)
Use the ONLY operator to match only a given value where applicable. Visit ONLY Searches FAQ for additional information
NOTE: ONLY operator searches are available on native documents that are processed by Logikcull (File Uploads and Cloud Uploads). Database Uploads with imported metadata are ineligible.
The fields in which an ONLY operator can be used as a modifier are:
email_fields.to
email_fields.smtp_to
email_fields.cc
email_fields.smtp_cc
email_fields.bcc
email_fields.smtp_bcc
email_fields.domains
email_fields.recip_domains
email_fields.recipient_emails
Email_recipients
09: Logikcull User Work Product Searches
Users may request for reviewers' work product activity in Logikcull. This enables the team to assess the quality of the review, provide feedback and training, maintain defensibility, conduct quality assurance checks, and gain insights into the review process. It also enhances the efficiency and effectiveness of eDiscovery, ensuring that the final results are accurate, consistent, and legally defensible.
Examples:
notes:important | Documents with important in the Logikcull Document Notes field |
comments.body:critical | Documents with critical in the Logikcull Document Comments field |
notes:(pro feature)~3 OR comments.body:(sensitive information)~3 | Documents where pro is within 3 words of feature in the Logikcull Document Notes field or documents where sensitive is within 3 words of information in the Logikcull Document Comments field |
comments.created_by_name:Rufert comments.created_by_name:Revuwer comments.created_by_name:”Rufert Revuwer”
| Documents with Logikcull Document Comments created by a user’s first name Rufert, or last name Revuwer or the exact first and last name |
comments.created_at:02/16/2023 | Documents with Logikcull Document Comments created on February 16, 2023 |
updates.user_email:rufert.revuwer@company.com | Documents that had any updates applied by a user with the email address rufert.revuwer@company.com |
updates.new_tags:Responsive AND NOT updates.old_tags:Responsive AND updates.happened_at:[2022-01-01 TO 2022-12-31] AND updates.user_email:rufert.revuwer@company.com | Documents that had an update between January 1, 2022 and December 31, 2022 that wasn’t tagged Responsive prior but now are tagged Responsive |
10: Search on Saved Searches
Searches can be saved in Logikcull and users may request to run searches against existing saved searches.
saved_search_name:"my first saved search 001" | Run a saved search titled my first saved search 001 |
saved_search_id:6888265 | Run a saved search using the Advanced Search Builder and using the Saved Search field. The search ID will be displayed in the syntax after executing the search. |
saved_search_name:(SavedSearch001 OR SavedSearch002) AND NOT saved_search_name:SavedSearch003 | Run and combined two saved searches titled SavedSearch001 and SavedSearch002 and at the same time, exclude results from another saved search titled SavedSearch003 |
Important Considerations:
Use short and unique naming convention for your saved searches to avoid ambiguous search name that can potentially map to more than one search
Use quotes as necessary to find the exact match of the saved search name
Saved searches that are locked and display static results can be unlocked for updates and re-lock
Check out our FAQ on Accessing and Editing Saved Searches for more information
11: Logikcull Unique ID and Production Bates Number Searches
Unique identifier or Bates number searching plays a vital role in eDiscovery, bringing efficiency and organization to the process. It serves as a valuable tool for tracking and locating specific documents throughout the legal journey. By assigning a unique identifier to each document, it simplifies the task of identifying, preserving, and collecting electronic evidence.
With Bates numbers in place, the often overwhelming task of sifting through numerous electronic files becomes more manageable. It ensures that relevant documents can be easily retrieved and referenced during litigation or investigations. By providing a structured system, Bates numbering helps maintain order and clarity amidst the sea of digital information.
In Logikcull each document automatically receives a unique identifier and also corresponds to Bates numbers if assigned either within Logikcull known as Download Doc IDs or outside of Logikcull known as Imported Bates Numbers. Logikcull makes it easy to find a document’s Bates numbers stored in both places using our Universal Bates Search field called Bates Number.
To search for production Bates numbers in Logikcull, you first need to determine how production Bates were generated before you run the search. Note that some documents have assigned Bates numbers stored in the File Name field or only available in the extracted or OCR body Text field.
11a: Searching for Logikcull Unique ID RANGES
To search for a range of Document IDs, you can use the search field file_id: and combine your list of unique IDs in a search by wrapping them in parentheses, separating each ID with a space.
For example, to search for a range of document IDs, use a search structured like this:
(file_id:0020f959bfcaf232568c15fb 0030f929bfcaf232568c15fa 0150f959bfgaf232558c15lp 0910f959bfxdp232568c25am)
11b: Searching for Bates RANGES
To search for a range of Bates numbers, you can use the search field bates: and combine your list of unique IDs in a search by wrapping them in brackets, separating the range endpoints with the word TO.
