Explore Field Descriptions

<< Click to Display Table of Contents >>

Navigation:  Reference Information >

Explore Field Descriptions

The following table provides reference information for all Explore fields. For a download-able copy of field descriptions please see the PDF Guides.

In the Explore Field Descriptions table, the DAT File Field Name column is blank if the field name used in a DAT file is the same as the original Explore field name. If Explore needs to change the field name for a DAT file, the corresponding field name is displayed in the DAT File Field Name column. The EDRM File Field Name column is blank if the field name used in an EDRM file is the same as the original Explore field name. If Explore needs to change the field name for an EDRM file, the corresponding field name is displayed in the EDRM File Field Name column.

 

Field Name

Field Description

Examples

DAT File
Field Name

EDRM File
Field Name

Related Database Field Name(s)

Available In

<Tag Name>

Each tag created in CloudNine™ Explore and CloudNine™ Explore Web is included in the .General\Tags category.

ex: Confidential

ex: Relevant

 

 

 

Explore Desktop

Application

Application used to create the document.

ex: Microsoft Office PowerPoint

 

 

EDocuments.DocApplicationName

Explore Desktop

Discovery Portal

AppointmentEnd

Appointment end date and time for calendar/appointment items. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (ApptEnd):

20140313

ex (TmApptEnd):

22:15:00

ex (EDRM):

2014-03-13T22:15:00

ApptEnd

TmApptEnd

 

Emails.AppointmentEnd

Explore Desktop

AppointmentStart

Appointment start date and time for calendar/appointment items. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (ApptStart):

20140313

ex (TmApptStart):

23:00:00

ex (EDRM):  

2014-03-13T23:00:00

ApptStart

TmApptStart

 

Emails.AppointmentStart

Explore Desktop

AppointmentType

Appointment type

Meeting

Appointment

ApptType

 

EmailAppointments table

Explore Desktop

Attach

Semi-colon-delimited list of filenames of the (top-level) attached files.

ex: UserGuide.pdf;HelpFile.chm

 

#AttachmentNames

Emails.Attach

Explore Desktop

AttachList

Populated for parent records only, this field contains a semi-colon-delimited list of export numbers for the parent and each attachment record. In the example, A0001 is the parent and A0002 and A0003 are attached to A0001.

ex: A0001;A0002;A0003

 

 

Generated at time of export

Explore Desktop

Attachments

Semi-colon-delimited list of filenames of the (top-level) attached files.

ex: UserGuide.pdf;HelpFile.chm

 

#AttachmentNames

Emails.Attach

Discovery Portal

Explore API

AttachParent

Export number of the (top-level) parent document. Applied to all members of the family.

ex: A0001

 

 

Generated at time of export

Explore Desktop

AttachRange

Export numbers of the parent document and the last attachment in the family, separated by a hyphen. Field is empty for records that are not part of a parent/attachment relationship.

ex: A0001 - A0003

 

 

Generated at time of export

Explore Desktop

Author

Author field value extracted from the metadata of the native file during analysis.

ex: John Smith

 

#Author

EDocuments.DocAuthor

Explore Desktop

Discovery Portal

BCC

Recipient(s) of "Blind Carbon Copies" of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@cloudnine.com>

 

#BCC

Emails.Bcc

Explore Desktop

Discovery Portal

BusinessAddress

Business address for contact

 

BusAddress

 

EmailContacts.BusinessAddress

Explore Desktop

BusinessPhone

Business phone number for contact

 

BusPhone

 

EmailContacts.BusinessPhone

Explore Desktop

BusinessPhone2

Secondary business phone number for contact

 

BusPhone2

 

EmailContacts.BusinessPhone2

Explore Desktop

Case

Name of the CloudNine™ Explore case from which the files were exported.

ex: MyEdaCaseName

 

 

CaseProperties.Name

Explore Desktop

Discovery Portal

Categories

Category field value extracted from metadata of the native file.

ex: Software

 

#Categories

EDocuments.DocCategory

Explore Desktop

CC

Recipient(s) of "Carbon Copies" of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

 

#CC

Emails.Cc

Explore Desktop

Discovery Portal

CellularPhone

Cellular phone number for contact

 

CellPhone

 

EmailContacts.CellularPhone

Explore Desktop

Client

Client name specified on the General tab in the New or Edit Case Settings dialog box.

ex: ClientMatter_01

 

 

EDA_Management:

EdaCaseListings.Client

EdaCaseListings.Name

Explore Desktop

Discovery Portal

CodePage

Numeric value that specifies the character set used in the file.

ex: 1252

 

 

Emails.CodePage

Explore Desktop

Discovery Portal

Comments

Comments field value extracted from the metadata of the native file.

ex: Paragraph needs updated info.

