Mailbox Search
A collected mailbox is complete, and completeness is the problem. Thirty thousand emails is the right thing to have collected and the wrong thing to read.
Mailbox search is the step after collection. We take the sealed collection, apply the terms and dates you give us, and hand back only what matches — as a bundle you can put in front of someone.
It runs on a mailbox Traces has already collected. We don't search a live account, because a live account changes while you're looking at it.
What do you need from me?
Search terms
Words, phrases, names, email addresses, domains. The more specific, the better the result — though we'll tell you if a term is so broad it'll return half the mailbox.
A date range
Usually the period the dispute covers, often with a margin either side.
The custodians
Which of the collected mailboxes to search. It can be all of them.
What "relevant" means for this matter
This is the one people skip and it matters most. A search returns what matches; it doesn't know what you're looking for. A sentence on what the matter turns on lets us tell the difference between a hit and a result.
We'll agree all of this with you before we start, and we'll write it down. The bundle records exactly what was searched for, so anyone can see how the set was arrived at.
What do we do?
We search the full text of every email in scope — subject lines, message bodies, headers, and the contents of attachments where the format allows it. We'll always provide a report detailing what we couldn't search before we do anything, so you have a chance to decide if the search is not going to yield the desired results.
Threads are kept whole. If one message in a chain matches, you get the chain, because a reply on its own usually means nothing.
Where searching has limits
Text inside a scanned image or a photographed document won't match a keyword search, because there's no text to match. Neither will a term that was only ever said on a call. We'll tell you when we think a gap like that is likely, and the chain of custody records what was and wasn't searchable.
Refining
The first pass is rarely the last. A term you were confident about returns four thousand results; a name you thought was peripheral turns out to be the whole matter.
We'll come back to you with what the first pass produced and how big it is, and you can adjust — narrow a term, add a name, move the dates. Refinements are part of the service, not a new instruction.
Every version of the search is recorded, so the bundle shows how you got from the first pass to the final set.
Our own records of the engagement - who instructed us, what we were asked to do, what we did - is retained for six years. Traces will hold a copy of the ZIP for 90 days once we have confirmed you have downloaded and can access the bundle. You can at any time request the deletion of your collection from Traces.
What do I get back?
Your results, as EML files
The full original email, with sender, recipients, timestamps and attachments intact, exactly as collected. We can also provide them as PDF where you need something to exhibit directly.
The search record
What terms were run, over which custodians, across what dates, and how many results each returned — including the passes you refined away. Anyone reviewing the bundle can see how the set was built rather than having to take it on trust.
Chain of custody
The collection this search ran against, when it was performed, and by whom. It links back to the original collection so the whole line from mailbox to exhibit is unbroken.
Hash list
Every file in the result set, signed. The hashes match the original collection, which is how you show that nothing changed between collection and exhibit.
Item manifest
A readable CSV of every result — custodian, folder, subject, from, to, sent and received timestamps, which search term matched, and the hash.
Our own records of the engagement - who instructed us, what we were asked to do, what we did - is retained for six years. Traces will hold a copy of the ZIP for 90 days once we have confirmed you have downloaded and can access the bundle. You can at any time request the deletion of your collection from Traces.