Skip to main content
Druva Documentation

How to search backed up emails

inSync Cloud Editions: File:/tick.pngElite Plus         File:/tick.png Elite     File:/tick.png Enterprise     File:/tick.pngBusiness
(Purchase Separately)  (Purchase Separately)

The availability of this feature may be limited based on the license type, region, and other criteria. To access this feature, contact your Druva Account Manager or Druva Support.

Overview

Using the Federated Search capability, inSync administrators can quickly find end-user emails that are backed up by inSync. You can search only those emails that are backed up for the following email clients:

  • Gmail
  • Exchange Online
  • MAPI

email search on the new ui.png

Note

  • You cannot search emails saved in *.PST. folder. However, you can search PST files using file search
  • You cannot restore MAPI emails; you can only search and download MAPI emails.

Following is a list of metadata attributes that inSync indexes for emails:

  • Email subject
  • Attachment name for each email

 

When you search using keywords in an email address, the last word in the local-part of the email address and the last word in the domain name are not valid search queries. For example, if you search a user - ernie.carter@secure.druva.com, carter in the local-part and com in the domain name are not valid search queries.

Search Emails

Procedure

  1. On the inSync Management Console menu bar, click Governance > Federated Search.
  2. Select Emails and enter a part or the entire email subject or a part or the entire attachment name in the search box. Use the filters and search operators available for email search to narrow down your search results.

    If you have not selected the Match exact words filter, then all words in the search query should at least contain 3 characters. For example, "qu" or "quarterly re" are invalid search queries whereas "qua" or "quarterly rep" are valid search queries.

    The filters available for email search are described in the table below. 
Filter Name Description
From

Search emails from a particular sender.

In this field, you cannot enter names containing spaces. To add names containing spaces, copy the name containing spaces and paste it in this field. 

To/CC/BCC

Search emails that were sent to a specific recipient. 

In this field, you cannot enter names containing spaces. To add names containing spaces, copy the name containing spaces and paste it in this field. 

Email Sent/Received Between Search emails that were sent or received between a specific date range.  
Profiles Search emails created by users associated to a particular profile. Start typing the profile name to view the list of profiles that match your search string.

Legal Holds

Note:  This field is displayed only when you access Federated Search as a Legal Administrator.

Select the legal holds that you want to search. You can select multiple legal holds.

Users Search emails sent by a particular user. By default, inSync searches emails from all users but if you want to search emails from a specific user, enter the name of the user in this field.

Custodians

Note: This field is displayed only when you access Federated Search as a Legal Administrator.

Select the custodians whose backed up data you want to search.

Match exact words Select this check box if you want inSync to match the exact words of your query. For example, if your search query contains 2 characters, select this check box. 
Email(s) with attachment(s) only  Select this check box if you want to search emails that contain only attachments. 
Attachment Type Search emails that contain the attachment type specified in this filter. 
  1. Click the Search icon.

Search emails without email subject

 This functionality is available only for customers on-boarded after June 8, 2019. 

Federated Search enables you to search for emails using different email parameters such as from, to, date when the email was sent, attachment name and so on. This is useful when you don't know the subject of the email but are aware of any of the email parameters.  You can use one or a combination of the following parameters to search an email in inSync:

  • From: Enter the email ID of the user who had sent the email. 
  • Recipients: Enter the email IDs of the recipients of the email. 
  • Date: Enter the period when the email was sent or received. 
  • Name or SHA1 value: Enter the file name or the SHA1 hash value of the email attachment that you want to find. 
  • File Size: Define the range of the size of the file. 
  • Extension:  Enter the extension name of the attachment or select the extension name from the drop-down list. You can search for different extension types such as txtpngmp4, and so on.
  • Data Source: Select the data source where the email resides.
  • Profiles: Select the profile that is associated with the user who sent the email. 
  • Users: Select the user who sent the email. 

Download Emails

You can download all the emails that are displayed in the search results in EML format for further analysis and review.

Procedure

  1. Search for the emails that you want to download.
  2. Select the emails that you want to download and click Download.

If you select multiple emails, all the selected emails are downloaded in a compressed file format. Following is the file naming convention of the downloaded emails:

SearchResults-<Date stamp>, <Time stamp>.<file extension of the compressed file format>

Email Search Results

The search results show a maximum of 1000 results that match your search query. inSync displays the search results progressively; loading the search results while scrolling. Using the Email Result option, upto 20,000 search results in CSV format can be sent to the email address of the inSync administrator who is logged in.

Procedure

  1. Search for emails.
  2. Click Email Results. The search results are emailed to you in CSV format.

The fields in the CSV file are explained in the following table.

Filter Name Description
Time when searched Displays the date and time stamp when the search query was run.
Query Displays the search query that was entered.
Exact Match, Dates, Types, Attachments, From, Participants, Users, Device Platforms Each filter is represented in a separate line and it displays the value that you used for each filter. If you have not applied a particular filter then, it displays Not Applied beside that filter name. If you have applied a filter, then the value of the filter is displayed beside the filter name.
Matches Displays a numeric value of the number of search results that matched your search query. 
Subject Displays the subject of the email.
Attachments Displays all the attachments of the emails along with attachment name and file size. 
Send/Received Time Displays the date and time stamp when the email was sent or received.
From Displays the email ID of the email sender.
To Displays the email ID of the email receiver.
Cc Displays the email ID of the person who was CCed in the email.
Bcc Displays the email ID of the person who was BCCed in the email.
User ID Displays the unique ID of the user.
User Name Displays the name of the user associated with the User ID.
Device ID Displays the unique ID of the device.
Device Name Displays the name of the device where the file is stored.