zhongwei91 Posted November 6, 2014 Report Share Posted November 6, 2014 Hey there, Need some clarification on "Unread" Column. From my understanding, the "Unread" column will only flag out emails that are unread at the time of indexing. Is it safe to say that emails that were flagged are unread and email that were not flagged were read? Will this also be consistent across different email platform (LN, Outlook, etc.)? Will there also be any indicator for email that are previewed but not open? Thanks and Regards, Z.W Link to comment Share on other sites More sharing options...
Chris Posted November 10, 2014 Report Share Posted November 10, 2014 Hey there, Need some clarification on "Unread" Column. From my understanding, the "Unread" column will only flag out emails that are unread at the time of indexing. Is it safe to say that emails that were flagged are unread and email that were not flagged were read? Will this also be consistent across different email platform (LN, Outlook, etc.)? Will there also be any indicator for email that are previewed but not open? Thanks and Regards, Z.W Hello, The Unread column reflects whether the evidence data marks the item as unread. There are several caveats to be made here: If this property is not set, it could mean that the item has been read or that its read status is unknown - at the moment we don't distinguish between these two situations. At the moment this property is only available for mails in a PST or OST file and for some messages in a cellphone dump. Some tools allow the user to set a message back to "unread", so even when the flag is set, it cannot be said with certainty that the message is unread. As for the previewed status: you mean previewed by the Intella user? This is reflected by the "Previewed" column and Features facet category. Note that there are also "Opened" and "Exported" categories. Link to comment Share on other sites More sharing options...
AdamS Posted November 11, 2014 Report Share Posted November 11, 2014 Christian I think the preview reference is when the preview pane is active in Outlook and the email itself can largely be read without actually having to 'open' the email. Link to comment Share on other sites More sharing options...
zhongwei91 Posted November 11, 2014 Author Report Share Posted November 11, 2014 Hello, The Unread column reflects whether the evidence data marks the item as unread. There are several caveats to be made here: If this property is not set, it could mean that the item has been read or that its read status is unknown - at the moment we don't distinguish between these two situations. At the moment this property is only available for mails in a PST or OST file and for some messages in a cellphone dump. Some tools allow the user to set a message back to "unread", so even when the flag is set, it cannot be said with certainty that the message is unread. As for the previewed status: you mean previewed by the Intella user? This is reflected by the "Previewed" column and Features facet category. Note that there are also "Opened" and "Exported" categories. Christian, thanks for the reply. Regarding the previewed status, it's as what Adam mention. Link to comment Share on other sites More sharing options...
igor_r Posted November 12, 2014 Report Share Posted November 12, 2014 Hi, Will there also be any indicator for email that are previewed but not open? I'm afraid it's not possible to say whether some email was previewed but not opened in Outlook. Intella uses PR_MESSAGE_FLAGS property to determine the "Unread" status of the message: http://msdn.microsoft.com/en-us/library/cc839733(v=office.15).aspx Please let us know if you are aware of such a property that can be used to determine "Previewed" or "Opened" status. Link to comment Share on other sites More sharing options...
Recommended Posts