Use Vault to search Gmail

Searched:

• The first 1 MB of text and attachments of a message
• Confidential mode messages sent by users in your organization
• Headers and subject of confidential mode messages sent by external senders
• Drafts, including discarded drafts and autosaved versions
• The header and subject of client-side encrypted emails, which are not encrypted

Not searched:

• The content of confidential mode messages sent by external senders
• Linked files
• Email layouts
• Messages sent through other Google services, such as Google Calendar or Google Docs, unless comprehensive message storage is turned on
• Dynamic content in dynamic messages
• The encrypted body text of client-side encrypted emails

For details, see Supported services and data types.

A user's Gmail data can include 3 types of draft messages. You can exclude all or only certain types of draft messages in search results and exports:

• To exclude all draft types, check the Exclude drafts box before you search. Previews still include automatically saved versions of draft messages, but these aren’t included when you export.
• To exclude automatically saved drafts, add the following operator to your search terms: ‑label:^r_ad.
• To exclude discarded drafts and automatically saved versions, and include only unsent drafts, add ‑(label:^deleted AND label:drafts) to your search terms. Preview will still include automatically saved versions of draft messages, but these aren’t included when you export.

Add the following operator to your search terms: ‑label:^admin_quarantine.

Learn more about admin quarantine.

To ensure you get all data relevant to a case, you might want to search unprocessed data. Unprocessed data includes:

• The content in messages and attachments that Gmail is still indexing.
• For large messages and attachments, where only the first 1 MB is indexed, the content beyond 1 MB.
• Attachments that couldn’t be converted to text and indexed.

If you search all data or held data and you enter search terms, Vault can’t match terms to the unprocessed data. To be certain that you collect all data that might match your terms, you can search for unprocessed data associated with the accounts or organizational unit of interest, export it, and use another tool to search it for your terms.

Vault retains and holds client-side encrypted emails the same as other files.

• You can preview the unencrypted email metadata, such as subject, sender, and receiver.
• An email's encrypted content will appear as an smime.p7m or smime.p7s attachment in the search preview. To view the contents, create an export. To decrypt an export in the mbox format, you can use the decrypter utility (beta). To view client-side encrypted emails in the PST format, import each users’ p7m file into Microsoft Outlook.

Learn more about Client-side encryption.

You can search for messages associated with a specific user, without having to access their account. When you start a search, use the following parameters:

• For the source data, select All data.
• For the entity, select Specific accounts and enter the user’s email address.
• (Optional) Refine your search with terms, such as the following:
  • To find only messages sent by the specific account, enter from:email_address.
  • To find only messages received by the specific account, enter to:email_address. This search returns emails where the specific account was in the to, cc, or bcc fields. It doesn’t return emails sent to groups that the account is subscribed to.

You can search for messages sent between specific users. The following examples are for 2 users, but you could add more accounts. When you start a search, use the following parameters:

• For the source data, select All data.
• For the entity, select Specific accounts and enter one of the users’ email addresses. You don’t need to enter both here.
• Refine your search with terms:
  • To find messages sent between the 2 accounts, with either account as the sender and receiver, enter from:(email_address_1 OR email_address_2) AND to:(email_address_1 OR email_address_2).
  • To find messages sent by one account to another account, enter from:sender_email_address AND to:receiver_email_address. Note: If the users you’re interested in have many accounts, ensure you match all their emails by following the preceding example and enter all the accounts.

You can review which accounts have sent or received messages from users in another company. When you start a search, use the following parameters:

• For the source data, select All data.
• For the entity, select All accounts.
• Refine your search with terms:
  • To find messages that were sent to any user in another company, enter to:*@example.com. This search returns emails where any account in the specified domain was in the to, cc, or bcc fields. 
  • To find messages sent to users in your organization from any user in another company, enter from:*@example.com.

To find Groups messages in a Gmail search, you can’t specify the group email as the account to search. Instead, use the following parameters:

• For the entity, select All accounts.
• For terms, enter from:group_address. For example, to find messages sent to the group [email protected], enter from:[email protected]. 

Note: This approach returns messages only if one or more users subscribed to the group, they get abridged summary or digest emails, and the messages are still available to Vault (not deleted and purged).

You can review which accounts have sent or received messages that contain a specific word, phrase, or attachment. When you start a search, use the following parameters:

• For the source data, select All data.
• For the entity, select All accounts.
• Refine your search with terms:
  • To find messages that contain a specific word, enter word. If you enter many words, the search returns only messages that contain all the words. Vault searches over the first ~1MB of message text and any attachments. You can’t restrict your search to only attachment text or message text.
  • To find messages that contain a specific phrase, enter the words in double quotes, such as ”project alpha”. The search isn’t case sensitive so messages that contain Project Alpha, Project alpha, project Alpha, or project alpha are all returned.
  • To find messages that have an attachment, enter has:attachment. To find messages with a file attachment with a keyword in the file name, enter filename:word.