DISCO search manual

DISCO uses Westlaw and Lexis-style search syntax with boolean search operators. These can be used in a fieldless search or with a field such as tag(Responsive or "Further Review"). This guide explains how to search in DISCO. For a training video about DISCO's search and review features, see DISCO 101: Search & Review.

Search basics
Order of operations
Standard document fields
Numeric searches
Tag fields
Tag predictions
Date fields
Redactions
Custom fields

Search basics

Operators	Description	Example
`&, and`	Includes results with both terms	`contract & payment` `contract and payment` — Documents that contain both contract and payment
`[space]``,` `or`	Includes results with either term or field	`contract payment` `contract or payment` — Documents that contain contract or payment
`%, not`	Excludes term or field from results	`contract % payment` `contract not payment` — Documents that contain contract but do not contain payment
`/n`	Proximity search, searching within n words, in any order	`contract /10 payment` — Documents that contain contract within ten words of payment, where the order is irrelevant
`+n`	Proximity search, searching within n words in prescribed order	`contract +10 payment` — Documents that contain contract within ten words of payment, where contract must precede payment
`“ ”`	Exact phrase intended	`“contract payment”` — Documents that contain the exact phrase contract payment `“Matt.Motley@email.com”` — Documents that contain the email address Matt.Motley@email.com Be sure to include quotes when searching for an email address.
`!`	Truncation search or root expander; can be used at the beginning of a term, end of a term, or both	`contract!` — Documents that contain any term starting with contract, for example, contract, contracts, contractual, contracting, or contracted `!contract` — Documents that contain any term ending with contract, for example, subcontract `filename(!contract!)` — Documents with the term contract anywhere in the file name
*``**	Wildcard search for single character	*`contract`** — Searches for words that have one, but only one, character after contract, such as contracts, but not contracted, contractual, or contract
`~`	Fuzzy or approximate word search. Fuzzy searching allows for the addition, deletion, or substitution of up to two letters in a word.	`guaranty~` — Searches for guaranty, guarantee, garanty, and similar (mis)spellings
`.`	Period in a name or email address	`Matt.Motley` — Documents that contain Matt.Motley (with the period), but not MattMotley (without the period)
`( )`	Grouping syntax	`(failure & consideration) & (contract agreement)` — Documents must contain both failure and consideration, and must also contain either contract or agreement
`sample(n, search)`	Returns n documents randomly selected from results of search. If n is less than 1, this number is treated as a percentage.	`sample(.5, contract)`; `sample(700, contract)` — Returns 50% and 700 of the search results for contract at random, respectively
`+family`	Includes family members as search hits for the entire query or any portion of a query; learn more here	`to("Jane.Smith@email.com)+family & "risk factors` — Returns emails, and family members of those emails, sent to Jane.Smith@email.com that include the phrase “risk factors” `tag(Responsive)+family % tag(Attorney-Client)+family` — Returns documents tagged Responsive and documents whose family members are tagged Responsive, but removes documents tagged Attorney-Client and family members of documents tagged Attorney-Client.
`field(terms)`	Field searching (see below for standard DISCO fields)	`custodian(Holcombe)` — Documents with Holcombe in the custodian field

DISCO ignores most punctuation and non-alphanumeric characters when searching. Periods, colons, semicolons, and apostrophes within a word are not removed. As an example, periods in a name or email address are indexed and searchable. Word operators (and, or, and not) can be searched if placed in quotation marks, “contract and payment”.

Order of operations

DISCO performs a search using the following order of operations:

Exact phrases: “ ”
Groupings: ( )
Proximity: /n, +n
Family subsearch: +family
&, and, %, not
[space], or

Standard document fields

Fieldless, or keyword, searches the document text, document notes, subject lines, custodians, authors, and user defined fields.

