Locate Internal Only or External Only email

A common request is to find all email that was sent to or received from external addresses, or, conversely, email that only was sent internally. This task cannot be performed via criteria in the wizard. Instead, the user has to run the search with other criteria then use the Domain view for filters to parse out the requested data.

Note: if the only criteria is this address criteria, run a Message Only search with the only criteria of Size > 0 bytes to return all messages.

Steps

1. Run a search on the data set in questions. If there are other criteria, use everything except the address criteria. If the address criteria is the only criteria, use Message Only option with Size > 0 for criteria. If appropriate, folders such as the Calendar or Contacts can be excluded. This process can also be used on searches that have already been run.
   
   Note: If the data source is MSG files, make sure the 'Other Email Store' option is used to select MSGs (i.e. don't select File Shares). Searching for MSGs as 'Other Email Stores' ensures email properties such as addresses are available for filtering.
   

2. Once the search is complete, open the Results Management window and navigate to the 'Domain' view.
   

3. Sort by the 'Domain' column, then Highlight all listed rows in this view. There is a short-cut Ctrl-A for this.
   

4. While holding down the Control Key (Ctrl), select all the domains that make up your organization's domains to un-select them. At this point all domains should be highlighted, except the organizations internal domains.
   
   Note: Not all email addresses are in the familiar name@domain.extension format. Internal email often has a different format ‘routing address’ For example, in the screenshot below for Gimmal , we would have both FIRST ORGANIZTION and ‘gimmal.com'.
   

5. Right Click on one of the Highlighted domains and choose the Mark Items | [Choose a Mark]. This will apply an icon to all the items that have an external address. The lower left status will update as the items are being marked
   
   Note: If you are only interested in items sent from an external address or sent to an internal address, you can apply an additional marks after sorting or opening domains and highlighting the items that match your preferred filter.
   

   

6. Once the items have been marked, navigate to All Results or Unique Items (depending on whether you have deduplicated) and use the Menu bar 'Filter | By Mark' option to open the Filter Marks dialog.
   

7. Choose the Mark you selected to identify the External addresses (marks can be associated with text in the Settings) and Click 'OK'
   

   

8. The view an now be filtered in any view to show items which have external addresses.
   

9. To see only internal items, choose the ‘[no mark]’ option in the filter.
   

10. The other items will still be present in the result set, and you can use other Filter options to toggle views.

Please contact support@gimmal.com with any questions.