 

#Comments

EDocuments.DocComments

Explore Desktop

Discovery Portal

Company

Company name for contact

 

 

 

EmailContacts.Company

Explore Desktop

CompressedSize

Populated for items that were contained within certain archive types (e.g. not populated for 7zip items), this field contains the compressed size of the file in bytes.

ex: 2977792

CompSize

 

InventoryItems.CompressedSize

Explore Desktop

Discovery Portal

ContactEmail

Email address for contact

 

ContactEml

 

EmailContacts.ContactEmail

Explore Desktop

ContactEmail2

Secondary email address for contact

 

ContactEml2

 

EmailContacts.ContactEmail2

Explore Desktop

ContainerPath

For documents extracted from a Microsoft Outlook or Lotus Notes mail store, archive, or forensic image container file, the path of the document as it exists in its immediate parent container file.

For example, if there is a .pst file containing the folder structure Inbox\ProjectA\email.msg, the ContainerPath value for the email.msg file would be:

Inbox\ProjectA

ex: Inbox\FollowUp

ContainPath

ContainerPath

InventoryItems.CompositeName

Explore Desktop

Discovery Portal

ConversationId

Microsoft-specific value used to identify an e-mail conversation.

ex: 01CF5D946F4EFD65607202

ConvId

 

Emails.ConversationID

Explore Desktop

Discovery Portal

ConversationIndex

Microsoft-specific value used for tracking position of an email within a conversation. This value is used during the process of email threading.

ex: 0101CF602E916BDDE035F5FB3D47A8D8D2

D6F92CC769

ConvIndex

 

Emails.ConversationIndex

Explore Desktop

Discovery Portal

ConversationTopic

Normalized subject of emails.

ex: Priorities for 2013

ConvTopic

 

Emails.ConversationTopic

Explore Desktop

Discovery Portal

Created

File creation date and time extracted from the metadata of the native file during analysis. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

If the Created date metadata is not available,  this field will be populated with date information from the parent hierarchy or the file system if no parent exists.

ex (Created):

20140225

ex (TmCreated):

15:48:53

ex (EDRM):

2014-02-25T15:48:53

Created

TmCreated

#DateCreated

EDocuments.DocCreated

Explore Desktop

Discovery Portal

Custodian

Textual custodian value assigned by the user on the Import tab.

ex: Smith, John

 

 

Custodians.Name

Explore Desktop

Discovery Portal

DateFilterLowerBound

For emails, this field contains the sent date of the message, split into two fields in the load file: DF_LBound (date in YYYY/MM/DD format) and TmDF_LBound (time in HH:MM:SS 24-hour time format, GMT). For calendar / appointment items, these fields hold the appointment start date and time. For e-documents, the earlier of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (DF_LBound):

20061225

ex (DAT) (TmDF_LBound):

21:55:00

ex (EDRM):

2006-12-25T21:55:00

DF_LBound

TmDF_LBound

 

DateFilterLowerBound

Explore Desktop

Discovery Portal

DateFilterUpperBound

For emails, this field holds the sent date of the message, split into two fields in the load file: DF_UBound (date in YYYY/MM/DD format) and TmDF_UBound (time in HH:MM:SS 24-hour time format, GMT). For calendar / appointment items, these fields hold the appointment end date and time. For e-documents, the more recent of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (DF_UBound):

20081225

ex (DAT) (TmDF_UBound):

22:05:00

ex (EDRM):

2008-12-25T22:05:00

DF_UBound

TmDF_UBound

 

DateFilterUpperBound

Explore Desktop

Discovery Portal

DateSource

Indicates where the document created and modified dates were obtained.

Possible values:

1=File System

2=Parent

3=Mapi Properties

4=Archive Entry

5=Metadata

 

 

EDocuments.DateSource

Explore Desktop

Decrypted

Indicates whether a file was decrypted during import.

Possible values (DAT):

0 or No=File was never encrypted OR file was encrypted and could not be decrypted

1 or Yes=File was successfully decrypted

 

 

InventoryItems.Decrypted

Explore Desktop

Discovery Portal

Delegator

Person who assigned the task

 

 

 

EmailTasks.Delegator

Explore Desktop

DelivReceipt

Indicates whether the option to request a delivery receipt was enabled in the email message.

Possible values:

0=No receipt requested or non-mail item

1=Delivery receipt requested

 

 

Emails.DelivReceipt

Explore Desktop

Discovery Portal

DepartmentName

Department name for contact

 

DeptName

 

EmailContacts.DepartmentName

Explore Desktop

Directory

Path to the original folder/location of the source file. For each item that originated in a mail store, the Directory will list the path to the mail store.

ex: C:\Data

 

 

Directories, InventoryItems.DirectoryId

Explore Desktop

Discovery Portal

DisplayName

Full name field from Outlook contact

 

 

 

EmailContacts.DisplayName

Explore Desktop

DistributionListMembers

Distribution list member names and email addresses separated by semicolons

MemberName1 <EmailAddress1>; MemberName2 <Email Address 2>

DistListMbrs

 

