Appendix C: Query Builder Criteria

The Query Builder allows users to construct complex NQL queries within a workspace environment. The criteria in this table are available within the Query Builder.

Note: All criterion configuration selections are based on the items currently available within the selected case.

Criterion	Select to:
NQL search	Define an NQL search for a keyword or phrase to include in the query. Any valid NQL string can be defined in this criterion. This criterion is always at the top of the list.
Batch loads	Identify items that were or were not contained, loaded, or reloaded in one or more specific batch loads.
Can contain text	Identify item types that could contain searchable text or not contain the text.
Cluster runs	Identify items by specific cluster runs that exist within your case. You can add more cluster runs to be searched.
Communication	Identify email items by subject, address or domain, and select one or more communication methods of From, To, CC, and BCC.
Communication between	Identify email communications between two specified email addresses or domains.
Contains text	Identify items that contain searchable text or do not contain that text.
Custodians	Identify items assigned or not assigned to one or more specific custodians.
Custom metadata	Identify items using Custom Metadata.
Date range	Identify items by modified date, or communication date for communication item kinds, by a specific date or date range. Click on a Date, select a month and year from the pulldowns, then click in the calendar to select a day.
Detected faces	Identify items by a specific number or a range of numbers of detected faces.
Digest lists	Identify items that have a hash that matches or does not match a hash included in one or more specific Digest lists.
Evidence	Identify items that are descendants or not descendants of one or more specific Evidence sets.
Exclusions	Identify items assigned or not assigned to one or more specific Exclusions.
Face confidence	Identify items that have at least one detected face with a confidence level within the specified range. Select High, Medium, and/or Low. ‎Note: To use this feature, the Face Detection option must have been selected during initial processing.
Fast review jobs	Identify items that include specific fast review jobs. Fast reviews allow you to present a group of items to investigators for review with a predefined set of tags and highlighted words that the reviewer can apply to the items during review.
File extensions	Identify items by their file extensions.
Flags	Identify items that have been flagged as being of a particular type.
Folders	Identify items based on the folders assigned to them.
Has binary	Identify items that have binary data stored or no binary data stored.
Has comment	Identify items that have received comments or have no comments.
Has communication	Identify items that contain or do not contain communication data. Items that are attached to, or associated with a communication are not returned.
Has custodians	Identify items that have an assigned custodian or not.
Has embedded Data	Identify item types that could contain embedded data or not.
Has exclusion	Identify items that have been excluded or not.
Has image	Identify items that contain or do not contain image data.
Has item set	Identify items that have been or have not been assigned to an item set.
Has production set	Identify items that have been assigned to a production set or not. Production sets are created using Nuix Workstation.
Has tag	Identify items that have been tagged or not tagged.
Has updated text	Identify items that have had their text updated. For example, images that have been processed using OCR. Or identify items that have not had their text updated.
Image color count	Identify images based on the number of different colors included in the image. Options include: Very high, High, Medium, Low, and Very low.
Image color range	Identify images based on the range of colors included in the image. Options include: Color, Monochrome, Strict grayscale, Black and white, Not analyzed, and Images uses alpha channel.
Image size	Identify images based on the following file size options: Very large, Large, Medium, and Small.
Is corrupted	Identify non-encrypted items that the Nuix Engine is not able to process.
Is corrupted container	Identify non-encrypted containers that the Nuix Engine is not able to process.
Is deleted	Identify items that were deleted, and then recovered from slack space.
Is encrypted	Identify items that are encrypted.
Is item set original	Identify items that are originals (non-duplicates) that are also included within an item set. If set to false, duplicates and items not included within an item set are returned.
Is non-searchable PDF	Identify PDFs that do not include searchable text.
Is unrecognized	Identify item types that are not recognized by the Nuix Engine.
Is unsupported	Identify items from which the Nuix Engine was not able to extract content.
Is unsupported Container	Identify containers from which the Nuix Engine was unable to extract content.
Item set	Identify items within an item set based on whether they are Originals, Duplicates, or both.
Item set batch	Identify All, Original, or Duplicate items within in item set by the batch in which they were added.
Kinds	Identify items by one or more specific item kinds.
Languages	Identify items that include text in one or more specific languages.
Mime types	Identify items by one or more specific MIME types.
Named entities	Identify items that contain the specified Named Entities, including custom named entities.
Path kind	Identify all ancestors of items that are of a specific item kind.
Phrase	Identify items that contain a defined phrase within one or more selected Metadata fields.
Production sets	Identify items assigned to one or more specific production sets. Production sets are created using Nuix Workstation.
Proximity	Determine the juxtaposition to which words must adhere to be included in the search results. You can set how close words must be and the order in which they should appear.
Range	Identify items with a specific metadata field that contain a value that falls within the defined range.
Search macros	Identify items based on predefined queries that you select.
Secured fields	Identify items that contain a secured field with a specific answer.
Shingle lists	Identify items that match the requirements in the selected shingle list.
Skin tone	Identify items based on the percentage of flesh tones included in the image. Options include: Severe, High, Medium, and Low
Tags	Identify items that have been assigned one or more specific tags.
Text options	Identify items using a comma-separated list of keywords. Select from the following query options: None: Searches using the specified keywords. Search is not case-sensitive, and punctuation is ignored. Stem: Adds “*” as a suffix to each of the keywords specified. The query searches for all keywords and words that contain the keywords. For example, if the keyword is “text”, the search returns text, texted, textbook and so on. Exact: Searches using the keywords as entered. This search is case-sensitive and recognizes punctuation. Fuzzy: This option allows you to match terms where some of the characters do not match exactly using the Levenshtein Distance algorithm. If selected, choose the amount of Fuzz Factor from the slider in values of 0, 1, or 2 where 0 is an exact match and the higher values permit more letters to be different.
Threads	Identify items by specific email threads that exist within your case. You can add more threads for additional searching. Search on endpoints such as: pivot, endpoint, endpoint-attach, thread-attach, endpoint-duplicate, endpoint-duplicate-inferred, and endpoint-any.
Word lists	Identify items that match any term contained within the selected word lists.