Capture Database for use in Forensic Investigation search

Use the Forensic Investigation search to find captured content that contains certain keywords or file names, or came from certain users. For example, you could look for a keyword in a document that has been leaked from your organization by a specific member of staff.

Forensic Investigation searches look for keywords in the body of an email message, any message attachments, and some email headers (From, To, Cc, Subject, Reply-To) using either exact matches on single words or phrases, or partial matches (inexact matches).

Your search terms can include numerals and special characters such as mathematical symbols and currencies, and you can include logical operators (and/or) to build searches that look for multiple words or phrases. You can also search for specific files by name as they move around your network, including items in archive files.

Note

A Forensic Investigation search does not look for keywords in web request headers.

To search for the activity of a particular user, the DLP Capture feature evaluates the LDAP membership and groups. It looks at the information that exists at the time you create the search, rather than the time the content was captured. If the entries in the LDAP server have been changed, the search might not be able to analyze all the email messages or web posts performed by the user you are interested in. For example, you might need to investigate the activity of a user who has already left the company, in which case, the user might have been removed from the LDAP server and the search will be unable to find them.

Note

It is possible to run a forensic investigation without specifying any criteria, but the search will match against all the results in the dataset up to the configured limit.

Stop words

To reduce the number of results returned, the Forensic Investigation search ignores certain words in all languages. These are known as stop words, and include words such as "if", "the", "and", "or".

Language support and word stemming

The DLP Capture feature can analyze content in any, or all, of the following languages: English, French, German, Spanish, Japanese, and Traditional Chinese.

When searching for an exact text match, the search ignores any language selections and just looks for an exact match of the text you entered. However, if you want to look for an inexact match, the search stems the word to broaden the results. For example, searching for run will also return running, or searching for information stems the word to inform and also matches informal.

If you select a language and look for a word from another supported language, the text in the other supported languages is ignored by the search. If you choose to search all languages, all text is searched and stemmed accordingly. Any unidentified sections of text, such as groups of numbers or text in an unsupported language, is searched using the original search term and is not stemmed.

Note

If a plural or gerund of a complete word used in a search is found, the result returns all strings that contain that stem word.

Language and stemming example: Single keyword, single language

The keyword triggers if the language matches the input and they stem to the same word. If the input language is unrecognized or unsupported, the keyword will only trigger if it's an exact match.

Search selections

Language and stemming example: Single keyword, multiple (any) language

The keyword is stemmed in every supported language. The keyword triggers if any of the languages match the input and they stem to the same word. If the input language is unrecognized or unsupported, the keyword will only trigger if it's an exact match.

Search selections

Language and stemming example: Special cases

There are cases where a single keyword might stem into multiple stems. This can happen if the word contains a separator, like a hyphen.

When this happens, the additional stems are added as extra stems in a multi-keyword rule and the logical operator selected is applied.