DISCO search manual

DISCO uses Westlaw and Lexis-style search syntax with boolean search operators. These can be used in conjunction with a field, such as in privilegeNote(“attorney-client” or “work-product”), or in a fieldless search¹ in the DISCO search bar.

This guide explains how to search in DISCO.

Download the DISCO Search Quick Reference guide.

Search basics
Order of operations
Standard document fields
Numeric searches
Tag fields
Tag prediction
Date fields
Redactions
Custom fields

Search basics

DISCO removes most punctuation and non-alphanumeric characters from a search query. Periods, colons, semicolons, and apostrophes within a word are not removed. As an example, periods in a name or email address are indexed and searchable.

Operators	Description	Example
`&, and`	Includes results with both terms	`contract & payment` OR `contract and payment` — Documents that contain both contract and payment
`[space]``,` `or`	Includes results with either term or field	`contract payment` OR `contract or payment` — Documents that contain contract or payment
`%, not`	Excludes term or field from results	`contract % payment` OR `contract not payment` — Documents that contain contract but do not contain payment
`/n`	Proximity search, searching within n words, in any order	`contract /10 payment` — Documents that contain contract within ten words of payment, where the order is irrelevant
`+n`	Proximity search, searching within n words in prescribed order	`contract +10 payment` — Documents that contain contract within ten words of payment, where payment must precede contract
`“ ”`	Exact phrase intended²	`“contract payment”` — Documents that contain the exact phrase contract payment `“Matt.Motley@email.com”``³` — Documents that contain the email address Matt.Motley@email.com
`!`	Truncation search or root expander; can be used at the beginning or end of a term	`contract!` — Documents that contain any term starting with contract, for example, contract, contracts, contractual, contracting, or contracted `!contract` — Documents that contain any term ending with contract, for example, subcontract
*``**	Wildcard search for single character	*`contract`** — Searches for words that have one, but only one, character after contract, such as contracts, but not contracted, contractual, or contract
`~`	Fuzzy or approximate word search⁴	`guaranty~` — Searches for guaranty, guarantee, garanty, and similar (mis)spellings
`.`	Period in a name or email address	`Matt.Motley` — Documents that contain Matt.Motley (with the period), but not MattMotley (without the period)
`( )`	Grouping syntax	`(failure & consideration) & (contract agreement)` — Documents must contain both failure and consideration, and must also contain either contract or agreement
`sample(n, search)`	Returns n documents randomly selected from results of search. If n is less than 1, this number is treated as a percentage.	`sample(.5, contract)`; `sample(700, contract)` — Returns 50% and 700 of the search results for contract at random, respectively
`field(terms)`	Field searching (see below for standard DISCO fields)	`custodian(Holcombe)` — Documents with Holcombe in the custodian field

Order of operations

Exact phrases: “ ”
Groupings: ( )
Proximity: /n, +n
&, and, %, not
[space], or

Standard document fields

Search queries that do not specify a field search on document text, document notes, custodians, authors, and user defined fields.

