<Tag Name>

Each tag created in CloudNine™ Explore and CloudNine™ Explore Web is included in the .General\Tags category.

ex: Confidential

ex: Relevant

Application

Application used to create the document.

ex: Microsoft Office PowerPoint

EDocuments.DocApplicationName

AppointmentEnd

Appointment end date and time for calendar/appointment items. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (ApptEnd):

20140313

ex (TmApptEnd):

22:15:00

ex (EDRM):

2014-03-13T22:15:00

ApptEnd

TmApptEnd

Emails.AppointmentEnd

AppointmentStart

Appointment start date and time for calendar/appointment items. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (ApptStart):

20140313

ex (TmApptStart):

23:00:00

ex (EDRM):  

2014-03-13T23:00:00

ApptStart

TmApptStart

Emails.AppointmentStart

AppointmentType

Appointment type

Meeting

Appointment

ApptType

EmailAppointments table

Attach

Semi-colon-delimited list of filenames of the (top-level) attached files.

ex: UserGuide.pdf;HelpFile.chm

#AttachmentNames

Emails.Attach

AttachList

Populated for parent records only, this field contains a semi-colon-delimited list of export numbers for the parent and each attachment record. In the example, A0001 is the parent and A0002 and A0003 are attached to A0001.

ex: A0001;A0002;A0003

Generated at time of export

Attachments

Semi-colon-delimited list of filenames of the (top-level) attached files.

ex: UserGuide.pdf;HelpFile.chm

#AttachmentNames

Emails.Attach

AttachParent

Export number of the (top-level) parent document. Applied to all members of the family.

ex: A0001

Generated at time of export

AttachRange

Export numbers of the parent document and the last attachment in the family, separated by a hyphen. Field is empty for records that are not part of a parent/attachment relationship.

ex: A0001 - A0003

Generated at time of export

Author

Author field value extracted from the metadata of the native file during analysis.

ex: John Smith

#Author

EDocuments.DocAuthor

BCC

Recipient(s) of "Blind Carbon Copies" of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@cloudnine.com>

#BCC

Emails.Bcc

BusinessAddress

Business address for contact

BusAddress

EmailContacts.BusinessAddress

BusinessPhone

Business phone number for contact

BusPhone

EmailContacts.BusinessPhone

BusinessPhone2

Secondary business phone number for contact

BusPhone2

EmailContacts.BusinessPhone2

Case

Name of the CloudNine™ Explore case from which the files were exported.

ex: MyEdaCaseName

CaseProperties.Name

Categories

Category field value extracted from metadata of the native file.

ex: Software

#Categories

EDocuments.DocCategory

CC

Recipient(s) of "Carbon Copies" of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

#CC

Emails.Cc

CellularPhone

Cellular phone number for contact

CellPhone

EmailContacts.CellularPhone

Client

Client name specified on the General tab in the New or Edit Case Settings dialog box.

ex: ClientMatter_01

EDA_Management:

EdaCaseListings.Client

EdaCaseListings.Name

CodePage

Numeric value that specifies the character set used in the file.

ex: 1252

Emails.CodePage

Comments

Comments field value extracted from the metadata of the native file.

ex: Paragraph needs updated info.

#Comments

EDocuments.DocComments

Company

Company name for contact

EmailContacts.Company

CompressedSize

Populated for items that were contained within certain archive types (e.g. not populated for 7zip items), this field contains the compressed size of the file in bytes.

ex: 2977792

CompSize

InventoryItems.CompressedSize

ContactEmail

Email address for contact

ContactEml

EmailContacts.ContactEmail

ContactEmail2

Secondary email address for contact

ContactEml2

EmailContacts.ContactEmail2

ContainerPath

For documents extracted from a Microsoft Outlook or Lotus Notes mail store, archive, or forensic image container file, the path of the document as it exists in its immediate parent container file.

