Use the Investigations node to create archive searches that include tags. The archived messages found as a result of an investigation search can then have tags added, changed, or removed. For more information, see Tag Definitions Node.
By default, investigation searches include items in the recycle bin (that have been deleted or expired). To create a new investigation, right-click Investigations, and click New, or to edit an existing investigation, click Investigations, right-click the investigation in the right pane, and click Edit
to set the following options in the Investigation Definition dialog box:
- Content criteria – Select whether to search in all messages or limit the search by specifying additional search criteria.
- Source criteria – Specify where to search.
- Status criteria – Define status criteria for expired items, deleted items, on-hold items, and whether to search Recycle Bin.
- Repository criteria – Select the repositories to be searched.
- Tags – Specify tags on which to search, and select whether to AND or OR the tags.
- Sampling rules – Select how many matches from the archive to show.
Once a search is run and the summary of results viewed, a column within the search results lists the tags on each message found. If any of the tags are a hold tag, the deletion status column displays Hold due to tag. A message with this tag can be deleted, but it cannot be purged (removed from the recycle bin).
Investigations can manipulate tags in two ways:
- Once a search is run, the dialog that displays includes Tag actions. Click this option to add, remove, or change tags on all messages found by the search.
- If you view the summary of messages found by the search and then select a set of messages, click Tag actions to allow you to add, remove or change tags on the selected messages.