Command	Description	Example
`batesNumber`	Field of Bates numbers applied to documents (either from DISCO production or from elsewhere)	`batesNumber(Enron000009)` — A document receiving the Bates stamp Enron000009 `batesNumber(Enron000007 to Enron000950)` — Documents with Bates numbers within the identified range
`batesPrefix`	The English portion of the Bates stamp	`batesPrefix(Enron)` — Documents that use Enron as a Bates prefix `batesPrefix(!)` — Documents with any Bates prefix
`DeDupHash`	The unique identifier used to deduplicate documents at the time of ingest	`DeDupHash(ABC123)` — The document with the ABC123 deduplication hash
`hashes`	Searches across deduphash, sha1hash, md5hash, and objecthash	`hashes(xyonqyiq3cfmwyt9szqpacl0b09v05oa7t6i1n6p)` — A document with the xyonqyiq3cfmwyt9szqpacl0b09v05oa7t6i1n6p hash
`id`	An identification number assigned by DISCO that is unique to each document in the database	`id(1200)` — The document with DISCO identification number 1200 `id(>500)` — Documents with DISCO identification numbers greater than 500
`ingestSessionId`	A number assigned to each group of documents ingested into DISCO	`ingestSessionId("IngestSessions/1")` — Documents ingested into DISCO in Ingest Session 1
`md5hash`	MD5 hash of the file binary; 32 characters	`md5hash(vgbc505ks2c28ekxy9v61bi4q0s5idip)` — The document with the vgbc505ks2c28ekxy9v61bi4q0s5idip MD5 hash
`objecthash⁵`	Hash of the file document, without considering the parent document; 40 characters	`objecthash(hpsrxok9xug43sr17g7ypheyiurrlu 7fx4dqj4wt)` — The document with the hpsrxok9xug43sr17g7ypheyiurrlu7fx4dqj4wt object hash
`production`	A name assigned by the user to each set of documents produced using DISCO	`production("defense")` — Documents produced in the defense production set
`referenceid`	Optional identification number users can assign (contact DISCO Client Success to do so)	`referenceid(245)` — Document with Reference ID number 245
`sha1hash`	SHA-1 hash of the file binary; 40 characters	`sha1hash(xyonqyiq3cfmwyt9szqpacl0b09v05oa7t6i1n6p)` — The document with the xyonqyiq3cfmwyt9szqpacl0b09v05oa7t6i1n6p SHA-1 hash

User-created information

Command	Description	Example
`documentNote`	Document note field (edited manually by DISCO users)	`documentNote(hot)` — Documents with the word hot in the document note field
`field`	Custom metadata field added by admin-level users that is used to capture additional information	`field(important)` — Documents with important in any user defined field
`folder`	Folder created in DISCO by a user	`folder("Hot Documents")` — Documents in the Hot Documents DISCO folder `folder("Hot Documents/Experts")` — Documents in the Experts subfolder `folder("Hot Documents/!")` — Documents in the Hot Documents folder and all subfolders
`privilegeNote`	A text field that will appear on privilege logs	`privilegeNote("Legal Advice")` — Documents using the phrase Legal Advice inside the privilege note
`redactionReason`	Optional user-created text that can overlay redactions	`redactionReason("Trade Secret")` — Documents with Trade Secret applied as a redaction reason
`stage`	A set of documents created by users for linear review	`stage("First Pass Review")` — Documents in the First Pass Review stage
`stageBatched`	Documents in stages that have been pulled into batches	`stageBatched("First Pass Review")` — Documents in the First Pass Review stage that have been placed in batches (whether or not yet reviewed)
`stageComplete`	Documents in stages that have been marked "reviewed" and checked-in	`stageComplete("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed and contained in a checked-in batch (i.e. complete)
`stageReviewed`	Documents in stages that have been marked "reviewed"	`stageReviewed("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed
`tag`	Fields appended to documents by users	`tag(responsive)` — Documents with the responsive tag
`taggroup`	Fields from a specific group appended to documents by users	`taggroup(Issue)` — Documents with a tag from the Issue group

