Low-level searches in GFI MailArchiver
The information in this article applies to:
- GFI MailArchiver for Exchange 5
- GFI MailArchiver for Exchange 6
Article ID: KBID003253
Query keywords: search
GFI MailArchiver 5 and later allows you to perform low-level Boolean searches from the GFI MailArchiver console -> ‘Conversations’ -> ‘Search’ node by entering the query in the ‘Search for’ field.
This type of search provides the ability to perform more advanced searches, which may not be possible using the Advanced Search.
Note: The low-level Boolean search cannot be used in the ‘Advanced Search Options’ screen.
The rest of the article provides the syntax for the searches and some examples:
Syntax:
raw: complex-term [operand complex-term]
operand: { __and | __or } [ __not ]
Note: Raw searches require a double underscore '__'
complex-term: [ ( ] boolean-term | field-term [ ) ]
boolean-term: [ ( ] simple-term [ ) ] [operand boolean-term]
field-term: { subject | sender | to | msgid | sentdated | recvdated | msgsizekb } __contains boolean-term
simple-term: [ mail-term | text-term | numeric-term ]
mail-term: mail( word )
text-term: { word | phrase }
phrase: [ " ] word [space word ...] [ " ]
word: { letter | digit | @ | wildcard } [...]
wildcard: * | ?
numeric-term: number ~~ number
number: digit [...]
Notes:
- sentdated and recvdated are numeric searches and are specified in the number of days from 01-01-1970 and padded with zeros to 10 digits. For example to search items sent between the 1st of January 1990 to the 20th of November 2007, the following parameter would be used:
sentdated __contains(0000007305~~0000013837)
You can calculate the number of days between 01-01-1970 and the date you would like to search using http://www.timeanddate.com/date/duration.html.
- msgsizekb is a numeric search and is specified in KB and padded to 10 digits. For example:
msgsizekb __contains(0000001025~~0001048576)
- Parenthesis are recommended for proper grouping
- mail-term is used to specify email addresses and message ids
- It is not possible to select a particular database for the search. The search will be performed across all registered indexes.
- The Advanced search performs numeric searches more efficiently
- When no field-term is specified the search is performed on the whole email (fields, body and attachments).
- Low level searches can also be saved as Search Folders
- Low level searches may produce incorrect results for indexes built by the GFI MailArchiver 4 builds prior to 20070616
Examples:
- To search for emails containing the phrase "concept plan" or "master plan"
raw: "concept plan" __or "master plan"
- To search for emails sent by ‘sales@company.com’
raw: sender __contains mail(sales@company.com)
- To search for emails sent by sales@company.com or containing GFI in the subject
raw: ( sender __contains mail(sales@company.com) ) __or ( subject __contains GFI )
- To search for emails received by sales@company.com or info@company.com
raw: to __contains mail(sales@company.com) __or mail(info@company.com)
- To search for emails containing a phrase "master plan" and emails which are smaller than 1 MB.
raw: ("master plan") __and (msgsizekb __contains 0000000001~~0000001025)
Notes:
- Starting from GFI MailArchiver 6.1, low-level searches can be performed from the GFI MailArchiver Bulk Export Tool.