For example, if there is a .pst file containing the folder structure Inbox\ProjectA\email.msg, the ContainerPath value for the email.msg file would be:

Inbox\ProjectA

ex: Inbox\FollowUp

ContainPath

ContainerPath

InventoryItems.CompositeName

ConversationId

Microsoft-specific value used to identify an e-mail conversation.

ex: 01CF5D946F4EFD65607202

ConvId

Emails.ConversationID

ConversationIndex

Microsoft-specific value used for tracking position of an email within a conversation. This value is used during the process of email threading.

ex: 0101CF602E916BDDE035F5FB3D47A8D8D2

D6F92CC769

ConvIndex

Emails.ConversationIndex

ConversationTopic

Normalized subject of emails.

ex: Priorities for 2013

ConvTopic

Emails.ConversationTopic

Created

File creation date and time extracted from the metadata of the native file during analysis. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

If the Created date metadata is not available,  this field will be populated with date information from the parent hierarchy or the file system if no parent exists.

ex (Created):

20140225

ex (TmCreated):

15:48:53

ex (EDRM):

2014-02-25T15:48:53

Created

TmCreated

#DateCreated

EDocuments.DocCreated

Custodian

Textual custodian value assigned by the user on the Import tab.

ex: Smith, John

Custodians.Name

DateFilterLowerBound

For emails, this field contains the sent date of the message, split into two fields in the load file: DF_LBound (date in YYYY/MM/DD format) and TmDF_LBound (time in HH:MM:SS 24-hour time format, GMT). For calendar / appointment items, these fields hold the appointment start date and time. For e-documents, the earlier of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (DF_LBound):

20061225

ex (DAT) (TmDF_LBound):

21:55:00

ex (EDRM):

2006-12-25T21:55:00

DF_LBound

TmDF_LBound

DateFilterLowerBound

DateFilterUpperBound

For emails, this field holds the sent date of the message, split into two fields in the load file: DF_UBound (date in YYYY/MM/DD format) and TmDF_UBound (time in HH:MM:SS 24-hour time format, GMT). For calendar / appointment items, these fields hold the appointment end date and time. For e-documents, the more recent of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (DF_UBound):

20081225

ex (DAT) (TmDF_UBound):

22:05:00

ex (EDRM):

2008-12-25T22:05:00

DF_UBound

TmDF_UBound

DateFilterUpperBound

DateSource

Indicates where the document created and modified dates were obtained.

Possible values:

1=File System

2=Parent

3=Mapi Properties

4=Archive Entry

5=Metadata

EDocuments.DateSource

Decrypted

Indicates whether a file was decrypted during import.

Possible values (DAT):

0 or No=File was never encrypted OR file was encrypted and could not be decrypted

1 or Yes=File was successfully decrypted

InventoryItems.Decrypted

Delegator

Person who assigned the task

EmailTasks.Delegator

DelivReceipt

Indicates whether the option to request a delivery receipt was enabled in the email message.

Possible values:

0=No receipt requested or non-mail item

1=Delivery receipt requested

Emails.DelivReceipt

DepartmentName

Department name for contact

DeptName

EmailContacts.DepartmentName

Directory

Path to the original folder/location of the source file. For each item that originated in a mail store, the Directory will list the path to the mail store.

ex: C:\Data

Directories, InventoryItems.DirectoryId

DisplayName

Full name field from Outlook contact

EmailContacts.DisplayName

DistributionListMembers

Distribution list member names and email addresses separated by semicolons

MemberName1 <EmailAddress1>; MemberName2 <Email Address 2>

DistListMbrs

DistributionListMembers.MemberName

DistributionListMembers.EmailAddress

DocumentType

ID number associated with the native file type (provided by third-party file identification engine).

ex: 2209

InventoryItems.FileType

DupCustNames

Names of the custodians containing duplicate versions of the original record. Populated for parent duplicates/original records only.

ex: FirstCustodianName; SecondCustodianName

Generated at time of export

DupCustPaths

Source path to each duplicate version of the original record. Populated for parent/original records only.

e-doc ex:

CustName\Folder01\Folder02

email ex:

CustName\Mail-Stores\Archive.pst\Inbox

Generated at time of export

DupId

Contains the EdaId value of the original record in a duplicate relationship (the original and all associated duplicates are assigned the same value).

ex: 42

Generated at time of export

DupParentName

Custodian name of the original record. Populated for duplicate records only.

ex: ParentCustodianName

DupPrntName

Generated at time of export

DupParentPath

Name of the custodian containing the original record. Populated for duplicate records only.

e-doc ex:

CustName\Folder01\Folder02

email ex:

CustName\Mail-Stores\Archive.pst\Inbox

DupPrntPath

Generated at time of export

EdaId

Unique value for each record in a CloudNine™ Explore case - assigned by CloudNine™ Explore during analysis.

ex: 1

InventoryItems.ID

EDFolderPath

Relative path to source files (if e-docs or loose e-mail) or relative path and folder path contained within a mail store (if NSF or PST).

edocs = folder\folder\folder

emails = folder\mailstore\folder\folder

EdFolderPath

Generated at time of export

EmailClient

Email client used to send the email message (information not always available).

ex: outlook

Emails.EmailClient

EmailSubject

Subject line from the email message.

ex: FW: Priorities for 2013

#Subject

Emails.Subject

Encrypted

Indicates whether a file is encrypted.

Possible values:

0 or No=File was never encrypted OR file was encrypted and could not be decrypted

1 or Yes=File is encrypted

InventoryItems.Encrypted

EntryId

Unique identifier of emails in mail stores.

ex: 000000003DE46CC0FC76C04187C0BB41FBE

BB063E4002000

Emails.EntryId

ET_Inclusive

Flags a minimal set of emails which can be viewed in order to read the email message thread's entire conversation. In the simplest case this will simply be the last message in the thread, since it will quote all the previous messages.

Possible values (DAT):

0=Not inclusive

1=Inclusive

Possible values (EDRM):

No=Not inclusive

Yes=Inclusive

Threading.ThreadIndex.inclusiveMessage

Threading.ThreadIndex.inclusiveAttachment

Threading.Messages.GroupID

ET_InclusiveReason

If ET_Inclusive field is set to Yes or 1, ET_InclusiveReason field indicates why the email is inclusive. If the email message contains message content that is not copied in any of its subsequent replies or forwards, Message is displayed. If the email message has attachments that are not included in any of its subsequent replies or forwards, Attachment is displayed. If the email message has both new message content and new attachments not included in any of its subsequent replies or forwards, Message, Attachment is displayed. If ET_Inclusive field is set to N, ET_InclusiveReason field is blank.

Possible values:

Message

Attachment

Message,Attachment

ET_IncReason

Threading.ThreadIndex.inclusiveMessage

Threading.ThreadIndex.inclusiveAttachment

ET_Indent

Indicates the indent level of the email message in relation to the first email in the email thread associated with the email message.

Possible values:

0=First email in the email thread

1=Replies to first email

2=Replies to replies to first email

3=Replies to replies to replies to first email...and so on.

ET_Indent

ET_Indent

Calculated by counting the number of periods in the ET_ThreadIndex field value.

ET_IsMessage

Indicates whether the document was recognized as an email message.

Possible values (DAT):

0=Not an email

1=Identified as an email

Possible values (EDRM):

No=Not an email

Yes=Identified as an email

Generated at time of export (multiple conditions apply)

ET_MessageId

Unique ID that is assigned to each message. If several documents have the same Message ID, it is because they were recognized as separate copies of the same email message.

ex: 00000001

Threading.Messages.GroupID

ET_ParentId

The immediate parent of the current email in the thread. For the first message, this will be blank. For each subsequent one, it will be the EdaId / InventoryItems.ID (padded with zeroes to make eight characters) of the email which it replies to or is a forward of. For attachments, ET_ParentID indicates the email to which it is attached.

ex: 00000013

Threading.ThreadIndex.index

ET_ThreadId

A unique ID assigned to each message thread.