DistributionListMembers.MemberName

DistributionListMembers.EmailAddress

Explore Desktop

DocumentType

ID number associated with the native file type (provided by third-party file identification engine).

ex: 2209

 

 

InventoryItems.FileType

Discovery Portal

Explore API

DupCustNames

Names of the custodians containing duplicate versions of the original record. Populated for parent duplicates/original records only.

ex: FirstCustodianName; SecondCustodianName

 

 

Generated at time of export

Explore Desktop

DupCustPaths

Source path to each duplicate version of the original record. Populated for parent/original records only.

e-doc ex:

CustName\Folder01\Folder02

email ex:

CustName\Mail-Stores\Archive.pst\Inbox

 

 

Generated at time of export

Explore Desktop

DupId

Contains the EdaId value of the original record in a duplicate relationship (the original and all associated duplicates are assigned the same value).

ex: 42

 

 

Generated at time of export

Explore Desktop

DupParentName

Custodian name of the original record. Populated for duplicate records only.

ex: ParentCustodianName

DupPrntName

 

Generated at time of export

Explore Desktop

DupParentPath

Name of the custodian containing the original record. Populated for duplicate records only.

e-doc ex:

CustName\Folder01\Folder02

email ex:

CustName\Mail-Stores\Archive.pst\Inbox

DupPrntPath

 

Generated at time of export

Explore Desktop

EdaId

Unique value for each record in a CloudNine™ Explore case - assigned by CloudNine™ Explore during analysis.

ex: 1

 

 

InventoryItems.ID

Explore Desktop

Discovery Portal

EmailClient

Email client used to send the email message (information not always available).

ex: outlook

 

 

Emails.EmailClient

Explore Desktop

Discovery Portal

EmailSubject

Subject line from the email message.

ex: FW: Priorities for 2013

 

#Subject

Emails.Subject

Explore Desktop

Discovery Portal

Encrypted

Indicates whether a file is encrypted.

Possible values:

0 or No=File was never encrypted OR file was encrypted and could not be decrypted

1 or Yes=File is encrypted

 

 

InventoryItems.Encrypted

Explore Desktop

Discovery Portal

EntryId

Unique identifier of emails in mail stores.

ex: 000000003DE46CC0FC76C04187C0BB41FBE

BB063E4002000

 

 

Emails.EntryId

Explore Desktop

Discovery Portal

ET_Inclusive

Flags a minimal set of emails which can be viewed in order to read the email message thread's entire conversation. In the simplest case this will simply be the last message in the thread, since it will quote all the previous messages.

Possible values (DAT):

0=Not inclusive

1=Inclusive

Possible values (EDRM):

No=Not inclusive

Yes=Inclusive

 

 

Threading.ThreadIndex.inclusiveMessage

Threading.ThreadIndex.inclusiveAttachment

Threading.Messages.GroupID

Explore Desktop

Discovery Portal

ET_InclusiveReason

If ET_Inclusive field is set to Yes or 1, ET_InclusiveReason field indicates why the email is inclusive. If the email message contains message content that is not copied in any of its subsequent replies or forwards, Message is displayed. If the email message has attachments that are not included in any of its subsequent replies or forwards, Attachment is displayed. If the email message has both new message content and new attachments not included in any of its subsequent replies or forwards, Message, Attachment is displayed. If ET_Inclusive field is set to N, ET_InclusiveReason field is blank.

Possible values:

Message

Attachment

Message,Attachment

ET_IncReason

 

Threading.ThreadIndex.inclusiveMessage

Threading.ThreadIndex.inclusiveAttachment

Explore Desktop

Discovery Portal

ET_Indent

Indicates the indent level of the email message in relation to the first email in the email thread associated with the email message.

Possible values:

0=First email in the email thread

1=Replies to first email

2=Replies to replies to first email

3=Replies to replies to replies to first email...and so on.

 

ET_Indent

ET_Indent

Calculated by counting the number of periods in the ET_ThreadIndex field value.

Explore Desktop

ET_IsMessage

Indicates whether the document was recognized as an email message.

Possible values (DAT):

0=Not an email

1=Identified as an email

Possible values (EDRM):

No=Not an email

Yes=Identified as an email

 

 

Generated at time of export (multiple conditions apply)

Explore Desktop

Discovery Portal

ET_MessageId

Unique ID that is assigned to each message. If several documents have the same Message ID, it is because they were recognized as separate copies of the same email message.

ex: 00000001

 

 

Threading.Messages.GroupID

Explore Desktop

Discovery Portal

ET_ParentId

The immediate parent of the current email in the thread. For the first message, this will be blank. For each subsequent one, it will be the EdaId / InventoryItems.ID (padded with zeroes to make eight characters) of the email which it replies to or is a forward of. For attachments, ET_ParentID indicates the email to which it is attached.

ex: 00000013

 

 

Threading.ThreadIndex.index

Explore Desktop

Discovery Portal

ET_ThreadId

A unique ID assigned to each message thread.

ex: 00000004

 

 

Threading.ThreadIndex.Thread

Explore Desktop

Discovery Portal

ET_ThreadIndex

Composed of a base ID, plus a unique number for each message within the thread, and if there are attachments, the letter A plus the unique number for the attachment within the thread. For example, A1, A2, A3. Uses the format: [base ID].[unique number for message].A[unique attachment number]. The base ID is the same as the thread ID without the leading zeros. The thread index for the root message of the thread will just be this.

ex: 4.1.2.3.4.5.6.7

ET_ThrdIndex

 

Threading.ThreadIndex.index

Explore Desktop

Discovery Portal

ET_ThreadSize

The total number of unique messages in the thread.

ex: 7

ET_ThrdSize

 

Threading.ThreadIndex.threadSize

Explore Desktop

Discovery Portal

ET_ThreadSort

A sort order which follows the chain of conversation, from first message to most recent. If a conversation splits into multiple branches, ET_ThreadSort will keep each of the branches together.

ex: 1

ET_ThrdSort

 

Threading.Threads.Sort

Explore Desktop

Discovery Portal

ExportNativeFileTitle

The name of the native file that was exported. If the user selects to copy native files to the export directory in Export Configuration.

ex:00000010.ntv.pdf

NativeFile

<File FileType="Native">

ExportItems.ExportNativeFileTitle

Discovery Portal

Explore API

ExportNumber

Based on the user-defined starting number specified in the Export # field on the Export tab, this value increments by one for each record in the load file.

ex: ABC000001

 

 

ExportItems.ExportNumber

Explore Desktop

Discovery Portal

ExportPath

The sub-directory below the ExportDirectory (specified in Export Configuration) where the native file or text file was placed.

ex: 001

Included in NativeFile and TextPath

Included in Native and Text ExternalFile path

ExportItems.ExportPath

Discovery Portal

Explore API

ExportTextFileTitle

The name of the text file that was exported. If the user selects to copy native files to the export directory in Export Configuration.

ex:00008393.txt

TextPath

<File FileType="Text">

ExportItems.ExportTextFileTitle

Discovery Portal

Explore API

FamilyParentDocumentGuid

The unique identifier of the family parent of this document.

ex: 3CA859A0-2786-4A93-A6C3-DC8C9C24EBB8

FamilyParent

FamilyParentDocumentGuid

InventoryItems.FamilyPid

Explore Desktop

Discovery Portal

FileDescription

Text file type description of native file (provided by third-party file identification engine).

ex: MS Excel 2007-2010 Spreadsheet (Open XML)

FileDescript

 

InventoryItems.FileTypeDesc

Explore Desktop

Discovery Portal

FileExtension

File extension of the native file. The value will be "lnd" for Lotus Notes documents (e.g. emails in an NSF).

e-doc ex:

docx

email ex:

msg

FileExt

#FileExtension

InventoryItems.Filename

Explore Desktop

Discovery Portal

FileName

Filename of the native file.

e-doc ex:

TrainingManual.docx

email ex:

Training Opportunities.msg

 

#FileName

InventoryItems.Filename

Explore Desktop

Discovery Portal

FileType

ID number associated with the native file type (provided by third-party file identification engine).

ex: 2209

 

 

InventoryItems.FileType

Explore Desktop

Discovery Portal

FileUri

Used internally by the system to retrieve mail store items for exporting and viewing native files.

ex (Lotus Notes email): note-id://D2D09967C7679B3E8625711400748A11

 

 

InventoryItems.CompositeURI

Explore Desktop

Discovery Portal

FlagDueBy

Date/time when action/follow-up is required for message

 

 

 

Emails.FlagDueBy

Explore Desktop

FlagIcon

Indicates if a flag icon (follow-up flag) was set for a message, and if so, what color

6

 

 

Emails.FlagIcon

Explore Desktop

FlagStatus

Follow-up flag value for message

Marked

 

 

Emails.FlagStatus

Explore Desktop

From

Sender of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

 

#From

Emails.From

Explore Desktop

Discovery Portal

FromDomain

Domain portion (only) of the sender's email address.

ex: CloudNine.com

 

 

Emails.Domain

Explore Desktop

Discovery Portal

GovernmentId

Government ID number for contact

 

 

 

EmailContacts.GovernmentId

Explore Desktop

GUID

Global unique identifier for a document.

 

 

 

InventoryItems.GUID

Explore Desktop

Discovery Portal

HasAttachments

Indicates whether a record has attachments or not.

Possible values:

0 or No=Does not have attachments

1 or Yes=Does have attachments

HasAttach

#HasAttachments

InventoryItems.HasChildren

Explore Desktop

Discovery Portal

HasComments

Indicates whether comments exist in the Microsoft Word, Microsoft PowerPoint, or Microsoft Excel native file, or whether sticky notes exist in the Adobe Acrobat PDF native file.

Possible values:

0 or No=No comments exist or setting was not enabled during analysis

1 or Yes=Comments exist within the document

 

 

EDocuments.DocHasComments

Explore Desktop

Discovery Portal

HasDuplicate

Indicates if the record is an original record and has duplicates in the case.

Possible values:

0 or No=Duplicate file OR file is not in a duplicate relationship

1 or Yes=Original file - duplicates of this record exist in the case

 

 

Generated at time of export

Explore Desktop

Hash

MD5 or SHA-1 hash of the email or edocument, depending on Deduplication Mode setting at time of import.

ex: F99E31814864692B6BDD6C10C30B5A55E5A

FD4E8

 

 

InventoryItems.Hash

Explore Desktop

Discovery Portal

HasHiddenRowsCols

Indicates whether the native Microsoft Excel file contains hidden row(s) or column(s).

Possible values:

0 or No=Does not contain a hidden row or column or setting was not enabled during analysis

1 or Yes=Contains hidden row(s) and/or column(s)

HasHidRowCol

 

EDocuments.DocHasHiddenRowsCols

Explore Desktop

Discovery Portal

HasHiddenSheets

Indicates whether the native Microsoft Excel file contains hidden sheet(s).

Possible values:

0 or No=Does not contain hidden sheets or setting was not enabled during analysis

1 or Yes=Contains hidden sheet(s)

HasHidShts

 

EDocuments.DocHasHiddenSheets

Explore Desktop

Discovery Portal

HasHiddenSlides

Indicates whether the native Microsoft PowerPoint file contains hidden slide(s).

Possible values:

0 or No=Does not contain hidden slides or setting was not enabled during analysis

1 or Yes=Contains hidden slide(s)

HasHidSlides

 

EDocuments.DocHasHiddenSlides

Explore Desktop

Discovery Portal

HasSpeakerNotes

Indicates whether the native Microsoft PowerPoint file contains speaker note(s).

Possible values:

0 or No=Does not contain speaker notes or setting was not enabled during analysis

1 or Yes=Contains speaker note(s)

HasSpkrNotes

 

EDocuments.DocHasSpeakerNotes

Explore Desktop

Discovery Portal

HasText

Indicates whether the exported native file has associated text in the export folder. If "Include text" is selected, the value will be "0" (DAT) or "No" (EDRM) for each record.

Possible values:

0 or No=Include Text was not enabled or record does not have text

1 or Yes=Native file has associated text

 

 

InventoryItems.ContentStatus >1

Explore Desktop

Discovery Portal

HasTrackedChanges

Indicates whether the Microsoft Word or Microsoft Excel file contains tracked change(s).

Possible values:

0 or No=Does not contain tracked changes or setting was not enabled during analysis

1 or Yes=Contains tracked change(s)

HasTrackChgs

 

EDocuments.DocHasTrackedChanges

Explore Desktop

Discovery Portal

Headers

Contents of the header extracted from the email message (not always present in email messages).

 

 

#Headers

Emails.Headers

Explore Desktop

Discovery Portal

HomeAddress

Home address for contact

 

 

 

EmailContacts.HomeAddress

Explore Desktop

IconIndex

Used in Exchange to determine which icon to display (e.g. MailUnread).

ex: 4294967295

 

 

Emails.IconIndex

Explore Desktop

Discovery Portal

Importance

Value of the Importance flag contained in the email message.

Low

Normal

High

None

Note: The SQL database codes these values as numbers. Low is 0, Normal is 1, High is 2, and None is 3.

 

#ImportanceFlag

Emails.Importance

Explore Desktop

Discovery Portal

Imported

Date/time (UTC) the file was imported into the CloudNine™ Explore case, split into two fields in the load file: Imported (date the file was imported) and TmImported (time the file was imported).  In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Imported):

20140203

ex (DAT) (TmImported):

17:04:05

ex (EDRM):

2014-02-03T17:04:05

Imported

TmImported

 

InventoryItems.Created

Explore Desktop

Discovery Portal

ImportSet

Session name specified on the Import tab.

ex: Import Set 001

ex: 2013-2-13-001

 

ImportSessions.Label

Sources.ImportSessionId

Discovery Portal

Explore API

InReplyToId

IntMsgID of the e-mail replied to.

ex: <F9AC00709876F64091943726669AFC9875

4D6CA6@retda2mbxp006.legal.regn.net>

 

 

Emails.InReplyToId

Explore Desktop

Discovery Portal

IntMsgID

Internet Message ID assigned to an e-mail message by the outgoing mail server.

ex: <BE8445B04466714283760D9A95ED6A731B

12E707@RETDA2MBXP002.legal.regn.net>

 

 

Emails.IntMsgId

Explore Desktop

Discovery Portal

IsAllDayEvent

Indicates whether the appointment is all-day

0 or No

1 or Yes

IsAllDayEvnt

 

EmailAppointments.IsAllDayEvent

Explore Desktop

IsArchiveItem

Indicates whether the native file was contained with an archive (e.g. 7zip) when imported into the CloudNine™ Explore case.