Field	Description	Example
`batesNumber`	Field of Bates numbers applied to documents (either from DISCO production or from elsewhere)	`batesNumber(Enron000009)` — A document receiving the Bates stamp Enron000009 `batesNumber(Enron000007 to Enron000950)` — Documents with Bates numbers within the identified range
`batesPrefix`	The English portion of the Bates stamp	`batesPrefix(Enron)` — Documents that use Enron as a Bates prefix `batesPrefix(!)` — Documents with any Bates prefix
`DeDupHash`	The unique identifier used to deduplicate documents at the time of ingest	`DeDupHash(ABC123!)` — Document with a deduplication hash starting with ABC123
`hashes`	Searches across deduphash, sha1hash, md5hash, and objecthash	`hashes(xyonqy!)` — Document with a hash starting with xyonqy
`id`	An identification number assigned by DISCO that is unique to each document in the database	`id(1200)` — The document with DISCO identification number 1200 `id(>500)` — Documents with DISCO identification numbers greater than 500
`ingestSessionId`	A number assigned to each group of documents ingested into DISCO	`ingestSessionId("IngestSessions/1")` — Documents ingested into DISCO in Ingest Session 1
`md5hash`	MD5 hash of the file binary; 32 characters	`md5hash(vgbc2c!)` — Document with an MD5 hash starting with vgbc2c
`objecthash`	Hash of the file document, without considering the parent document; 40 characters For non-email files, objecthash is the same as sha1hash. For email files, objecthash is computed by extracting and hashing parts of an email including sent date, sender, message body, and a few more.	`objecthash(hpsrxo!)` — Document with an object hash starting with hpsrxo
`production`	A name assigned by the user to each set of documents produced using DISCO	`production("defense")` — Documents produced in the defense production set
`referenceid`	Optional identification number users can assign (contact DISCO Support to do so)	`referenceid(245)` — Document with Reference ID number 245
`sha1hash`	SHA-1 hash of the file binary; 40 characters	`sha1hash(wyt9sz!)` — Document with a SHA-1 hash starting with wyt9sz

User-created information

Field	Description	Example
`documentNote`	Document note field (edited manually by DISCO users)	`documentNote(hot)` — Documents with the word hot in the document note field
`field`	Custom metadata field added by admin-level users that is used to capture additional information	`field(important)` — Documents with important in any user defined field `contract(draft)` — Documents with draft in the Contract user defined field
`folder`	Folder created in DISCO by a user	`folder("Hot Documents")` — Documents in the Hot Documents DISCO folder `folder("Hot Documents/Experts")` — Documents in the Experts subfolder `folder("Hot Documents/!")` — Documents in the Hot Documents folder and all subfolders
`privilegeNote`	A text field that will appear on privilege logs	`privilegeNote("Legal Advice")` — Documents using the phrase Legal Advice inside the privilege note
`production`	A name assigned by the user to each set of documents produced using DISCO	`production("defense")` — Documents produced in the defense production set
`redactionReason`	Optional user-created text that can describe redactions	`redactionReason("Trade Secret")` — Documents with Trade Secret applied as a redaction reason
`stage`	A set of documents created by users for linear review	`stage("First Pass Review")` — Documents in the First Pass Review stage
`stageBatched`	Documents in stages that have been pulled into batches	`stageBatched("First Pass Review")` — Documents in the First Pass Review stage that have been placed in batches (whether or not yet reviewed)
`stageComplete`	Documents in stages that have been marked "reviewed" and checked-in	`stageComplete("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed and contained in a checked-in batch (i.e. complete)
`stageReviewed`	Documents in stages that have been marked "reviewed"	`stageReviewed("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed
`tag`	Fields appended to documents by users	`tag(responsive)` — Documents with the responsive tag
`tagGroup`	Fields from a specific group appended to documents by users	`taggroup(Issue)` — Documents with a tag from the Issue group

Document metadata fields

Metadata is data about a document that is not part of the document’s content. Metadata can include things like the creation date, author, sending and receiving information, file name, and file path.