For example, to search for a Bates range of documents numbered 01 to 50, use a search structured like this:
bates:[CTRL0000001 TO CTRL0000050]
Examples:
file_id:0020f959bfcaf232568c15fb | Document with Logikcull Unique ID 0020f959bfcaf232568c15fb |
bates:CTRL0000001 | Document with a Logikcull download doc id or Imported Bates CTRL0000001
|
bates:[CTRL0000001 TO CTRL0000050] | Documents with a Logikcull download doc id or Imported Bates between CTRL0000001 and CTRL0000050 |
bates:CTRL* | Documents with a Logikcull download doc id or Imported Bates numbers starting with the prefix CTRL |
bates:(CTRL0000001 CTRL0000010 CTRL0000020) | Documents with a Logikcull download doc id or Imported Bates CTRL0000001 or CTRL0000010 or CTRL0000020 |
tags:Responsive AND NOT bates:PRODBATES* | Documents tagged Responsive that are not assigned with a Logikcull download doc id or Imported Bates number beginning with prefix PRODBATES* |
exports.download_name:PROD003 | Documents produced in Logikcull with a Download volume name PROD003 |
file_name:BATES000001 | Documents with BATES000001 in the File Name field |
CTRL0000001 | Documents with CTRL0000001 in the Body Text field in Logikcull |
Important Considerations:
If you’re unsure how Bates numbers are assigned in your project, option to run a combination of example searches above. (CTRL0000001 OR file_name:CTRL0000001 OR bates:CTRL0000001)
Leverage the use of Bulk Keyword search to run multiple Bates number searches at once
Note that the Bates number value in your search needs to be an exact match of the Bates number stored in Logikcull
Use single or multi character wildcard if your unsure of the Bates prefix numbering scheme
If data sets don’t currently have Bates number assigned and only Logikcull Unique ID is available, option to run a download to assign Bates or Control numbers without exporting any images, natives or text files.
12: Complex Searches
Users may request for complex searches that involve the use of various search operators, Boolean logic, multiple + nested proximity operators, wildcards, and other techniques to find specific information within large volumes of electronically stored information (ESI). These searches go beyond simple keyword searches and allow for more precise and targeted retrieval of relevant documents during the eDiscovery process.
Examples:
(((contract* OR agreement*) AND (breach OR violation)) AND (family_date:>=2019-01-01 AND family_date:<=2022-12-31)) AND ((document_type:Email) AND NOT (confidential OR privileged)) AND (tags:Responsive AND NOT tags:privilege) | Explanation: This search query demonstrates the use of various operators and search criteria to conduct a complex search in eDiscovery
Boolean operators: The query uses the AND operator to specify that both "contract" and "agreement" must be present in the document. Similarly, it uses the OR operator to include documents containing either "breach" or "violation".
Date range: The query includes a date range criterion using the "date" field. In this example, it searches for documents created between January 1, 2019, and December 31, 2022. The ">=2019-01-01" condition specifies that the document date should be greater than or equal to January 1, 2019, and the "<=2022-12-31" condition ensures that the document date is less than or equal to December 31, 2022.
Inclusion and exclusion criteria: The query specifies that the search should focus on documents that are made up of emails using the field Document Type. It also uses the NOT operator to exclude documents that contain the terms "confidential" or "privileged". Lastly, the scope of the results is limited to the number of documents marked Responsive only and excludes items marked Privilege.
By combining these elements, this complex search query aims to retrieve documents that meet specific criteria. |
processing_flag:"not rendered" AND NOT (file_duplicate:true OR processing_flag:("protected" OR "has virus" OR "zero bytes")) | Explanation: This search query can help identify documents (if any) that may warrant a re-render request with the Logikcull support team.
Documents marked Not Rendered in Auto Tags filter and at the same time excludes items that are duplicates, password protected, has virus, and zero bytes (empty) files.
|
Important Considerations:
When dealing with very long, complex search syntax, keep in mind Logikcull has a limit of 1,024 Boolean operators per individual search (and a separate limit of 40,000 characters per search). You may opt to break a large search up into separate saved searches, then search on the combined saved searches, as a work-around to this limit.
Break down your search terms: Complex search terms can often be overwhelming. Break them down into smaller, more specific components or keywords. This will make it easier to conduct targeted searches and track relevant results.
Maintain a record or spreadsheet to track your search queries, results, and any tweaks you make along the way. This will help you stay organized, compare different sources, and easily refer back to previous search queries if needed.
Use Logikcull’s Bulk Keyword Search + Build Search Report to generate a detailed CSV file of your search terms which includes, Document Count, Page Count, Family Count and Unique Hit Document Count.
Related FAQ articles: