Document metadata fields in eDiscovery (Premium)

Je li ova stranica od pomoći?

Imate dodatne povratne informacije?

Povratne informacije će biti poslane kompaniji Microsoft: pritiskom na dugme za slanje, vaše povratne informacije će se koristiti za unapređivanje proizvoda i usluga kompanije Microsoft. Pravila privatnosti.

Note

Microsoft 365 compliance is now called Microsoft Purview and the solutions within the compliance area have been rebranded. For more information about Microsoft Purview, see the blog announcement.

The following table lists the metadata fields for documents in a review set in a case in Microsoft Purview eDiscovery (Premium). The table provides the following information:

• Field name and Display field name: The name of the metadata field and the name of the field that's displayed when viewing the file metadata of a selected document in a review set. Some metadata fields aren't included when viewing the file metadata of a document. These fields are highlighted with an asterisk (*).

• Searchable field name: The name of the property that you can search for when running a review set query. A blank cell means that you can't search for the field in a review set query.

• Exported field name: The name of the metadata field that included when documents are exported. A blank cell means the field isn't included with the exported metadata.

• Description: A description of the metadata field.

Note

The Keywords field in review set search uses Keyword Query Language (KQL). The fields listed in the Searchable field name column can be used in the Keywords field in a review set search to form complex queries without you having to use the query builder. For more information about KQL, see Keyword Query Language syntax reference.