Field	Description	Example
`author`	Identifies the author or creator of a file (does not include the sender of an email)	`author(Jones)` — Documents that Jones authored
`bcc`	A recipient that was blind copied (or blind carbon copied) on an email	`bcc(Frank)` — Emails in which Frank (first or last name) is blind copied
`cc`	A recipient that was copied (or carbon copied) on an email	`cc(Thomas)` — Emails in which Thomas (either as a first or last name) is copied `cc("Frank Thomas")` — Emails in which Frank Thomas is copied
`custodian`	Typically the individual or location from which a document was collected	`custodian(Peterson or Jones)` — Documents that have Peterson or Jones in the custodian name field
`custodianExact`	An exact custodian name	`custodianExact("Andrew Lewis")` — Documents in which exactly Andrew Lewis is the custodian
`domain`	An email domain (typically, the text after the @ symbol)	`domain(winlaw.com)` — Emails sent to or from email addresses (also including cc and bcc fields) having winlaw.com as the domain (e.g., johnsmith@winlaw.com)
`folderpath`	Any folder in which a document was saved (such as a computer or network drive)	`folderpath("Deleted items")` — Documents that were in the Deleted items folder when collected Note: This search locates any discrete folder within the tree of folders and subfolders (e.g., MyComputer/Files/DeleteItems
`from`	Identifies the sender of an email	`from(Lee)` — Emails sent by Lee
`recipient`	Searches the combined email metadata fields: to, cc, and bcc (i.e., anyone who was the recipient of an email)	`recipient(Jones)` — Emails in which Jones appears in the metadata of the to, from, or bcc fields
`subject`	Searches the subject (or "re:" line) of an email	`subject(meeting)` — Emails with meeting in the subject line
`subjectNormalized`	Searches for exact match against the subject without "Re:" or "Fwd:"	`subjectNormalized("Transaction documents")` — Searches for the exact subject Transaction documents while ignoring "Re:" or "Fwd:"
`text`	The OCR (extracted text) information in an image	`text(Peter)` — Documents containing Peter anywhere within the image Note: This does not search metadata
`to`	Identifies to whom an email was sent (excludes the cc and bcc fields)	`to(Duncan)` — Emails in which Duncan (either as a first or last name) was in the to field `to("Duncan Kennedy")` — Emails sent to Duncan Kennedy