ex: 00000004

Threading.ThreadIndex.Thread

ET_ThreadIndex

Composed of a base ID, plus a unique number for each message within the thread, and if there are attachments, the letter A plus the unique number for the attachment within the thread. For example, A1, A2, A3. Uses the format: [base ID].[unique number for message].A[unique attachment number]. The base ID is the same as the thread ID without the leading zeros. The thread index for the root message of the thread will just be this.

ex: 4.1.2.3.4.5.6.7

ET_ThrdIndex

Threading.ThreadIndex.index

ET_ThreadSize

The total number of unique messages in the thread.

ex: 7

ET_ThrdSize

Threading.ThreadIndex.threadSize

ET_ThreadSort

A sort order which follows the chain of conversation, from first message to most recent. If a conversation splits into multiple branches, ET_ThreadSort will keep each of the branches together.

ex: 1

ET_ThrdSort

Threading.Threads.Sort

ExportNativeFileTitle

The name of the native file that was exported. If the user selects to copy native files to the export directory in Export Configuration.

ex:00000010.ntv.pdf

NativeFile

<File FileType="Native">

ExportItems.ExportNativeFileTitle

ExportNumber

Based on the user-defined starting number specified in the Export # field on the Export tab, this value increments by one for each record in the load file.

ex: ABC000001

ExportItems.ExportNumber

ExportPath

The sub-directory below the ExportDirectory (specified in Export Configuration) where the native file or text file was placed.

ex: 001

Included in NativeFile and TextPath

Included in Native and Text ExternalFile path

ExportItems.ExportPath

ExportTextFileTitle

The name of the text file that was exported. If the user selects to copy native files to the export directory in Export Configuration.

ex:00008393.txt

TextPath

<File FileType="Text">

ExportItems.ExportTextFileTitle

FamilyParentDocumentGuid

The unique identifier of the family parent of this document.

ex: 3CA859A0-2786-4A93-A6C3-DC8C9C24EBB8

FamilyParent

FamilyParentDocumentGuid

InventoryItems.FamilyPid

FileDescription

Text file type description of native file (provided by third-party file identification engine).

ex: MS Excel 2007-2010 Spreadsheet (Open XML)

FileDescript

InventoryItems.FileTypeDesc

FileExtension

File extension of the native file. The value will be "lnd" for Lotus Notes documents (e.g. emails in an NSF).

e-doc ex:

docx

email ex:

msg

FileExt

#FileExtension

InventoryItems.Filename

FileName

Filename of the native file.

e-doc ex:

TrainingManual.docx

email ex:

Training Opportunities.msg

#FileName

InventoryItems.Filename

FileType

ID number associated with the native file type (provided by third-party file identification engine).

ex: 2209

InventoryItems.FileType

FileUri

Used internally by the system to retrieve mail store items for exporting and viewing native files.

ex (Lotus Notes email): note-id://D2D09967C7679B3E8625711400748A11

InventoryItems.CompositeURI

FlagDueBy

Date/time when action/follow-up is required for message

Emails.FlagDueBy

FlagIcon

Indicates if a flag icon (follow-up flag) was set for a message, and if so, what color

6

Emails.FlagIcon

FlagStatus

Follow-up flag value for message

Marked

Emails.FlagStatus

From

Sender of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

#From

Emails.From

FromDomain

Domain portion (only) of the sender's email address.

ex: CloudNine.com

Emails.Domain

GovernmentId

Government ID number for contact

EmailContacts.GovernmentId

GUID

Global unique identifier for a document.

InventoryItems.GUID

HasAttachments

Indicates whether a record has attachments or not.

Possible values:

0 or No=Does not have attachments

1 or Yes=Does have attachments

HasAttach

#HasAttachments

InventoryItems.HasChildren

HasComments

Indicates whether comments exist in the Microsoft Word, Microsoft PowerPoint, or Microsoft Excel native file, or whether sticky notes exist in the Adobe Acrobat PDF native file.

Possible values:

0 or No=No comments exist or setting was not enabled during analysis

1 or Yes=Comments exist within the document

EDocuments.DocHasComments

HasDuplicate

Indicates if the record is an original record and has duplicates in the case.