---

Field name and Display field name	Searchable field name	Exported field name	Description
Attachment Content Id	AttachmentContentId		Attachment content Id of the item.
Attorney client privilege score	AttorneyClientPrivilegeScore		Attorney-client privilege model content score.
Author	Author	Doc_authors	Author from the document metadata.
BCC	Bcc	Email_bcc	Bcc field for message types. Format is DisplayName <SMTPAddress>.
CC	Cc	Email_cc	Cc field for message types. Format is DisplayName <SMTPAddress>.
Compliance labels	ComplianceLabels	Compliance_labels	Retention labels applied to content in Office 365.
Compound Path	CompoundPath	Compound_path	Human readable path that describes the source of the item.
Content*	Content		Extracted text of the item.
Conversation Body	ConversationBody		Conversation body of the item.
Conversation ID	ConversationId	Conversation_ID	Conversation Id from the message. For Teams 1:1 and group chats, all transcript files and their family items within the same conversation share the same Conversation ID. For more information, see eDiscovery (Premium) workflow for content in Microsoft Teams.
Conversation Family ID	ConversationFamilyID	ConversationFamilyID	The Id that identifies individual elements of a conversation as well as the related items in the conversation.
Conversation Index		Conversation_index	Conversation index from the message.
Conversation Name		ConversationName	This field depends on content type. Teams 1:1 chat: first 40 characters of first message. Teams 1:N chat: Name of group chat; if not available, the first 40 characters of the first message. Teams Channel Post: Post title or announcement subhead; if not available, the first 40 characters of the first message.
Conversation Pdf Time	ConversationPdfTime		Date when the PDF version of the conversation was created.
Conversation Redaction Burn Time	ConversationRedactionBurnTime		Date when the PDF version of the conversation was created for Chat.
Conversation Topic	ConversationTopic		Conversation topic of the item.
Conversation Type	ConversationType	ConversationType	The type of chat conversation. Values are: Teams 1:1 and group chats and all Yammer conversations: Group Teams channels and private channels: Channel
Contains Deleted Message	ContainsDeletedMessage	ContainsDeletedMessage	Indicates if the chat transcript includes a deleted message
Contains Edited Message	ContainsEditedMessage	ContainsEditedMessage	Indicates if the chat transcript includes an edited message
Teams Announcement Title	TeamsAnnouncementTitle	TeamsAnnouncementTitle	Title from a teams announcement.
		Converted_file_path	The path of the converted export file. For internal Microsoft use only.
Custodian	Custodian	Custodian	Name of the custodian the item was associated with.
Date	Date	Date	Date is a computed field that depends on the file type. Email: Sent date Email attachments: Last modified date of the document; if not available, the parent's sent date Embedded documents: Last modified date of the document; if not available, the parent's last modified date SPO documents (includes modern attachments): Last modified date of the document; if not available, SharePoint last modified date Non-Office 365 documents: Last modified date Meetings: Meeting start date VoiceMail: Sent date IM: Sent date Teams: Sent date
Document comments	DocComments	Doc_comments	Comments from the document metadata.
Document company		Doc_company	Company from the document metadata.
Document date created	CreatedTime	Doc_date_created	Create date from document metadata.
DocIndex*			The index in the family. -1 or 0 means it is the root.
Document keywords		Doc_keywords	Keywords from the document metadata.
Document modified by		Doc_modified_by	The user who last modified the document from document metadata.
Document revision	Doc_Version	Doc_Version	Revision from the document metadata.
Document subject		Doc_subject	Subject from the document metadata.
Document template		Doc_template	Template from the document metadata.
DocLastSavedBy		Doc_last_saved_by	The name of the user who last saved the document.
Dominant theme	DominantTheme	Dominant_theme	Dominant theme as calculated for analytics.
Duplicate subset		Duplicate_subset	Group ID for exact duplicates.
EmailAction*		Email_action	Values are None, Reply, or Forward; based on the subject line of a message.
Email Delivery Receipt Requested		Email_delivery_receipt	Email address supplied in Internet Headers for delivery receipt.
Importance	EmailImportance	Email_importance	Importance of the message: 0 - Low; 1 - Normal; 2 - High
Ignored processing errors	ErrorIgnored	Error_Ignored	Error was ignored and not remediated.
EmailInternetHeaders	EmailInternetHeaders	Email_internet_headers	The full set of email headers from the email message
EmailLevel*		Email_level	Indicates a message's level within the email thread it belongs to; attachments inherit its parent message's value.
Email Message Id		Email_message_ID	Internet message Id from the message.
EmailReadReceiptRequested		Email_read_receipt	Email address supplied in Internet Headers for read receipt.
Email Security	EmailSecurity	Email_security	Security setting of the message: 0 - None; 1 - Signed; 2 - Encrypted; 3 - Encrypted and signed.
Email Sensitivity	EmailSensitivity	email_sensitivity	Sensitivity setting of the message: 0 - None; 1 Personal; 2 - Private; 3 - CompanyConfidential.
Email set	EmailSet	Email_set	Group ID for all messages in the same email set.