Document attributes

Field	Description	Example
`billingSize`	Returns all documents with the indicated size in bytes relative to the review database's billing statement	`billingSize(>1000000)` — Documents with a billing size greater than 1,000,000 bytes
`childCount`	Returns all parent documents that have the specified number of children. A child is typically either an attachment to an email or an embedded file in a document. A parent is the email containing the attachment or the document containing the file.	`childCount(2)` — Emails or other documents that have two children (such as attachments or embedded files) `childCount(1 to 1000)` — Emails or other documents that have between 1 and 1000 children
`comment`	Returns all documents with the indicated text left inline in the original file	`comment(!)` — All documents with comments in the original files
`company`	Returns all documents created by the same company	`company(Enron)` — Documents created by Enron
`conversationCount`	Returns all emails belonging to conversations that contain the number or range of emails specified. Conversations include the various responses, replies, and forwards of an email chain.	`conversationCount(3)` — Emails that contain three emails within the conversations `conversationCount(3 to 15)` — Emails that contain between three and 15 emails within the conversations
`extension`	Returns all documents with the specified file extension	`extension(.doc)` — Documents with the .doc file extension
`familyConsistentTag`	Returns documents where every family member has the specified tag. Limited to documents in families.	`familyConsistentTag(Responsive)`— Documents where every family member has a Responsive tag
`familyInconsistentTag`	Returns documents that do not have the specified tag, where at least one of its family members has the specified tag. Limited to documents in families.	`familyInconsistentTag(Responsive)`— Documents without a Responsive tag, where at least one of its family members has a Responsive tag
`fileLength`	Returns files corresponding to the specified size of the file (in bytes)	`fileLength(25000)` — Documents that are exactly 25,000 bytes `fileLength(>1000000)` — Documents with file sizes greater than 1,000,000 bytes
`filename`	The filename of any document Note: Emails often have filenames, though largely hidden in most applications, so consider excluding that type, if desired	`filename(Agenda.pdf)` — Documents with the exact filename agenda.pdf `filename(Agenda!)` — Documents that begin with Agenda in the filename (e.g., Agenda.pdf; AgendaForMay11.doc; or Agenda for Meeting.ppt) `filename(!Agenda!)` — Documents with Agenda anywhere in the filename
`hasDetectedSlipsheet`	DISCO identifies when a slipsheet is produced in conjunction with a native file for load file ingests, and will create a near-native image from the native file and append it to the slipsheet in the document viewer	`hasDetectedSlipsheet(yes)` — Documents that have a slipsheet
`hasDocumentNote`	Returns documents that include a note	`hasDocumentNote(yes)` — Documents that have a note
`hasHiddenType`	Returns documents with hidden content detected. Hidden content can include comments, hidden sheets, notes, hidden rows, etc.	`has``HiddenType(yes)` — Documents that have hidden content detected
`hasImage`	Indicates if an item was processed as an image or not. An image is sometimes also referred to as a “near native” or “PDF.”	`has``Image(yes)` — Documents that were processed as images
`hasLanguage`	Documents that have an identified language	`hasLanguage(yes)` — Documents that have a language identified
`hasNative`	Indicates if the native file was not supplied. If an image is supplied, DISCO will use that to populate the native file link. If no native or image is supplied, DISCO will create a near-native image from the supplied text and use that to populate the native link.	`hasNative(yes)` — Documents with a native file supplied
`hasOCR`	Returns documents for which any of the extracted text was derived via OCR	`hasOCR(yes)` — Documents with text extracted via OCR
`hasPrivilege`	Returns documents that include a privilege tag	`hasPrivilege(yes)` — Documents with a privilege tag
`hasSearchText`	Returns documents that include searchable text	`hasSearchText(yes)` — Documents with searchable text
`hasWrongExtension`	Indicates if the extension of an ingested item is inconsistent with the determined type	`hasWrongExtension(yes)` — Documents ingested as a file type that differs from the indicated type
`hiddentText`	Hidden text is text that has been set to be hidden in the original file	`hiddentText(yes)` — Documents that have hidden text in their original files
`hiddentype`	Identifies whether hidden data is in a file, including comments, revisions, notes, hidden sheets, or very hidden sheets	`hiddentype(revisions)` — Documents with hidden revisions
`imageSize`	Returns documents with the indicated size in bytes of the document’s image file	`imageSize(>1000000)` — Documents whose image size is greater than 1,000,000 bytes
`ingestType`	Indicates which of the two types of data deliveries can be processed: Native — Files delivered as they were maintained during the normal course of business Load file - Files (either images only or images with natives) accompanied by a load file that supplies family relationship and metadata information	`ingestType(native)` — Documents processed as native files
`invisibleText`	Invisible text is text that is the same color as its background	`invisibleText(yes)` — Documents that contain invisible text
`isDetectedEmail`	Files identified as emails during processing based on an examination of the file's text/OCR	`isDetectedEmail(yes)` — Documents identified as emails
`isInclusive`	Returns emails with unique content	`isInclusive(yes)` — Filters out emails that are duplicated within inclusive emails
`isProcessedAsNative`	Indicates that some aspect of processing was unsuccessful. However, DISCO will create a record in the matter with a link to the native file.	`isProcessedAsNative(yes)` — Documents that were processed unsuccessfully
`language`	Searches for documents with specific languages (English, German, French, Portuguese, Spanish, Chinese, Japanese, Korean, or Undetermined)	`language(German)` — Documents that include the German language
`pageCount`	Returns documents containing the specified number of pages in an image	`pageCount(1)` — Documents that have one page `pageCount(101 to 3000)` — Documents whose image has between 101 and 3000 pages
`parentCount`	Returns documents with the specified number or range of parents	`parentCount(1)` — Children (such as attachments or embedded files) that have only one parent `parentCount(0)` — Only parents (i.e., excludes all attachments and embedded files), and "loose" files that have no children or parent files
`path`	Location from which the document was collected	`path("My Computer/Deleted Items/!")` — Documents that were saved, when collected, in the My Computer/Deleted Items folder, as well as all documents in subfolders
`prediction`	Tag predictions are useful for finding documents that DISCO predicts are likely or unlikely to receive a specific tag	`prediction("responsive", highly likely)` — Documents that are highly likely to be tagged responsive `prediction("Work-Product", >20)` — Documents that have a likelihood score over 20 to be tagged Work-Product
`primaryLanguage`	Returns documents that have the specified primary language	`primaryLanguage(French)` — Documents in which the greatest portion of the content is in French
`processingDetails`	Returns documents with the specified processing reason	`processingDetails(Password protected)` — Documents that were identified as password protected during processing
`processingStatus`	Returns documents with the specified processing outcome	`processingStatus(Successful)` — Documents that were successfully processed
`similarCount`	Returns documents with the specified number of similar documents	`similarCount(5)` — Documents with exactly 5 similar documents `similarCount(>7)` — Documents with more than 7 similar documents
`speakerNote`	Speaker notes are slide-specific notes that are hidden from the audience, but are visible to the presenter while editing	`speakerNote(yes)` — Documents that include speaker notes
`tagcount`	Useful for figuring out whether a document has been tagged or not	`tagcount(2)` — Documents with exactly two tags `tagcount(>3)` — Documents with more than three tags
`textLength`	Returns documents with the specified number or range of characters in the text of an image (including spaces)	`textLength(3000000)` — Documents with 300,000 characters in the text
`title`	Returns documents with the specified document title	`title(``GAS PURCHASE AGREEMENT``)` — Documents whose metadata title is GAS PURCHASE AGREEMENT
`type`	The type of a document in DISCO is the file type (e.g., email, Word, PDF, audio, Excel, video, or text)	`type(Word)` — All Word files `type(email)` — All emails
`unfoldered`	Documents that are, or are not, within a folder	`unfoldered(yes)` — Documents that are not in a folder