Possible values:

0 or No=Duplicate file OR file is not in a duplicate relationship

1 or Yes=Original file - duplicates of this record exist in the case

Generated at time of export

Hash

MD5 or SHA-1 hash of the email or edocument, depending on Deduplication Mode setting at time of import.

ex: F99E31814864692B6BDD6C10C30B5A55E5A

FD4E8

InventoryItems.Hash

HasHiddenRowsCols

Indicates whether the native Microsoft Excel file contains hidden row(s) or column(s).

Possible values:

0 or No=Does not contain a hidden row or column or setting was not enabled during analysis

1 or Yes=Contains hidden row(s) and/or column(s)

HasHidRowCol

EDocuments.DocHasHiddenRowsCols

HasHiddenSheets

Indicates whether the native Microsoft Excel file contains hidden sheet(s).

Possible values:

0 or No=Does not contain hidden sheets or setting was not enabled during analysis

1 or Yes=Contains hidden sheet(s)

HasHidShts

EDocuments.DocHasHiddenSheets

HasHiddenSlides

Indicates whether the native Microsoft PowerPoint file contains hidden slide(s).

Possible values:

0 or No=Does not contain hidden slides or setting was not enabled during analysis

1 or Yes=Contains hidden slide(s)

HasHidSlides

EDocuments.DocHasHiddenSlides

HasSpeakerNotes

Indicates whether the native Microsoft PowerPoint file contains speaker note(s).

Possible values:

0 or No=Does not contain speaker notes or setting was not enabled during analysis

1 or Yes=Contains speaker note(s)

HasSpkrNotes

EDocuments.DocHasSpeakerNotes

HasText

Indicates whether the exported native file has associated text in the export folder. If "Include text" is selected, the value will be "0" (DAT) or "No" (EDRM) for each record.

Possible values:

0 or No=Include Text was not enabled or record does not have text

1 or Yes=Native file has associated text

InventoryItems.ContentStatus >1

HasTrackedChanges

Indicates whether the Microsoft Word or Microsoft Excel file contains tracked change(s).

Possible values:

0 or No=Does not contain tracked changes or setting was not enabled during analysis

1 or Yes=Contains tracked change(s)

HasTrackChgs

EDocuments.DocHasTrackedChanges

Headers

Contents of the header extracted from the email message (not always present in email messages).

#Headers

Emails.Headers

HomeAddress

Home address for contact

EmailContacts.HomeAddress

IconIndex

Used in Exchange to determine which icon to display (e.g. MailUnread).

ex: 4294967295

Emails.IconIndex

Importance

Value of the Importance flag contained in the email message.

Low

Normal

High

None

Note: The SQL database codes these values as numbers. Low is 0, Normal is 1, High is 2, and None is 3.

#ImportanceFlag

Emails.Importance

Imported

Date/time (UTC) the file was imported into the CloudNine™ Explore case, split into two fields in the load file: Imported (date the file was imported) and TmImported (time the file was imported).  In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Imported):

20140203

ex (DAT) (TmImported):

17:04:05

ex (EDRM):

2014-02-03T17:04:05

Imported

TmImported

InventoryItems.Created

ImportSet

Session name specified on the Import tab.

ex: Import Set 001

ex: 2013-2-13-001

ImportSessions.Label

Sources.ImportSessionId

InReplyToId

IntMsgID of the e-mail replied to.

ex: <F9AC00709876F64091943726669AFC9875

4D6CA6@retda2mbxp006.legal.regn.net>

Emails.InReplyToId

IntMsgID

Internet Message ID assigned to an e-mail message by the outgoing mail server.

ex: <BE8445B04466714283760D9A95ED6A731B

12E707@RETDA2MBXP002.legal.regn.net>

Emails.IntMsgId

IsAllDayEvent

Indicates whether the appointment is all-day

0 or No

1 or Yes

IsAllDayEvnt

EmailAppointments.IsAllDayEvent

IsArchiveItem

Indicates whether the native file was contained with an archive (e.g. 7zip) when imported into the CloudNine™ Explore case.