Possible values:

0 or No=Native file was not contained in an archive when imported

1 or Yes=Native file was contained in an archive when imported

IsArcItem

 

InventoryItems.ParentCat, InventoryItems.Lvl

Explore Desktop

Discovery Portal

IsAttachment

Indicates whether a record is an attachment record or not.

Possible values:

0 or No=Is not an attachment

1 or Yes=Is an attachment

 

 

InventoryItems.FamilyPid

InventoryItems.Lvl

Explore Desktop

Discovery Portal

IsCompound

Indicates whether the native is a "compound document" (contains embedded files).

Possible values:

0 or No=Not a compound document

1 or Yes=Is a compound document

 

 

InventoryItems.IsCompound

Explore Desktop

Discovery Portal

IsCompoundChild

Indicates whether the native file was embedded in another file prior to import.

Possible values:

0 or No=Was not embedded within a document

1 or Yes=Was embedded in a document prior to import

IsCompChild

IsCompoundChild

InventoryItems.IsCompoundChild

Explore Desktop

Discovery Portal

IsDuplicate

Indicates if the record is a duplicate of another record in the case.

Possible values:

0 or No=Original file (duplicates of this record exist in the case) OR file is not in a duplicate relationship

1 or Yes=Duplicate of another file in the case

 

 

InventoryItems.Duplicate

Explore Desktop

Discovery Portal

IsEmail

Indicates whether the native file was recognized as an email message during import.

Possible values:

0 or No=Native file was not recognized as an email when imported

1 or Yes=Native file was recognized as an email when imported

 

 

InventoryItems.ParentCat, InventoryItems.Lvl

Explore Desktop

IsEmailAttachment

Indicates whether the native file was recognized as an email attachment during import.

Possible values:

0 or No=Native file was not recognized as an email attachment when imported

1 or Yes=Native file was recognized as an email attachment when imported

IsEmailAtt

 

InventoryItems.ParentCat, InventoryItems.Lvl

Explore Desktop

Discovery Portal

IsPrivate

Flag indicating if the message is marked as being private

0 or No

1 or Yes

 

 

Emails.IsPrivate

Explore Desktop

IsRecurring

Flag indicating whether the appointment is recurring

0 or No

1 or Yes

 

 

EmailAppointments.IsRecurring

Explore Desktop

JournalType

Type of journal entry (i.e. note, phone call, task, etc.)

Phone Call

Note

Task Response

 

 

EmailJournals.JournalType

Explore Desktop

JournalTypeDescription

Long description of JournalType

 

JrnlTypeDesc

 

EmailJournals.JournalTypeDescription

Explore Desktop

Keywords

Keywords extracted from the metadata of the native file.

ex: E-Discovery

 

#Keywords

EDocuments.DocKeywords

Explore Desktop

Label

The color label of the item (Outlook category)

 

 

 

Emails.Label

Explore Desktop

Languages

Semi-colon-delimited list of languages found in the native file.

ex: English;Chinese_Simplified

 

 

InventoryItems.Languages

Explore Desktop

LastAuthor

User who last saved or revised the document.

ex: John Smith

 

 

EDocuments.DocLastAuthor

Explore Desktop

Discovery Portal

LastMod

Last modified date and time extracted from the metadata of the native file during analysis. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

If the LastMod date metadata is not available,  this field will be populated with date information from the parent hierarchy or the file system if no parent exists.

ex (LastMod):

20140312

ex (TmLastMod):

22:14:46

ex (EDRM):

2014-03-12T22:14:46

LastMod

TmLastMod

#DateModified

EDocuments.DocLastMod

Explore Desktop

Discovery Portal

LastPrint

Date and time the document was last printed. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (LastPrint):

20140312

ex (TmLastPrint):

22:14:46

ex (EDRM):

2014-03-12T22:14:46

LastPrint

TmLastPrint

#DatePrinted

EDocuments.DocLastPrint

Explore Desktop

Discovery Portal

Level (Document)

A numeric representation of the depth of the document within its container. For example, a PST file might be level 0, an email in the PST level 1, an attachment of an email in the PST level 2, etc.

0

 

 

[InventoryItems].[Lvl]

Discovery Portal

Explore API

Level  (Email Threading)

Indicates the indent level of the email message in relation to the first email in the email thread associated with the email message.

Possible values:

0=First email in the email thread

1=Replies to first email

2=Replies to replies to first email

3=Replies to replies to replies to first email...and so on.

ET_Indent

ET_Indent

Calculated by counting the number of periods in the ET_ThreadIndex field value.

