Search term ending in a period

[Jacques B]

I'm trying to create a task to search for emails from Expedia and tag it as Travel. If I search for expedia.com, it finds those (6 emails) as the name that appears in the from field is Expedia.com, and the sender is actually expediamail.com.

If I search for "expedia.*" or "expedia." (field specific "from" or "sender"), it produces 131 responsive emails. But many of the hits are where the word "expedia" is in the from/sender field, but not "expedia.". It's producing responsive emails that do not have the period. If I escape the period, it doesn't change anything. I know the period is not a special character. But it seems to be behaving like a period in a GREP expression, as the highlighted hit seems to be "expedia" followed by a space.

I was hoping to search for "expedia.*" so that it would find expedia.com, expedia.ca, expedia.co.uk, etc. But the fact that it's hitting no Expedia followed by a space, I'm presuming it wouldn't yield the expected results.

Is there something I should be doing different?

[Jacques B]

I think I found my answer here: https://vound-software.com/docs/intella/2.6/#_tokenization_and_special_characters

I believe that's a change with 2.6.

[Guest Marco de Moulin]

Hello @Jacques B,

The emails are indexed sub tokenized to parts (mail@expedia.com -> mail, Expedia, com). This way you can search for the individual parts. No wildcards are needed because of this tokenization. 

In your case, you could search for "expedia (com OR ca OR 'co.uk')" or "Expediamail (com OR ca OR 'co.uk')" and limit the search to 'Sender' and 'From'.  

That part in the manual indeed explains it in more detail.

Let us know if you have any follow-up questions.

Marco

[Jacques B]

Thanks,

I'll try that and see how it works. I'm constantly looking at what I can auto-tag for investigators to provide them with an overview of the type of data in the case. They can then use these tags to immediately start identifying content that is either not relevant, or potentially relevant. This is especially useful to tag emails from social media sites for example. An investigator may not think to look for that. But seeing it tagged will help them think of other types of emails as potentially containing relevant info (e.g., showing connection between parties by their interaction on social media generating a notification email).

Jacques