EmailThread*		Email_thread	Position of the message within the email set; consists of node IDs from the root to the current message and are separated by periods (.).
		Export_native_path	The path of the exported file.
Extracted content type		Native_type	Extracted content type, in the form of mime type; for example, image/jpeg
		Extracted_text_path	The path to the extracted text file in the export.
ExtractedTextLength*		Extracted_text_length	Number of characters in the extracted text.
FamilyDuplicateSet*		Family_duplicate_set	Numeric identifier for families that are exact duplicates of each other (same content and all the same attachments).
Family ID	FamilyId	Family_ID	Groups together attachments and extracted items from email and chats with its parent item. This includes the chat or email and all attachments and extracted items.
Family Size		Family_size	Number of documents in the family.
File class	FileClass	File_class	For content from SharePoint and OneDrive: Document. For content from Exchange: Email or Attachment. For content from Teams or Yammer: Conversations.
File ID	FileId	File_ID	Document identifier unique within the case.
File system date created		File_system_date_created	Created date from file system (only applies to non-Office 365 data).
File system date modified		File_system_date_modified	Modified date from file system (only applies to non-Office 365 data).
File Type	FileType		File type of the item based on file extension.
Group Id	GroupId	Group_ID	Groups together all items for email and documents. For email, this includes the message and all attachments and extracted items. For documents, this includes the document and any embedded items.
Has attachment	EmailHasAttachment	Email_has_attachment	Indicates whether or not the message has attachments.
Has attorney	HasAttorney		True when at least one of the participants is found in the attorney list; otherwise, the value is False.
HasText*		Has_text	Indicates whether or not the item has text; possible values are True and False.
Immutable ID		Immutable_ID	This Id is used to uniquely identify a document within a review set. This field can't be used in a review set search and the Id can't be used to access a document in its native location.
Inclusive type	InclusiveType	Inclusive_type	Inclusive type calculated for analytics: 0 - not inclusive; 1 - inclusive; 2 - inclusive minus; 3 - inclusive copy.
In Reply To Id		In_reply_to_ID	In reply to Id from the message.
InputFileExtension		Original_file_extension	The original file extension of the file.
InputFileID		Input_file_ID	The file ID of the top level item in the review set. For an attachment, this ID will be the ID of the parent. This can be used to group families together.
Is modern attachment	IsModernAttachment		This file is a modern attachment or linked file.
Is from document version	IsFromDocumentVersion		Current document is from a different version of another document.
Is email attachment	IsEmailAttachment		This item is from an email attachment that shows up as an attached item to the message.
Is inline attachment	IsInlineAttachment		This was attached inline and shows up in the body of the message.
Is Representative	IsRepresentative	Is_representative	One document in every set of exact duplicates is marked as representative.
Item class	ItemClass	Item_class	Item class supplied by exchange server; for example, IPM.Note
Last modified date	LastModifiedDate	Doc_date_modified	Last modified date from document metadata.
Load ID	LoadId	Load_ID	The Id of the load set in which the item was added to a review set.
Location	Location	Location	String that indicates the type of location that documents were sourced from. Imported Data - Non-Office 365 data Teams - Microsoft Teams Exchange - Exchange mailboxes SharePoint - SharePoint sites OneDrive - OneDrive accounts
Location name	LocationName	Location_name	String that identifies the source of the item. For exchange, this will be the SMTP address of the mailbox; for SharePoint and OneDrive, the URL for the site collection.
		Marked_as_pivot	This file is the pivot in a near duplicate set.
Marked as representative	MarkAsRepresentative		One document from each set of exact duplicates is marked as representatives.
Meeting End Date	MeetingEndDate	Meeting_end_date	Meeting end date for meetings.
Meeting Start Date	MeetingStartDate	Meeting_start_date	Meeting start date for meetings.
Message kind	MessageKind	Message_kind	The type of message to search for. Possible values: contacts docs email externaldata faxes im journals meetings microsoftteams (returns items from chats, meetings, and calls in Microsoft Teams) notes posts rssfeeds tasks voicemail
Modern Attachment Parent Id		ModernAttachment_ParentId	The Immutable Id of the document's parent.
Native Extension	NativeExtension	Native_extension	Native extension of the item.
Native file name	NativeFileName	Native_file_name	Native file name of the item.
NativeMD5		Native_MD5	MD5 hash (128-bit hash value) of the file stream.
NativeSHA256		Native_SHA_256	SHA256 hash (256-bit hash value) of the file stream.
ND/ET Sort: Excluding attachments	NdEtSortExclAttach	ND_ET_sort_excl_attach	Concatenation of the email thread (ET) set and Near-duplicate (ND) set. This field is used for efficient sorting at review time. A D is prefixed to ND sets and an E is prefixed to ET sets.