Discovery Portal

Explore API

Location

Contents of the Location metadata field extracted during analysis.

ex: John's office

 

 

Emails.Location

Explore Desktop

ManagerName

Manager name for contact

 

 

 

EmailContacts.ManagerName

Explore Desktop

Md5Hash

MD5 hash value of the native file.

ex: C20B8B8A3ECF8569B1D1DFF93A18D13F

 

 

InventoryItems.Md5Hash

Explore Desktop

MeetingStatus

Status of the meeting

NotDefined

Received

Update

Invitation

MeetingStats

 

EmailAppointments.MeetingStatus

Explore Desktop

MimeType

Information about the content of the file extracted from the header of emails (with the exception of MS Outlook items) and e-documents. Not all e-documents contain this information.

exs:

application/pdf

text/plain

message/rfc822

 

 

InventoryItems.MimeType

Explore Desktop

Discovery Portal

MsgClass

Indicates the item / entry type in the mail store.

ex: IPM.Note

 

#MessageClass

Emails.MsgClass

Explore Desktop

Discovery Portal

ND_IsMaster

Indicates whether the document is the master document.

Within a family, the master document is the one with the greatest overall similarity to all the other documents in the family. It has to be a near-duplicate of every other document in the family.

Note: Documents that are not part of a near-duplicate family will also have a Y (Yes) value in the field.

Note: If a master document in a set of near-duplicate documents is deleted, all documents assigned to the near-duplicate set are released, and will be reassigned the next time the near-duplicate analysis process runs.

Y=Yes

N=No

ND_IsMaster

ND_IsMaster

Generated at time of export

Explore Desktop

ND_Master

CloudNine™ Explore ID of the master of the document’s near-duplicate family.

ex: 4

ND_Master

ND_Master

Generated at time of export

Explore Desktop

ND_Score

Displays the percentage of similarity between the document and its master document.

Within a family, the master document is the one with the greatest overall similarity to all the other documents in the family. It has to be a near-duplicate of every other document in the family.

ex: 85, 100

ND_Score

ND_Score

Generated at time of export

Explore Desktop

Optional

Contents of the Optional recipient list extracted during analysis.

ex: lawsupport@CloudNine.com

 

 

Emails.Optional

Explore Desktop

Organization

Organization or Company value retrieved from the metadata properties of the document.

ex: CloudNine

 

#Company

EDocuments.DocOrganization

Explore Desktop

Discovery Portal

Organizer

Contents of the Organizer metadata field extracted during analysis.

ex: Smith, John M. (LNG-RDU)

 

 

Emails.Organizer

Explore Desktop

Owner

Person who is assigned the task

 

 

 

EmailTasks.Owner

Explore Desktop

ParentDocumentGuid

Unique identifier for a parent document.  This value is determined during an export.

 

 

 

 

 

ParentExportNumber

Export number of the (top-level) parent document. Applied to all members of the family.

ex: A0001

 

 

Generated at time of export

Discovery Portal

Explore API

ParentID

The immediate parent of the current email in the thread. For the first message, this will be blank. For each subsequent one, it will be the EdaId / InventoryItems.ID (padded with zeroes to make eight characters) of the email which it replies to or is a forward of. For attachments, ET_ParentID indicates the email to which it is attached.

ex: 00000013

 

 

Threading.ThreadIndex.index

Discovery Portal

Explore API

Password

Lists the password used to decrypt the file during the import.

ex: TopSecretPwd

 

 

InventoryItems.Password

Explore Desktop

Discovery Portal

ReadReceipt

Indicates whether the option to request a delivery receipt was enabled in the email message.

Possible values (DAT):

0=No receipt requested or non-mail item

1=Read receipt requested

Possible values (EDRM):

No=No receipt requested or non-mail item

Yes=Read receipt requested

 

 

Emails.ReadReceipt

Explore Desktop

Discovery Portal

Received

Date and time the email message was received.  In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Received):  

20140122

ex (DAT) (TmReceived):

22:37:35

ex (EDRM):

2014-01-22T22:37:35

Received

TmReceived

#DateReceived

Emails.Received

Explore Desktop

Discovery Portal

RecurrencePattern

Description of the recurrence pattern for the meeting

every Monday from 11:00 AM to 11:30 AM

RecurrPattrn

 

EmailAppointments.RecurrencePattern

Explore Desktop

RecurrenceType

Frequency of the meeting recurrence

None

Weekly

Monthly

RecurrType

 

EmailAppointments.RecurrenceType

Explore Desktop

Required

Contents of the Required recipient list extracted during analysis.

ex: LitigationSalesGroup@ReedElsevier.com

 

 

Emails.Required

Explore Desktop

Resources

List of resources for the appointment (i.e. conference rooms)

Conference Room 186

 

 

EmailAppointments.Resources

Explore Desktop

Revision

Revision number of the document found in the file system properties.

ex: 2

 

 

EDocuments.DocRevision

Explore Desktop

Discovery Portal

Sensitivity

Value of the Sensitivity flag contained in the email message.

ex: Personal

 

 