Date fields

Dates can be searched by exact date, a range of dates, and before or after a date. Dates can be formatted as date certain (12/10/2015), month and year (9/2016), or year (2012). For example:

Exact: date(5/4/09)
Range: date(5/4/09 to 5/10/09)
Before: date(before 5/10/09)
After: date(after 5/10/09)

Field	Description
`conversationDate`	For all documents in an email conversation, the conversation date is the send date of the first email in the conversation.
`createDate`	Created date is the date the file was created.
`date`	Date searches the send date of emails and the last modified date of all other document types.
`familyDate`	For all documents in a family, the family date is the sent date (for emails) or last modified date (for non-emails) of the family head document.
`lastAccessedDate`	The last accessed date is the date the file was last accessed.
`lastModifiedDate`	The last modified date is the date changes were last made to a file.
`lastPrintedDate`	The last printed date is the date the file was last printed.
`loadDate`	The load date is the date documents were ingested into DISCO.
`receivedDate`	The received date is the date an email was received.
`sendDate`	The sent date is the date an email was sent.

Numeric searches

For the following, you can search for an exact document, a range of documents, or documents greater than or less than the indicated value. For example:

id(1234)
id(1 to 1234)
id(>1234)
id(<1234)

Numeric fields

id( )
batesNumber( )
billingSize( )
childCount( )
conversationCount( )
fileLength( )
imageSize( )
pageCount( )
parentCount( )
similarCount( )
tagcount( )
textLength( )

Tag predictions

Tag prediction uses AI to predict a tag or tags that should be applied to a document. Tag prediction search syntax is displayed below. Search syntax can accommodate multiple tags, e.g., prediction("tag name1" & "tag name2", >20).