Document metadata fields⁶

Command	Description	Example
`author`	Identifies the author or creator of a file (does not include the sender of an email)	`author(Jones)` — Documents that Jones authored
`bcc`	A recipient that was blind copied (or blind carbon copied) on an email	`bcc(Frank)` — Emails in which Frank (first or last name) is blind copied
`cc`	A recipient that was copied (or carbon copied) on an email	`cc(Thomas)` — Emails in which Thomas (either as a first or last name) is copied `cc("Frank Thomas")` — Emails in which Frank Thomas is copied
`custodian`	Typically the individual or location from which a document was collected	`custodian(Peterson or Jones)` — Documents that have Peterson or Jones in the custodian name field
`custodianExact`	An exact custodian name	`custodianExact("Andrew Lewis")` — Documents in which exactly Andrew Lewis is the custodian
`domain`	An email domain (typically, the text after the @ symbol)	`domain(winlaw.com)` — Emails sent to or from email addresses (also including cc and bcc fields) having winlaw.com as the domain (e.g., johnsmith@winlaw.com)
`folderpath`	Any folder in which a document was saved (such as a computer or network drive)	`folderpath("Deleted items")` — Documents that were in the Deleted items folder when collected Note: This search locates any discrete folder within the tree of folders and subfolders (e.g., MyComputer/Files/DeleteItems
`from`	Identifies the sender of an email	`from(Lee)` — Emails sent by Lee
`recipient`	Searches the combined email metadata fields: to, cc, and bcc (i.e., anyone who was the recipient of an email)	`recipient(Jones)` — Emails in which Jones appears in the metadata of the to, from, or bcc fields
`subject`	Searches the subject (or "re:" line) of an email	`subject(meeting)` — Emails with meeting in the subject line
`subjectNormalized`	Searches for exact match against the subject without "Re:" or "Fwd:"	`subjectNormalized("Transaction documents")` — Searches for the exact subject Transaction documents while ignoring "Re:" or "Fwd:"
`text`	The OCR (extracted text) information in an image	`text(Peter)` — Documents containing Peter anywhere within the image Note: This does not search metadata
`to`	Identifies to whom an email was sent (excludes the cc and bcc fields)	`to(Duncan)` — Emails in which Duncan (either as a first or last name) was in the to field `to("Duncan Kennedy")` — Emails sent to Duncan Kennedy