Emails.Sensitivity

Explore Desktop

Discovery Portal

Sent

Sent date and time of the email message. In version 1.6 or later, the time zone of the exported date will match the "Case Time Zone" set prior to analysis (Case Settings > General tab).

ex (DAT) (Sent):

20140122

ex (DAT) (TmSent):

22:37:35

ex (EDRM):

2014-01-22T22:37:35

Sent

TmSent

#DateSent

Emails.Sent

Explore Desktop

Discovery Portal

Session

Session name specified on the Import tab.

ex: 2013-2-13-001

 

 

ImportSessions.Label

Sources.ImportSessionId

Explore Desktop

Sha1Hash

SHA-1 hash value of the native file.

ex: 9D4973C1BB42BE722715479AD341850DB9

95A5FE

 

 

InventoryItems.Sha1Hash

Explore Desktop

Size

Size of the native file in bytes.

ex: 107194

 

#FileSize

InventoryItems.Size

Explore Desktop

Discovery Portal

Source

Folder containing the source file. For items from a mail store, this field lists the name of the folder containing the mail store file itself.

ex: ArchiveFolder01

 

 

Sources.Name

InventoryItems.SourceId

Explore Desktop

Discovery Portal

SourceDocumentID

The unique identifier (Id) of the top-level document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

 

 

 

[InventoryItems].[InventoryPid]

Discovery Portal

Explore API

SourceDocumentGuid

The GUID of the top-level document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

6686B1C4-4CC6-47B3-9CCF-A2DAB1EE432C

 

 

[InventoryItems].[GUID]

Discovery Portal

Explore API

SourceFile

Full path to the original file. If the file is in a container, the full path to the top-most container is returned.

ex: C:\Demo Set\Msg.pst

 

 

Directories, InventoryItems.FileName

Explore Desktop

Discovery Portal

Subject

Subject field value extracted from metadata of native file.

Note: Email messages subjects are exported to the EmailSubject field.

ex: CloudNine™ LAW Benefits

 

#Subject

EDocuments.DocSubject

Explore Desktop

Discovery Portal

SubjectPrefix

Optional prefix for the message subject

FW:

RE:

Updated:

Canceled:

SubjPrefix

 

Emails.SubjectPrefix

Explore Desktop

Tags

Semi-colon-delimited list of tag names associated with the document

ex: Responsive

 

 

InventoryItems.Tags

Explore Desktop

Discovery Portal

TaskStatus

Status of the task

Complete

InProgress

NotStarted

 

 

EmailTasks.Status

Explore Desktop

Template

Template field value extracted from the metadata of the native file during analysis.

ex: Normal.dotm

 

 

EDocuments.DocTemplate

Explore Desktop

Discovery Portal

Text

The text of the document extracted during Analysis or OCR. If the text is stored on disk (see IsTextStoredOnDisk), then this value will be null.

Testing Text File

 

 

ContentItems.Content

Discovery Portal

Explore API

TextSize

Size of the extracted or OCR text in bytes.

ex: 6128

 

 

ContentItems.ContentSize

Explore Desktop

Discovery Portal

TextSource

Indicates the type of text, if any, associated with the record in CloudNine™ Explore (regardless of whether the text was included for export).

Possible values:

0=Extracted OR file does not have associated text content

1=OCR

 

 

ContentItems.Source

Explore Desktop

Title

Title field value extracted from the metadata of the native file.

ex: CloudNine™ Explore Manual

 

#Title

EDocuments.DocTitle

Explore Desktop

Discovery Portal

To

Main recipient(s) of the email message.

ex: Smith, Jane (LNG-HBE) <jane.smith@CloudNine.com>

 

#To

Emails.To

Explore Desktop

Discovery Portal

Uid

Formatted ID comprised of the following: <Sessions.Id> - <Sources.Id> - <InventoryPid.Attachment

ex: 15-3-1.2

 

 

InventoryItems.Uuid

Explore Desktop

UnRead

Indicates whether the email was marked read/unread.

Possible values (DAT):

0=Email was "Read" or non-mail item

1=Email was marked as "Unread"

Possible values (EDRM):

No=Email was marked as "Unread"

Yes=Email was marked as "Read"

 

#ReadFlag

Emails.UnRead

Explore Desktop

Discovery Portal

UnSent

Indicates whether the email was sent for emails within a mail store.

Possible values (DAT):

0=Email was sent or non-mail item

1=Email was not sent

Possible values (EDRM):

No=Email was sent

Yes=Email was not sent

 

 

Emails.UnSent

Explore Desktop

Discovery Portal

Virtual Path

For documents extracted from a Microsoft Outlook or Lotus Notes mail store, archive, or forensic image container file, the path of the document as it exists in its immediate parent container file.

For example, if there is a .pst file containing the folder structure Inbox\ProjectA\email.msg, the ContainerPath value for the email.msg file would be:

Inbox\ProjectA

ex: Inbox\FollowUp

ContainPath

ContainerPath

InventoryItems.CompositeName

Discovery Portal

Explore API