I can see Immutable ID and Item Identity are a match when comparing exports of overlapping data from eDiscovery against Content Search, but I can't actually search those values to find the exact data set that I need. Here's my use case: we have files that were tagged for hard deletion in an eDiscovery Review Set. I need to find those exact files in a Content Search, but attempts to find emails and their attachments using FileId, FamilyId, ConversationId have all failed. Content Search just ignores those queries and returns the entirety of whatever mailboxes I'm searching on. Email Message Id appears to be unavailable in Content Search and neither Item Identity nor Immutable ID are working either. How can I find the exact files that were tagged? Is there a unique identifier that can be used? We need to do a hard delete of these items, hence the need to pull them into Content Search. Any help or suggestions would be appreciated.
So far, the best matching search I've been able to run is on received date (which includes the timestamp) but this is giving me too many results. Given the lack of columns and filtering in Content Search, having too many results is not ideal. Need to get the exact tagged set returned.
And what about Compound Path? Which way should the slashes go for Content Search? I can't get it to return anything.
