Basic Advanced Search Procedures

To construct and run, save, or save and run an advanced search:

  1. Open the case you want to search.

  2. In the Case View, click the Advanced Search tab.

  3. If a previously defined search is already displayed in the Advanced Search tab, click Clear Search button at the top of the tab, the title for the search changes to Untitled.

  4. Click the edit button .
  5. Enter a Search Name for your search.

  6. Select the folder where you want to save the search.
  7. Click Save Only.
  8. Component



    If you will be saving the search, enter a unique name here. Leave this field blank if you will not be saving the search.

    Parent Folder

    If you will be saving the search, select the folder in which the search should be saved. By default, a saved search will be public (available to all users with access to the case or batch). It can also be private or shared. Folders are used to organize saved searches and are created as described in "Search Folders".


    To include documents related to those in the search results, select one or more of the Include options (click  on the right side of the Include field). All fields defined with the Allow Group by option will be available; typical selections include fields that indicate:

    • Family (based on case BEGATTACH field)

    • Near-duplicates (based on CAATND field)

    • Duplicates (based on MD5HASH field)

    • Email relationships (based on various CAAT fields)

    Note: This option should not be selected when random sampling is used.

Specify Sort Order

Search results can be organized based by field content (the columns in the case table). Up to three fields can be defined for sorting. When you sort based upon multiple fields, the order of the sorting is based on the order in which the fields are selected.

To specify sort order:

  1. Define a search using the previous procedures.

  2. If the Sort Options section is not visible in the Advanced Search tab, click the corresponding arrow, .

  3. Click Add sort by field.

  4. Select the first field to be sorted. This is the primary order for the search results.

  5. Select the sort order—Ascending (lowest to highest) or Descending (highest to lowest).

  6. To specify a second sort order, click and repeat step 4 and step 5 for the second field.

  7. To specify a third sort order, click Add sort by field and repeat step 4 and step 5 for the third field.

    In the below example, search results will be sorted first by author name and then by date created.

  8. Review your selections. Note:

    • Make changes if needed.

    • To remove one of the sort-definition rows, point to the right side of the row and click .

  9. After the sort order is defined, continue with one of the following actions as needed:

    • Define random sampling for the search results, next.

    • Run and/or Save a Search

To return a random sample of documents instead of all documents meeting your search criteria, complete the following steps. An overview of random sampling can be found in "About Search Types and Options".

  1. Define a search using the previous procedures.

  2. Ensure the Include option is not selected.

  3. If the Random Sampling section is not visible in the Advanced Search tab, click the corresponding arrow, .

  4. In the Random Sampling section, select Apply to Search.

  5. Select the needed sampling type and associated options as described in the following table.

  6. Sampling Type


    Fixed size

    Select this type to create a sample containing a specific number of documents in the search results.

    When this option is selected, enter the desired size (a value equal to or greater than 1) in the Fixed Size field.

    The value you choose should be based on the size of the search results without random sampling applied and what number of those documents represents a good sampling size.

    Statistical sampling

    Statistical sampling is based on standard statistics calculations that utilize a confidence level and margin of error.

    Confidence Level

    Confidence level represents the reliability of an estimate, that is, how likely it is that the sample returned will be representative of all search results.

    The larger the confidence level is, the narrower the range of documents will be that are considered to be representative.

    • 90: wider range of documents considered (fewer documents typically returned).

    • 95: medium range of documents considered.

    • 99: narrower range of documents (more documents typically returned).

    Margin of Error

    The margin of error expresses the amount of error to be allowed in the search results sample.

    Select a value from 1 - 5, where 1 is the least amount of error and 5 is the highest amount of error.

    A setting of 1 typically returns the most documents; a setting of 5 typically returns the fewest documents.

  7. When your search is defined and random sampling is configured, continue with "Run and/or Save a Search".

Changing an Advanced Search

Before a Search is Run

Any time before an advanced search is run, revise the search as follows:

After a Search is Run

To edit a search that has just been run (whether it was saved or not), click on the Advanced Search tab of the Case view. The search definition will be in the Advanced Search tab. Make changes as described in the previous section.

Modify Saved Searches

See "Saved Searches" for details on changing searches you have saved.