One of the common questions when it comes to archiving of Exchange messages with Enterprise Vault is which date attribute is used when searching ..  well the answer is in the following technote:

TECH198491

Hope that proves helpful to you.