Finding Conversations between Addresses

When performing an e-Discovery search, you may need to find conversations between two or more persons of interest. Discovery Attender has several options to assist with these types of searches.

Wizard Based Filters

The Discovery Attender Search Wizard provides several options to search for conversations between two addresses using either the Find Conversation Between Any Two Addresses option or the Find Conversation Between Different Sender and Recipient option as seen below:

• “Find Conversation Between Any Two Addresses” Option requires that the sender and at least one recipient must be in the address list.

• “Find Conversation Between Different Sender and Recipient” Option locates results where the sender is from one list and at least one recipient is from the other.

These options may not always be ideal. For instance,

• If your custodians are in the habit of copying themselves (CCs or BCCs) on an email, it may generate a false-positive hit.

• If one of the addresses belongs to the custodian whose email you are searching. In this case, all messages in those data stores will be to or from that address leading to redundant searching. To correctly search in this instance, it is more efficient to use the correspondent’s addresses in a standard address search.

To help avoid generating false positives and false negatives due to these factors, you may want to consider breaking down your search into separate searches per number of custodians and addresses being searched:

1. Perform a search against the first custodian's data stores searching for all additional correspondent addresses

2. Perform a search against the second custodian's data stores searching for all additional correspondent addresses

3. … and so on with any additional custodians

For instance, let’s say you are trying to find conversations between John Doe, Robert Jones, and Jane Smith, where John Doe and Jane Smith are custodians in my organization. Assuming you want all instances of the conversations between any of these persons of interest, you would first search all of John Doe’s mail stores (mailbox, online archive, and/or PST files) for both Jane and Robert’s email addresses. For the second search, you will search all of Jane Smith’s data stores (mailbox, online archive, and/or PST files) for John and Robert’s email addresses, and so on.

Additional Address Considerations

Property Options

• There are three properties Discovery Attender scans for each address:

  • Display name (e.g. Jeffrey Lebowski)

  • Exchange Internal address (e.g. /O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=JeffreyLebowski)

  • SMTP address (Lebowski @exchangelab.local)

Too often, users will enter just the SMTP address in their search criteria and forget that internal communications (especially for sent messages in Exchange-based data stores) often depend on the other properties. To counteract this option, including both the display name and SMTP address for internal senders and recipients will guarantee the most expansive results.

Wildcards with Addresses

When searching addresses in general, please remember that to be considered a hit, the address search terms must match the entire address property text. Therefore, the use of wildcards like the asterisk is encouraged. However, pattern matching may not always work with your criteria. If the name is too common, your search will result in numerous false-positive hits. (That is, you probably do not want to search for just *smith*). In addition, the Exchange and SMTP addresses may not include the full name either, therefore causing an incomplete result set. To get around this, make sure to verify you have all the address properties using the PreSearch Tool’s snapshot option.

Result Management Filters

Although finding a conversation between two addresses is easier using the search wizard, the same result can be achieved using Marks and Filters with the Address view in the Result Management Screen.

Don’t hesitate to contact support if you have further questions on searching for conversations in Discovery Attender.

First Published July, 2024