Document attributes

Command	Description	Example
`billingSize`	Returns all documents with the indicated size in bytes relative to the review database's billing statement	`billingSize(>1000000)` — Documents with a billing size greater than 1,000,000 bytes
`childCount`	Returns all parent documents that have the specified number of children ⁷	`childCount(2)` — Emails or other documents that have two children (such as attachments or embedded files) `childCount(1 to 1000)` — Emails or other documents that have between 1 and 1000 children
`comment`	Returns all documents with the indicated text left inline in the original file	`comment(!)` — All documents with comments in the original files
`company`	Returns all documents created by the same company	`company(Enron)` — Documents created by Enron
`conversationCount`	Returns all emails belonging to conversations⁸ that contain the number or range of emails specified	`conversationCount(3)` — Emails that contain three emails within the conversations `conversationCount(3 to 15)` — Emails that contain between three and 15 emails within the conversations
`extension`	Returns all documents with the specified file extension	`extension(.doc)` — Documents with the .doc file extension
`familyConsistentTag`	Returns documents where every family member has the specified tag. Limited to documents in families.	`familyConsistentTag(Responsive)`— Documents where every family member has a Responsive tag
`familyInconsistentTag`	Returns documents that do not have the specified tag, where at least one of its family members has the specified tag. Limited to documents in families.	`familyInconsistentTag(Responsive)`— Documents without a Responsive tag, where at least one of its family members has a Responsive tag
`fileLength`	Returns files corresponding to the specified size of the file (in bytes)	`fileLength(25000)` — Documents that are exactly 25,000 bytes `fileLength(>1000000)` — Documents with file sizes greater than 1,000,000 bytes
`filename`	The filename of any document Note: Emails often have filenames, though largely hidden in most applications, so consider excluding that type, if desired	`filename(Agenda.pdf)` — Documents with the exact filename agenda.pdf `filename(Agenda!)` — Documents that begin with Agenda in the filename (e.g., Agenda.pdf; AgendaForMay11.doc; or Agenda for Meeting.ppt)
`hasDetectedSlipsheet`	DISCO identifies when a slipsheet is produced in conjunction with a native file for load file ingests, and will create a near-native image from the native file and append it to the slipsheet in the document viewer	`hasDetectedSlipsheet(yes)` — Documents that have a slipsheet
`hasDocumentNote`	Returns documents that include a note	`hasDocumentNote(yes)` — Documents that have a note
`hasHiddenType`	Returns documents with hidden content detected	`has``HiddenType(yes)` — Documents that have hidden content detected
`hasImage`	Indicates if an item was processed as an image or not. An image is sometimes also referred to as a “near native” or “PDF.”	`has``Image(yes)` — Documents that were processed as images
`hasLanguage`	Documents that have an identified language	`hasLanguage(yes)` — Documents that have a language identified
`hasNative`	Indicates if the native file was not supplied. If an image is supplied, DISCO will use that to populate the native file link. If no native or image is supplied, DISCO will create a near-native image from the supplied text and use that to populate the native link.	`hasNative(yes)` — Documents with a native file supplied
`hasOCR`	Returns documents for which any of the extracted text was derived via OCR	`hasOCR(yes)` — Documents with text extracted via OCR
`hasPrivilege`	Returns documents that include a privilege tag	`hasPrivilege(yes)` — Documents with a privilege tag
`hasSearchText`	Returns documents that include searchable text	`hasSearchText(yes)` — Documents with searchable text
`hasWorkProduct`	Documents that have any tags, folders, notes, fields, or have been reviewed within a stage or produced	`hasWorkProduct(yes)` — Documents that have any work product applied
`hasWrongExtension`	Indicates if the extension of an ingested item is inconsistent with the determined type	`hasWrongExtension(yes)` — Documents ingested as a file type that differs from the indicated type
`hiddentText`	Hidden text is text that has been set to be hidden in the original file	`hiddentText(yes)` — Documents that have hidden text in their original files
`hiddentype`	Identifies whether hidden data is in a file, including comments, revisions, notes, hidden sheets, or very hidden sheets Note: Users must specify type⁹	`hiddentype(revisions)` — Documents with hidden revisions
`imageSize`	Returns documents with the indicated size in bytes of the document’s image file	`imageSize(>1000000)` — Documents whose image size is greater than 1,000,000 bytes
`ingestType`	Indicates which of the two types of data deliveries can be processed: Native — Files delivered as they were maintained during the normal course of business Load file - Files (either images only or images with natives) accompanied by a load file that supplies family relationship and metadata information	`ingestType(native)` — Documents processed as native files
`invisibleText`	Invisible text is text that is the same color as its background	`invisibleText(yes)` — Documents that contain invisible text
`isDetectedEmail`	Files identified as emails during processing based on an examination of the file's text/OCR	`isDetectedEmail(yes)` — Documents identified as emails
`isInclusive`	Returns emails with unique content	`isInclusive(yes)` — Filters out emails that are duplicated within inclusive emails
`isProcessedAsNative`	Indicates that some aspect of processing was unsuccessful. However, DISCO will create a record in the matter with a link to the native file.	`isProcessedAsNative(yes)` — Documents that were processed unsuccessfully
`language`	Searches for documents with specific languages (English, German, French, Portuguese, Spanish, Chinese, Japanese, Korean, or Undetermined)	`language(German)` — Documents that include the German language
`pageCount`	Returns documents containing the specified number of pages in an image	`pageCount(1)` — Documents that have one page `pageCount(101 to 3000)` — Documents whose image has between 101 and 3000 pages
`parentCount`	Returns documents with the specified number or range of parents	`parentCount(1)` — Children (such as attachments or embedded files) that have only one parent `parentCount(0)` — Only parents (i.e., excludes all attachments and embedded files)
`path`	Location from which the document was collected	`path("My Computer/Deleted Items/!")` — Documents that were saved, when collected, in the My Computer/Deleted Items folder, as well as all documents in subfolders
`prediction`	Tag predictions are useful for finding documents that DISCO predicts are likely or unlikely to receive a specific tag	`prediction("responsive", highly likely)` — Documents that are highly likely to be tagged responsive `prediction("Work-Product", >20)` — Documents that have a likelihood score over 20 to be tagged Work-Product
`primaryLanguage`	Returns documents that have the specified primary language	`primaryLanguage(French)` — Documents in which the greatest portion of the content is in French
`processingDetails`	Returns documents with the specified processing reason	`processingDetails(Password protected)` — Documents that were identified as password protected during processing
`processingStatus`	Returns documents with the specified processing outcome	`processingStatus(Successful)` — Documents that were successfully processed
`speakerNote`	Speaker notes are slide-specific notes that are hidden from the audience, but are visible to the presenter while editing	`speakerNote(yes)` — Documents that include speaker notes
`tagcount`	Useful for figuring out whether a document has been tagged or not	`tagcount(2)` — Documents with exactly two tags `tagcount(>3)` — Documents with more than three tags
`textLength`	Returns documents with the specified number or range of characters in the text of an image (including spaces)	`textLength(3000000)` — Documents with 300,000 characters in the text
`title`	Returns documents with the specified document title	`title(``GAS PURCHASE AGREEMENT``)` — Documents whose metadata title is GAS PURCHASE AGREEMENT
`type`	The type of a document in DISCO is the file type (e.g., email, Word, PDF, audio, Excel, video, or text)	`type(Word)` — All Word files `type(email)` — All emails
`unfoldered`	Folders are used for organizing documents	`unfoldered(yes)` — Documents that are not in a folder

