IDocument Properties

A concatenated value used to describe the location of a document within its container.

The compressed size of the native file (in bytes) if it was contained within certain archive types (e.g. not populated for 7zip items).

If the file was originally contained within a container, e.g. .zip file or .pst, this is the path to the file's location within the container.

The custodian responsible for the document.

For emails, this field contains the sent date of the message. For calendar / appointment items, this holds the appointment start date and time. For e-documents, the earlier of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used.

For emails, this field contains the sent date of the message. For calendar / appointment items, this holds the appointment end date and time. For e-documents, the latest of the two dates found in the creation and last modified fields (within the internal document metadata (if available)) is used.

Indicates if the native file was password protected but able to be decrypted during import.

The path to the original folder/location of the native file. For each item that originated in a mail store, the Directory will list the path to the mail store.

The type of document that this represents, e.g. Email or EDocument.

Metadata specific to non-email documents. For Email documents this will be Null.

Metadata specific to Email documents. For non-email documents this will be Null.

Indicates if the native file was password protected and unable to be decrypted.

The unique identifier of the "family parent" document, i.e. the "top" document in the document family

The filename of the native file.

A numeric representation of the native file type (provided by third-party file identification engine).

A textual description of native file type (provided by third-party file identification engine).

Used internally by the system to retrieve mail store items for exporting and viewing native files, e.g. (Lotus Notes email): note-id://D2D09967C7679B3E8625711400748A11.

Indicates whether the document has attachments.

The MD5 or SHA-1 hash of the email or edocument, depending on the Deduplication Mode setting at the time of import.

The unique identifier for the document.

The date/time that the file was imported into the case.

The document's import session.

The internal numeric identifier for the document.

Indicates whether the native file was contained with an archive (e.g. 7zip) when imported into the case.

Indicates whether the native file was an attachment of another document.

Indicates whether the native file is a "compound document" (contains embedded files).

Indicates whether the native file was embedded inside another document (the parent document would have IsCompound set to True).

Indicates if the document was identified as a duplicate of another document in the case during Analysis.

Indicates whether the native file was an attachment of an email.

A numeric representation of the depth of the document within its container. For example, a PST file might be level 0, an email in the PST level 1, an attachment to an email in the PST level 2, etc.

Information about the content of the file extracted from the header of emails (with the exception of MS Outlook items) and e-documents. Not all e-documents contain this information.

The unique identifier (Id) of the immediate parent document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

The password used to decrypt the native file during import.

The size of the native file in bytes.

The source of the document.

The unique identifier (Id) of the top-level document in the parent-child relationship hierarchy, e.g. parent doc or mail store.

The full path to the native file. If the file was in a container then the full path to the top-most container is returned.

The text of the document extracted during Analysis or OCR.

Size of the extracted or OCR text (in bytes).