# Search recipes

Copy-paste commands that answer real questions. **hexane** · <https://hexane.cc>

Assumes you are at the archive root and have `rg` (ripgrep) installed.

---

## Set up once

```bash
# index the mail for real search
sudo apt install notmuch
notmuch new --root=01_EMAIL

# or, if you prefer to stay in the shell
export MBOX_GLOB='01_EMAIL/**/*.mbox'
```

---

## 1. Find a person across everything

```bash
NAME='Gauland'
rg -i -l "$NAME" 01_EMAIL/ 03_DOCUMENTS/ 04_TABULAR_DATA/ | head -50
```

In notmuch, with threading:

```bash
notmuch search --output=threads "Gauland"
notmuch show --format=text "$(notmuch search --output=threads 'Gauland' | head -1)"
```

---

## 2. Money: find the financial threads

```bash
rg -i -n --no-heading \
  'Untreue|Veruntreuung|Unterschlagung|Bestechung|Bestechlichkeit|Vorteilsnahme|Kickback|Schwarzgeld|schwarz bezahlt' \
  01_EMAIL/ | head -100
```

Find invoices and match them to email:

```bash
rg -i -n 'Rechnungsnummer|Zahlbetrag|zu zahlen|IBAN' 03_DOCUMENTS/ | head -50
rg -i -n 'IBAN|Kontonummer|Bankverbindung' 01_EMAIL/ | head -50
```

Cross-check amounts:

```bash
rg -o -N '\b\d{1,3}(\.\d{3})*,\d{2}\s*(EUR|€)' 01_EMAIL/ | sort | uniq -c | sort -rn | head -40
```

---

## 3. The arbitration courts — read these first

```bash
notmuch search --output=messages 'path:bundesschiedsgericht' | wc -l
notmuch search 'path:bundesschiedsgericht and (Parteiausschluss or Berufung or Revision)'
```

List every expulsion proceeding:

```bash
rg -i -l 'Parteiausschluss|Ausschlussverfahren|Ehrverlust|Rüge|Verweis' \
  01_EMAIL/bundesschiedsgericht@alternativefuer.de/ | head -50
```

---

## 4. Internal conflict and resignations

```bash
rg -i -n --no-heading \
  'Rücktritt|zurückgetreten|Amtsniederlegung|Vertrauensentzug|Misstrauen|Austritt' \
  01_EMAIL/ | head -80
```

---

## 5. Data protection: how much member data is here

Count distinct IBANs (validated list is in `04_TABULAR_DATA/`):

```bash
wc -l 04_TABULAR_DATA/*iban* 2>/dev/null
rg -o -N '\bDE\d{2}( ?\d{4}){4} ?\d{2}\b' 03_DOCUMENTS/ 04_TABULAR_DATA/ \
  | sed 's/.*://; s/ //g' | sort -u | wc -l
```

Find rosters — files with many names and member numbers:

```bash
rg -i -l 'Mitgliedsnummer|Mitgliedsnr' 04_TABULAR_DATA/ 03_DOCUMENTS/ | head -30
```

---

## 6. The WordPress database

```bash
# what tables are there
rg -n '^CREATE TABLE' 02_DATABASES/*.sql | sed 's/.*CREATE TABLE `\?//; s/`\? (.*//' | sort
```

Form submissions (names, emails, messages):

```bash
rg -n 'INSERT INTO `(wp_)?(gf_entry|wpforms_entries|cf7|e_submissions)' \
  02_DATABASES/*.sql | head -20
```

Users and password hashes:

```bash
rg -n 'INSERT INTO `wp_users`' 02_DATABASES/*.sql | head -5
rg -o -N '\$P\$[./A-Za-z0-9]{31}' 02_DATABASES/*.sql | sort -u | wc -l
```

---

## 7. Credentials and security posture

```bash
# how many distinct hashes, by type
rg -o -N '\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}' 05_CREDENTIALS_AND_KEYS/ | sort -u | wc -l
rg -o -N '\$P\$[./A-Za-z0-9]{31}'            05_CREDENTIALS_AND_KEYS/ | sort -u | wc -l

# private keys
rg -l 'BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY' 05_CREDENTIALS_AND_KEYS/

# secrets in configs
rg -i -n 'api[_-]?key|secret|token|passwd|password\s*=' 05_CREDENTIALS_AND_KEYS/ | head -50
```

---

## 8. Shop: what was printed and sold

```bash
notmuch search 'path:afd-fanshop'
rg -i -n 'Spannband|Aufkleber|Plakat|Motiv|Druck|Auflage' \
  01_EMAIL/sascha.huemmer@afd-fanshop.de/ | head -40
```

---

## 9. Extremist content — with the sender caveat

```bash
rg -i -n --no-heading \
  'Untermensch|Endlösung|Gas Kammer|Gaskammer|Volksverräter|Umvolkung|Zigeuner|Nafri' \
  01_EMAIL/ | head -80
```

Then, for each hit, check who actually sent it:

```bash
rg -A2 -B8 'Untermensch' 01_EMAIL/... | rg -i '^(From|Sender|Return-Path):'
```

---

## 10. Timeline of a mailbox

```bash
rg -h '^Date: ' 01_EMAIL/fabian.jacobi@afd.nrw/*.mbox \
  | sed 's/^Date: //' | sort | head -5
rg -h '^Date: ' 01_EMAIL/fabian.jacobi@afd.nrw/*.mbox \
  | sed 's/^Date: //' | sort | tail -5
```

Volume by month:

```bash
rg -h '^Date: ' 01_EMAIL/*/*.mbox | grep -oE '[A-Z][a-z]{2} [0-9]{4}' \
  | sort | uniq -c | sort -k2
```

---

## 11. Export a thread to something readable

```bash
# notmuch -> one text file per thread
notmuch search --output=threads 'subject:Spende' | while read t; do
  notmuch show --format=text "$t" > "thread_${t#thread:}.txt"
done
```

---

## 12. Everything containing a term, with context

```bash
rg -i -C3 'Bestechung' 01_EMAIL/ | less
```

---

## Performance notes

- `rg` on 200 GB of mbox takes a few minutes cold, seconds warm.
- `notmuch new` on the full tree takes ~10–20 minutes once, then incremental
  updates are fast.
- Prefer `notmuch` for anything involving sender/recipient/date; prefer `rg`
  for anything involving body text or attachments.

---

**hexane** · <https://hexane.cc>