Possible values:

0 or No=Native file was not contained in an archive when imported

1 or Yes=Native file was contained in an archive when imported

IsArcItem

InventoryItems.ParentCat, InventoryItems.Lvl

IsAttachment

Indicates whether a record is an attachment record or not.

Possible values:

0 or No=Is not an attachment

1 or Yes=Is an attachment

InventoryItems.FamilyPid

InventoryItems.Lvl

IsCompound

Indicates whether the native is a "compound document" (contains embedded files).

Possible values:

0 or No=Not a compound document

1 or Yes=Is a compound document

InventoryItems.IsCompound

IsCompoundChild

Indicates whether the native file was embedded in another file prior to import.

Possible values:

0 or No=Was not embedded within a document

1 or Yes=Was embedded in a document prior to import

IsCompChild

IsCompoundChild

InventoryItems.IsCompoundChild

IsDuplicate

Indicates if the record is a duplicate of another record in the case.

Possible values:

0 or No=Original file (duplicates of this record exist in the case) OR file is not in a duplicate relationship

1 or Yes=Duplicate of another file in the case

InventoryItems.Duplicate

IsEmail

Indicates whether the native file was recognized as an email message during import.

Possible values:

0 or No=Native file was not recognized as an email when imported

1 or Yes=Native file was recognized as an email when imported

InventoryItems.ParentCat, InventoryItems.Lvl

IsEmailAttachment

Indicates whether the native file was recognized as an email attachment during import.

Possible values:

0 or No=Native file was not recognized as an email attachment when imported

1 or Yes=Native file was recognized as an email attachment when imported

IsEmailAtt

InventoryItems.ParentCat, InventoryItems.Lvl

IsPrivate

Flag indicating if the message is marked as being private

0 or No

1 or Yes

Emails.IsPrivate

IsRecurring

Flag indicating whether the appointment is recurring

0 or No

1 or Yes

EmailAppointments.IsRecurring

JournalType

Type of journal entry (i.e. note, phone call, task, etc.)

Phone Call

Note

Task Response

EmailJournals.JournalType

JournalTypeDescription

Long description of JournalType

JrnlTypeDesc

EmailJournals.JournalTypeDescription

Keywords

Keywords extracted from the metadata of the native file.

ex: E-Discovery

#Keywords

EDocuments.DocKeywords

Label

The color label of the item (Outlook category)

Emails.Label

Languages

Semi-colon-delimited list of languages found in the native file.

ex: English;Chinese_Simplified

InventoryItems.Languages

LastAuthor

User who last saved or revised the document.

ex: John Smith

EDocuments.DocLastAuthor

LastMod

Last modified date and time extracted from the metadata of the native file during analysis. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

If the LastMod date metadata is not available,  this field will be populated with date information from the parent hierarchy or the file system if no parent exists.

ex (LastMod):

20140312

ex (TmLastMod):

22:14:46

ex (EDRM):

2014-03-12T22:14:46

LastMod

TmLastMod

#DateModified

EDocuments.DocLastMod

LastPrint

Date and time the document was last printed. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (LastPrint):

20140312

ex (TmLastPrint):

22:14:46

ex (EDRM):

2014-03-12T22:14:46

LastPrint

TmLastPrint

#DatePrinted

EDocuments.DocLastPrint

Level (Document)

A numeric representation of the depth of the document within its container. For example, a PST file might be level 0, an email in the PST level 1, an attachment of an email in the PST level 2, etc.

0

[InventoryItems].[Lvl]

Level  (Email Threading)

Indicates the indent level of the email message in relation to the first email in the email thread associated with the email message.

Possible values:

0=First email in the email thread

1=Replies to first email

2=Replies to replies to first email

3=Replies to replies to replies to first email...and so on.

ET_Indent

ET_Indent

Calculated by counting the number of periods in the ET_ThreadIndex field value.