Numeric searches

For the following, you can search for an exact document, a range of documents, or documents greater than or less than the indicated value (for example, id(1234), id(1 to 1234), and id(<1234), respectively).

id( )
batesNumber( )
billingSize( )
childCount( )
conversationCount( )
fileLength( )
imageSize( )
instanceCount( )
pageCount( )
parentCount( )
similarCount( )
tagcount( )
textLength( )

Tag fields

Tagging decisions can also be searched by dates applied and users applying them, using the following syntaxes:

Syntax	Description
`tag(by reviewer@lawfirm.com)`	Documents tagged by reviewer@lawfirm.com
`tag(responsive & by reviewer@lawfirm.com)`	Documents tagged responsive by reviewer@lawfirm.com
`tag(non-responsive % by reviewer@csdisco.com)`	Documents tagged non-responsive by someone other than reviewer@csdisco.com
`sample(10, tag(by reviewer@csdisco.com))`	Ten random documents tagged by reviewer@csdisco.com
`tag(by reviewer@csdisco.com & on 10/16/2015)`	Documents tagged by reviewer@csdisco.com on 10/16/2015
`tag(responsive & by reviewer@csdisco.com & before 10/16/2015)`	Documents tagged responsive by reviewer@csdisco.com before 10/16/2015
`removedTag(responsive)`	Documents from which the responsive tag was removed (by anyone)
`removedTag(by reviewer@lawfirm.com)`	Documents from which any tags were removed by reviewer@lawfirm.com
`taggroup(Issue)`	Documents with at least one tag from the Issue tag group
*` % tag(!)`**	Documents that have zero tags associated

Tag prediction

Tag prediction uses AI to predict a tag or tags that should be applied to a document. Tag prediction search syntax is displayed below. Search syntax can accommodate multiple tags, e.g., prediction("tag name1" & "tag name2", >20).

Syntax Description

prediction("tag name", Likeliness value)

prediction(Attorney-Client, Highly likely)

— Documents that are highly likely to be tagged Attorney-Client

prediction(Attorney-Client, Likely)

— Documents that are likely to be tagged Attorney-Client

prediction(Attorney-Client, Neutral)

— Documents that are neither likely nor unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Unlikely)

— Documents that are unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Highly unlikely)

— Documents that are highly unlikely to be tagged Attorney-Client

prediction("tag name", score range)

prediction(Attorney-Client, -20 to 20)

— Documents that have a likelihood score in the range of -20 to 20 to be tagged Attorney-Client

prediction(Attorney-Client, >20)

— Documents that have a likelihood score over 20 to be tagged Attorney-Client

prediction("tag name", exact score)

prediction(Attorney-Client, 20)

— Documents that have a likelihood score of 20 to be tagged Attorney-Client

Date fields

Dates can be searched by exact date, a range of dates, and before or after a date (for example, createDate(5/4/09), createDate(5/4/09 to 5/10/09), and createDate(before 5/10/09), respectively).