Field Description

prediction("tag name", Likeliness value)

prediction(Attorney-Client, Highly likely) — Documents that are highly likely to be tagged Attorney-Client

prediction(Attorney-Client, Likely) — Documents that are likely to be tagged Attorney-Client

prediction(Attorney-Client, Neutral) — Documents that are neither likely nor unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Unlikely) — Documents that are unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Highly unlikely) — Documents that are highly unlikely to be tagged Attorney-Client

prediction("tag name", score range)

prediction(Attorney-Client, -20 to 20)

— Documents that have a likelihood score in the range of -20 to 20 to be tagged Attorney-Client

prediction(Attorney-Client, >20)

— Documents that have a likelihood score over 20 to be tagged Attorney-Client

prediction("tag name", exact score)

prediction(Attorney-Client, 20)

— Documents that have a likelihood score of 20 to be tagged Attorney-Client

Tag fields

Tagging decisions can also be searched by dates applied and users applying them, using the following syntaxes:

Field	Description
`tag(by reviewer@lawfirm.com)`	Documents tagged by reviewer@lawfirm.com
`tag(responsive & by reviewer@lawfirm.com)`	Documents tagged responsive by reviewer@lawfirm.com
`tag(non-responsive % by reviewer@csdisco.com)`	Documents tagged non-responsive by someone other than reviewer@csdisco.com
`sample(10, tag(by reviewer@csdisco.com))`	Ten random documents tagged by reviewer@csdisco.com
`tag(by reviewer@csdisco.com & on 10/16/2015)`	Documents tagged by reviewer@csdisco.com on 10/16/2015
`tag(responsive & by reviewer@csdisco.com & before 10/16/2015)`	Documents tagged responsive by reviewer@csdisco.com before 10/16/2015
`removedTag(responsive)`	Documents from which the responsive tag was removed (by anyone)
`removedTag(by reviewer@lawfirm.com)`	Documents from which any tags were removed by reviewer@lawfirm.com
`taggroup(Issue)`	Documents with at least one tag from the Issue tag group
*` % tag(!)`**	Documents that have zero tags associated

Redactions

Field	Description	Example
`hasRedaction`	Searches for documents that have redactions, do not have redactions, or have redactions in a specific location. Value options are yes, no, onDocument, onMetadata, and any metadata fields.	`hasRedaction(onDocument) % hasRedaction(onMetadata)` — Documents with a redaction in the document but not in the metadata `hasRedaction(to)` — Emails with redaction in the to metadata field
`hasRedactionReason`	Searches for documents that have redaction reasons, do not have redaction reasons, or have redaction reasons in a specific location	`hasRedactionReason(author)` — Documents with a redaction reason for the author metadata field `hasRedactionReason(yes)` — Documents that have a redaction reason
`hasRedactionWithoutReason`	Searches for documents that have a redaction, but no corresponding redaction reason. Value options are yes, no, onDocument, onMetadata, and any metadata field.	`hasRedactionWithoutReason(yes)` — Documents with a redaction that does not have a corresponding redaction reason `hasRedactionWithoutReason(onMetadata)` — Documents with metadata redactions that do not have a corresponding redaction reason
`redactionReason`	Optional user-created text that can describe redactions	`redactionReason("Trade Secret")`— Documents with Trade Secret applied as a redaction reason

Custom fields

DISCO supports user defined fields created in the product, and custom fields ingested from a load file. The search syntax works similarly for both types of custom fields.

Example	Description
`Deposition(!)`	Documents with any contents in the Deposition field
`Deposition(Important)`	Documents with the word Important in the Deposition field
`"My notes"(!)`	Documents with any contents in the My notes field
`"My notes"("Review again")`	Documents with Review again in the My notes field

There are two additional searches for user defined fields.

Example	Description
`hasFields(true)`	Documents with contents in any user defined field
`field("Red Team")`	Documents with Red Team in any user defined field

Contents

Search basics

Order of operations

Standard document fields

User-created information

Document metadata fields

Document attributes

Date fields

Numeric searches

Tag predictions

Tag fields

Redactions

Custom fields

Articles in this section

Contents

Search basics

Order of operations

Standard document fields

User-created information

Document metadata fields

Document attributes

Date fields

Numeric searches

Tag predictions

Tag fields

Redactions

Custom fields

Related articles

Articles in this section