Location

Contents of the Location metadata field extracted during analysis.

ex: John's office

Emails.Location

ManagerName

Manager name for contact

EmailContacts.ManagerName

Md5Hash

MD5 hash value of the native file.

ex: C20B8B8A3ECF8569B1D1DFF93A18D13F

InventoryItems.Md5Hash

MeetingStatus

Status of the meeting

NotDefined

Received

Update

Invitation

MeetingStats

EmailAppointments.MeetingStatus

MimeType

Information about the content of the file extracted from the header of emails (with the exception of MS Outlook items) and e-documents. Not all e-documents contain this information.

exs:

application/pdf

text/plain

message/rfc822

InventoryItems.MimeType

MsgClass

Indicates the item / entry type in the mail store.

ex: IPM.Note

#MessageClass

Emails.MsgClass

ND_IsMaster

Indicates whether the document is the master document.

Within a family, the master document is the one with the greatest overall similarity to all the other documents in the family. It has to be a near-duplicate of every other document in the family.

Note: Documents that are not part of a near-duplicate family will also have a Y (Yes) value in the field.

Note: If a master document in a set of near-duplicate documents is deleted, all documents assigned to the near-duplicate set are released, and will be reassigned the next time the near-duplicate analysis process runs.

Y=Yes

N=No

ND_IsMaster

ND_IsMaster

Generated at time of export

ND_Master

CloudNine™ Explore ID of the master of the document’s near-duplicate family.

ex: 4

ND_Master

ND_Master

Generated at time of export

ND_Score

Displays the percentage of similarity between the document and its master document.

Within a family, the master document is the one with the greatest overall similarity to all the other documents in the family. It has to be a near-duplicate of every other document in the family.

ex: 85, 100

ND_Score

ND_Score

Generated at time of export

Optional

Contents of the Optional recipient list extracted during analysis.

ex: lawsupport@CloudNine.com

Emails.Optional

Organization

Organization or Company value retrieved from the metadata properties of the document.

ex: CloudNine

#Company

EDocuments.DocOrganization

Organizer

Contents of the Organizer metadata field extracted during analysis.

ex: Smith, John M. (LNG-RDU)

Emails.Organizer

Owner

Person who is assigned the task

EmailTasks.Owner

ParentDocumentGuid

Unique identifier for a parent document.  This value is determined during an export.

ParentExportNumber

Export number of the (top-level) parent document. Applied to all members of the family.

ex: A0001

Generated at time of export

ParentID

The immediate parent of the current email in the thread. For the first message, this will be blank. For each subsequent one, it will be the EdaId / InventoryItems.ID (padded with zeroes to make eight characters) of the email which it replies to or is a forward of. For attachments, ET_ParentID indicates the email to which it is attached.

ex: 00000013

Threading.ThreadIndex.index

Password

Lists the password used to decrypt the file during the import.

ex: TopSecretPwd

InventoryItems.Password

ReadReceipt

Indicates whether the option to request a delivery receipt was enabled in the email message.

Possible values (DAT):

0=No receipt requested or non-mail item

1=Read receipt requested

Possible values (EDRM):

No=No receipt requested or non-mail item

Yes=Read receipt requested

Emails.ReadReceipt

Received

Date and time the email message was received.  In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Received):  

20140122

ex (DAT) (TmReceived):

22:37:35

ex (EDRM):

2014-01-22T22:37:35

Received

TmReceived

#DateReceived

Emails.Received

RecurrencePattern

Description of the recurrence pattern for the meeting

every Monday from 11:00 AM to 11:30 AM

RecurrPattrn

EmailAppointments.RecurrencePattern

RecurrenceType

Frequency of the meeting recurrence

None

Weekly

Monthly

RecurrType

EmailAppointments.RecurrenceType

Required

Contents of the Required recipient list extracted during analysis.

ex: LitigationSalesGroup@ReedElsevier.com

Emails.Required

Resources

List of resources for the appointment (i.e. conference rooms)

Conference Room 186

EmailAppointments.Resources

Revision

Revision number of the document found in the file system properties.