Dates can be formatted as date certain (12/10/2015), month and year (9/2016), or year (2012).

allDates( )
conversationdate( )¹⁰
createDate( )
date( )¹¹
familydate( )¹²
lastaccesseddate( )
lastmodifieddate( )
lastprinteddate( )
loaddate( )
receiveddate( )
sendDate( )

Redactions

Syntax Description Example

hasRedaction

Searches for documents that have redactions, do not have redactions, or have redactions in a specific location. Value options are yes, no, onDocument, onMetadata, and any metadata fields.

hasRedaction(onDocument) % hasRedaction(onMetadata) — Documents with a redaction in the document but not in the metadata

hasRedaction(to) — Emails with redaction in the to metadata field

hasRedactionReason

Searches for documents that have redaction reasons, do not have redaction reasons, or have redaction reasons in a specific location

hasRedactionReason(author) — Documents with a redaction reason for the author metadata field

hasRedactionReason(yes) — Documents that have a redaction reason

hasRedactionWithoutReason

Searches for documents that have a redaction, but no corresponding redaction reason. Value options are yes, no, onDocument, onMetadata, and any metadata field.

hasRedactionWithoutReason(yes) — Documents with a redaction that does not have a corresponding redaction reason

hasRedactionWithoutReason(onMetadata) — Documents with metadata redactions that do not have a corresponding redaction reason

Custom fields

DISCO supports user defined fields created in the product, and custom fields ingested from a load file. The search syntax works similarly for both types of custom fields.

Example	Description
`Deposition(!)`	Documents with any contents in the Deposition field
`Deposition(Important)`	Documents with the word Important in the Deposition field
`"My notes"(!)`	Documents with any contents in the My notes field
`"My notes"("Review again")`	Documents with Review again in the My notes field

There are two additional searches for user defined fields.

Example	Description
`hasFields(true)`	Documents with contents in any user defined field
`field("Red Team")`	Documents with Red Team in any user defined field

For a training video about DISCO's search and review features, see DISCO 101: Search & Review.

Fieldless (keyword) searches the document text, document notes, subject lines, custodians, authors, and user defined fields.
Word operators (and, or, and not) can be searched if placed in quotation marks, e.g., “contract and payment”
Because the @ symbol is not indexed, to search for an email address, the address must be contained in quotes.
Fuzzy searching allows for the addition, deletion, or substitution of up to two letters in a word.
For non-email files, objecthash is the same as sha1hash. For email files, objecthash is computed by extracting and hashing parts of an email including sent date, sender, message body, and a few more.
Metadata is data about a document that is not part of the document’s content. Metadata can include things like the creation date, author, sending and receiving information, file name, and file path.
A child is typically either an attachment to an email or an embedded file in a document. A parent is the email containing the attachment or the document containing the file.
Conversations include the various responses, replies, and forwards of an email chain.
Choices include revisions, hidden sheets, very hidden sheets, comments, and notes.
For all documents in an email conversation, the conversation date is the sent date of the first email in the conversation. Emails have a sent date, but other document types do not.
date( ) refers to the sent date for emails, or the last modified date for other files.
For all documents in a family, the family date is the sent date of the head of the family.

CONTENTS

Search basics

Order of operations

Standard document fields

User-created information

Document metadata fields⁶

Document attributes

Numeric searches

Tag fields

Tag prediction

Date fields

Redactions

Custom fields

Articles in this section

CONTENTS

Search basics

Order of operations

Standard document fields

User-created information

Document metadata fields6

Document attributes

Numeric searches

Tag fields

Tag prediction

Date fields

Redactions

Custom fields

Related articles

Articles in this section

Document metadata fields⁶