ND/ET Sort: Including attachments	NdEtSortInclAttach	ND_ET_sort_incl_attach	Concatenation of an email thread (ET) set and near-duplicate (ND) set. This field is used for efficient sorting at review time. A D is prefixed to ND sets and an E is prefixed to ET sets. Each email item in an ET set is followed by its appropriate attachments.
Near Duplicate Set		ND_set	Items that are similar to the pivot document share the same ND_set.
O365 authors		O365_authors	Author from SharePoint.
O365 created by		O365_created_by	Created by from SharePoint.
O365 date created		O365_date_created	Created date from SharePoint.
O365ModifiedDate		O365_date_modified	The date a document (or document version) collected from SharePoint or OneDrive for Business was modified. This is the same modified date as the one displayed in the version history in the SharePoint and OneDrive user experience.
O365 modified by		O365_modified_by	Modified by from SharePoint or OneDrive.
Other custodians	DedupedCustodians	Deduped_custodians	List of custodians of documents that are exact duplicates (for email, based on content; for documents, based on hash).
Other file IDs	DedupedFileIds	Deduped_file_IDs	List of file IDs of documents that are exact duplicates (for email, based on content; for documents, based on hash).
Other paths	Dedupedcompoundpath	Deduped_compound_path	List of compound paths of documents that are exact duplicates (email: based on content, documents: based on hash).
Parent ID	ParentId	Parent_ID	Id of the item's parent.
ParentNode		Parent_node	The closest preceding email message in the email thread.
Participant domains	ParticipantDomains	Email_participant_domains	List of all domains of participants of a message.
Participants	Participants	Email_participants	List of all participants of a message; for example, Sender, To, Cc, Bcc.
Pivot ID	PivotId	Pivot_ID	The ID of a pivot.
Potentially privileged	PotentiallyPrivileged	Potentially_privileged	True if attorney-client privilege detection model considers the document potentially privileged
Processing status	ProcessingStatus	Error_code	Processing status after the item was added to a review set.
Read percentile	ReadPercentile		Read percentile for the document based on Relevance.
Received	Received	Email_date_received	The date and time the email was received in UTC.
Recipient Count		Recipient_count	Number of recipients in the message.
Recipient domains	RecipientDomains	Email_recipient_domains	List of all domains of recipients of a message.
Recipients	Recipients	Email_recipients	List of all recipients of a message (To, Cc, Bcc).
		Redacted_file_path	The path of the redacted replacement file in the export.
		Redacted_text_path	The path of the redacted text file replacement in the export. For internal Microsoft use only.
Relevance tag Case issue 1		Relevance_tag_case_issue_1	Relevance tag Case issue 1 from Relevance.
Relevance score	RelevanceScore		Relevance score of a document based on Relevance.
Relevance tag	RelevanceTag		Relevance score of a document based on Relevance.
Representative ID	RepresentativeId		Numeric identifier of each set of exact duplicates.
		Row_number	The row number of the item in the load file.
Sender	Sender	Email_sender	Sender (From) field for message types. Format is DisplayName <SmtpAddress>.
Sender/Author	SenderAuthor		Calculated field comprised of the sender or author of the item.
Sender domain	SenderDomain	Email_sender_domain	Domain of the sender.
Sent	Sent	Email_date_sent	Sent date of the message. Chats: Beginning date from the transcript
Set Order: Inclusive First	SetOrderInclusivesFirst	Set_order_inclusives_first	Sorting field - email and attachments: counter-chronological; documents: pivot first then by descending similarity score.
Set ID		Set_ID	Documents of similar content (ND_set) or email within the same email thread (Email_set) share the same Set_ID.
SimilarityPercent		Similarity_percent	Indicates how similar a document is to the pivot of the near duplicate set.
Native file size	Size	Native_size	Number of bytes of the native item.
Subject	Subject	Email_subject	Subject of the message.
Subject/Title	SubjectTitle		Calculated field comprised of the subject or title of the item.
Tags	Tags	Tags	Tags applied in a review set.
Channel Name	Channel	ChannelName	This is the Teams channel name. Only applies to Microsoft Teams content.
Team Name	TeamName	TeamName	Teams: Name of team Yammer: Community name
Themes list	ThemesList	Themes_list	Themes list as calculated for analytics.
Title	Title	Doc_title	Title from the document metadata. Title from the document metadata. For Teams and Yammer content, this is the value from the ConversationName property.
To	To	Email_to	To field for message types. Format is DisplayName<SmtpAddress>
Unique in email set	UniqueInEmailSet		False if there's a duplicate of the attachment in its email set.
Version Group ID		Version_Group_Id	Groups together the different versions of the same document.
VersionNumber		Version_Number	The version number of a document collected from SharePoint or OneDrive for Business. This is the same version number as the one displayed in the version history in the SharePoint and OneDrive user experience.
Was Remediated	WasRemediated	Was_Remediated	True if the item was remediated, otherwise False.
Word count	WordCount	Word_count	Number of words in the item.

Note

For more information about searchable properties when searching Office 365 content locations when you're collecting data for an eDiscovery (Premium) case, see Keyword queries and search conditions for Content Search.