ex: 2

EDocuments.DocRevision

Sensitivity

Value of the Sensitivity flag contained in the email message.

ex: Personal

Emails.Sensitivity

Sent

Sent date and time of the email message. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Sent):

20140122

ex (DAT) (TmSent):

22:37:35

ex (EDRM):

2014-01-22T22:37:35

Sent

TmSent

#DateSent

Emails.Sent

Session

Session name specified on the Import tab.

ex: 2013-2-13-001

ImportSessions.Label

Sources.ImportSessionId

Sha1Hash

SHA-1 hash value of the native file.

ex: 9D4973C1BB42BE722715479AD341850DB9

95A5FE

InventoryItems.Sha1Hash

Size

Size of the native file in bytes.

ex: 107194

#FileSize

InventoryItems.Size

Source

Folder containing the source file. For items from a mail store, this field lists the name of the folder containing the mail store file itself.

ex: ArchiveFolder01

Sources.Name

InventoryItems.SourceId

SourceDocumentID

The unique identifier (Id) of the top-level document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

[InventoryItems].[InventoryPid]

SourceDocumentGuid

The GUID of the top-level document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

6686B1C4-4CC6-47B3-9CCF-A2DAB1EE432C

[InventoryItems].[GUID]

SourceFile

Full path to the original file. If the file is in a container, the full path to the top-most container is returned.

ex: C:\Demo Set\Msg.pst

Directories, InventoryItems.FileName

Subject

Subject field value extracted from metadata of native file.

Note: Email messages subjects are exported to the EmailSubject field.

ex: CloudNine™ LAW Benefits

#Subject

EDocuments.DocSubject

SubjectPrefix

Optional prefix for the message subject

FW:

RE:

Updated:

Canceled:

SubjPrefix

Emails.SubjectPrefix

Tags

Semi-colon-delimited list of tag names associated with the document

ex: Responsive

InventoryItems.Tags

TaskStatus

Status of the task

Complete

InProgress

NotStarted

EmailTasks.Status

Template

Template field value extracted from the metadata of the native file during analysis.

ex: Normal.dotm

EDocuments.DocTemplate

Text

The text of the document extracted during Analysis or OCR. If the text is stored on disk (see IsTextStoredOnDisk), then this value will be null.

Testing Text File

ContentItems.Content

TextSize

Size of the extracted or OCR text in bytes.

ex: 6128

ContentItems.ContentSize

TextSource

Indicates the type of text, if any, associated with the record in CloudNine™ Explore (regardless of whether the text was included for export).

Possible values:

0=Extracted OR file does not have associated text content

1=OCR

ContentItems.Source

Title

Title field value extracted from the metadata of the native file.

ex: CloudNine™ Explore Manual

#Title

EDocuments.DocTitle

To

Main recipient(s) of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

#To

Emails.To

Uid

Formatted ID comprised of the following: <Sessions.Id> - <Sources.Id> - <InventoryPid.Attachment

ex: 15-3-1.2

InventoryItems.Uuid

UnRead

Indicates whether the email was marked read/unread.

Possible values (DAT):

0=Email was "Read" or non-mail item

1=Email was marked as "Unread"

Possible values (EDRM):

No=Email was marked as "Unread"

Yes=Email was marked as "Read"

#ReadFlag

Emails.UnRead

UnSent

Indicates whether the email was sent for emails within a mail store.

Possible values (DAT):

0=Email was sent or non-mail item

1=Email was not sent

Possible values (EDRM):

No=Email was sent

Yes=Email was not sent

Emails.UnSent

Virtual Path

For documents extracted from a Microsoft Outlook or Lotus Notes mail store, archive, or forensic image container file, the path of the document as it exists in its immediate parent container file.

For example, if there is a .pst file containing the folder structure Inbox\ProjectA\email.msg, the ContainerPath value for the email.msg file would be:

Inbox\ProjectA

ex: Inbox\FollowUp

ContainPath

ContainerPath

InventoryItems.CompositeName