Searching your collected evidence
Once an investigation has collected its material, the Search tab lets you search within it. This is different from the Vault search that decided what to collect: that one chose what came in, this one works inside what is already here.
Two modes, chosen per search
You choose Exact or Connected each time you search, not once for the whole matter. Mode is per search, never per matter.
Exact — only messages matching your search
Exact finds messages where your terms actually appear: in the sender, the recipients, the subject, the message the sender wrote, or an attachment filename.
Whole terms and quoted phrases. Searching "call" does not match inside "recall". Use double quotes for an exact phrase, for example "corporate box".
It does not correct your spelling, and it does not guess. If you search a word that isn't there, you get nothing, and we tell you plainly.
Every result shows why it matched — which field, which term, and the surrounding text.
Exact does not use AI. The same search over the same material always returns the same results.
Connected — matching messages plus the conversation around them
Connected does everything Exact does, and then adds the messages that are structurally connected to what it found. There are two ways a message can be structurally connected, and Connected tells you which one applies to each result.
The rest of the conversation. Messages in the same conversation as a direct match, in both directions, reconstructed from the reply structure of the collected material. These show which direct match they came from and how far away they are.
A separate thread between the same two people. Connected can also return a message that is not in the visible reply chain at all. This happens when the same sender and recipient, in either direction, continue in a separate thread within the standard window, and at least one further deterministic signal supports the connection — the two messages were sent close together in time, or the message contains one of the fixed, published channel-switch phrases. Continuation alone is never enough.
Both kinds are ordinary Connected results. There is no separate category and no special label; what differs is the reasons shown.
A connected message may also show one or more additional factual reasons, where another deterministic rule about the message or conversation also applies. Neither this nor the structural reason indicates the sender's intent, conduct, or that a conversation actually moved to another channel — each records an observable feature of the message for you to assess.
Connected does not use AI. Neither mode does. The channel-switch reason checks only a fixed, published list of phrases, only against words the sender actually wrote, never quoted history.
What Search does not do
Search does not adjust for misspellings and does not infer related meaning beyond the words you enter. It does not promise to surface every message that could conceivably matter. A search that finds nothing is still recorded, so you always know it ran.
Can't find what you need? Contact support — we aim to respond within one business day, during UK business hours.