GUID fields

Nuix assigns a unique identifier to each item that it processes, which is the Globally Unique Identifier or GUID. The GUID is unique across all cases, and should not be confused with the digest identifier (MD5, SHA-1, SHA-256), as these are based on the item content and are designed to show authenticity and to find duplicate content.

Nuix GUIDs are created as 32-character strings that contain a mix of alpha-numeric characters and may or may not contain the hyphens: d05307e6-0402-4042-a75e- a6d24a1235b1.

Nuix also supports wildcards with all searches that use the GUID fields.

This section details these 'GUID' fields in alphabetic order, with working examples of each.

batch-load-guid | comm-guid | guid | parent-guid | path-guid

batch-load-guid

Use the batch-load-guid field to search for items contained, loaded or reloaded in a particular batch. Example:

Query string

Results

batch-load-guid:5000

Matches all items loaded in the batch with GUID 5000. When items reload or new items are added to a case, they receive a new batch GUID.

 

comm-guid

Use the comm-guid field to search for items contained in a communication with a given GUID. Therefore, the GUID you provide must be a communication; that is, the query has-communication:1 should show the item in question.

Example:

Query string

Results

comm-guid:5000

Matches items contained as attachments of the communication with GUID 5000, or contained as attachments of another message that was in turn an attachment of GUID 5000.

 

guid

Use the guid field to search for an item with a specific GUID. By definition, this always returns either one or zero search results unless you use a wildcard with a partial guid.

Example:

Query string

Results

guid:5000

Matches the item whose GUID is 5000.

 

parent-guid

Use the parent-guid field to search for all child items embedded one level deep for a specific GUID. This field is different from the path-guid in that it only searches for items embedded directly under the specified guid, rather than all embedded items.

Examples:

Query string

Results

parent-guid:5000

Matches all items whose parent GUID is 5000.

parent-guid:empty

Matches items without a parent.

 

path-guid

Use the path-guid field to search for all child items for a specific GUID. This is useful when you need to search for all items associated with a piece of Nuix evidence. This field is different from the parent-guid in that it searches for all embedded items of the searched for guid, not just those that are one level deep.

Example:

Query string

Results

path-guid:5000

Matches items whose parent's or any other ancestor's GUID is 5000.