Search vault for the content of an email

alexgrutza
Contributor III

Probably a weird request, but ultimately we'd like to search Vault (we have EDU Fund. so no investigation tool) for an email to a particular user, that has the HTML apostrophe value in the email body

Example: search for &#8217 within the body of an email to a particular person..

So their email body would be something like: "Why don&#8217t you call me" instead of "Why don't you call me"

--
CISSP | LinkedIn | @Phyxiis
4 REPLIES 4

Kim_Nilsson
Admin Moderator

That's ging to be tricky, but you can perhaps figure it out.

If I send an email that looks like that.

"Why don&#8217t you call me"

Then the Vault result come back as this. Not the same.

Kim_Nilsson_0-1689027885426.png

And if I instead send an email with a proper sentence.

"Why don't you call me"

the result comes back a this, a different code than what you were looking for.

Kim_Nilsson_1-1689027947963.png

This different code also seems to be the one used by Outlook Online, as I sent a test email from there.

Kim_Nilsson_2-1689028115836.png

However, that HTML reference, 't, can't be used by itself, at all.

It matches nothing in Vault, maybe because it searches the real text, even if the preview only shows semi-broken HTML. Opening the individual email in Vault shows only the proper text, and no HTML.

--
https://wheretofind.me/@NoSubstitute

James_Seymour
New Contributor III

Out of interest I searched our Vault for ’ and it picked up the email from this thread as well as emails from MXToolbox which looks like it is 'replicating' the issue, see the image below.

Screenshot 2023-07-11 13.31.49.png

Ah, cool. Then you perhaps have a way forward for testing.

--
https://wheretofind.me/@NoSubstitute

Humorous about the MXToolbox emails haha. That is a great example, got plenty of those in my email account to test and it seems it's coming back with that in the body of the message

--
CISSP | LinkedIn | @Phyxiis