Jump to content

Search term ending in a period

Recommended Posts

I'm trying to create a task to search for emails from Expedia and tag it as Travel. If I search for expedia.com, it finds those (6 emails) as the name that appears in the from field is Expedia.com, and the sender is actually expediamail.com.

If I search for "expedia.*" or "expedia." (field specific "from" or "sender"), it produces 131 responsive emails. But many of the hits are where the word "expedia" is in the from/sender field, but not "expedia.". It's producing responsive emails that do not have the period. If I escape the period, it doesn't change anything. I know the period is not a special character. But it seems to be behaving like a period in a GREP expression, as the highlighted hit seems to be "expedia" followed by a space.

I was hoping to search for "expedia.*" so that it would find expedia.com, expedia.ca, expedia.co.uk, etc. But the fact that it's hitting no Expedia followed by a space, I'm presuming it wouldn't yield the expected results.

Is there something I should be doing different?

Link to comment
Share on other sites

  • 2 weeks later...
Guest Marco de Moulin

Hello @Jacques B,

The emails are indexed sub tokenized to parts (mail@expedia.com -> mail, Expedia, com). This way you can search for the individual parts. No wildcards are needed because of this tokenization. 

In your case, you could search for "expedia (com OR ca OR 'co.uk')" or "Expediamail (com OR ca OR 'co.uk')" and limit the search to 'Sender' and 'From'.  

That part in the manual indeed explains it in more detail.

Let us know if you have any follow-up questions.


Link to comment
Share on other sites


I'll try that and see how it works. I'm constantly looking at what I can auto-tag for investigators to provide them with an overview of the type of data in the case. They can then use these tags to immediately start identifying content that is either not relevant, or potentially relevant. This is especially useful to tag emails from social media sites for example. An investigator may not think to look for that. But seeing it tagged will help them think of other types of emails as potentially containing relevant info (e.g., showing connection between parties by their interaction on social media generating a notification email).


Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...