Vault export contents

How Chat messages are organized in an export file

To provide context for Chat messages, your search results, preview, and export files include messages sent in the same conversation or thread as the matching messages. Chat messages are organized in an export file as follows:

• Messages are grouped by conversation, thread, or Chat space.
• If your export includes messages from several conversations, the conversations are in reverse chronological order based on the most recent matching message. For example, if the last matching message in one conversation was sent at 1 PM, and the last matching message in another conversation was sent at 8 PM, messages from the conversation with the 8 PM message are listed first in the export file, then the messages from the conversation with the 1 PM message.
• Within each conversation or Chat space, messages are in chronological order.

  Note: If you review your export in an email client, messages are in chronological order and aren’t grouped by conversation.

Reducing duplicate messages

When many messages in the same conversation or thread match your search, there can be overlap in the messages provided for context. To avoid exporting duplicate messages, Vault evaluates the overlap and groups messages accordingly.

For example, a conversation has 2 messages that match the search query, one sent at 9 AM on Monday and the other sent at 3 PM on Monday. The matching messages have the following context windows:

• 9 AM message: 9 PM Sunday to 9 PM Monday
• 3 PM message: 3 AM Monday to 3 AM Tuesday

The context windows overlap between 3 AM and 9 PM Monday. When the messages are exported, only one series of messages is returned for the conversation and it includes all messages sent between 9 PM Sunday and 3 AM Tuesday.

If another message in the conversation matches but was sent more than 24 hours after the previous matching message, then a second message grouping is created and returned in the export. Continuing the previous example, if another matching message was sent at 11 AM Thursday, its context window is from 11 PM Wednesday to 11 PM Thursday. This window doesn’t overlap with the previous window, which ended at 3 AM Tuesday, so the messages in this window are returned in a second group.

The metadata CSV file lists the following information for each message. The value is blank if the information isn't available or doesn't apply to a message.

The count CSV file contains a list of the searched accounts and the number of messages in the export associated with each account.

The first row is for Totals, which lists the total exported and error messages for all emails in the export. Results are sorted in descending order of the number of successfully exported messages for that email address.

Note about counting

If a message matches the export query but fails to convert to PST format, it's counted as a success in this file. You can review the messages that didn't convert in the export_name-conversion_errors-N.zip file.

The metadata file contains the following information:

Metadata for Groups messages

• #From—Email account of the sender
• #To—Email accounts of all recipients
• #CC—Email accounts of all Cc'd recipients
• #BCC—Email accounts of all Bcc'd recipients
• #Subject—Message subject
• #DateSent—Timestamp for when the message was sent
• #DateReceived—Timestamp for when the message was received

Metadata for Chat messages

• #DateFirstMessageSent—Timestamp for when the first message in a conversation was sent
• #DateLastMessageSent—Timestamp for when the last message in a conversation was sent
• #DateFirstMessageReceived—Timestamp for when the first message in a conversation was received
• #DateLastMessageReceived—Timestamp for when the last message in a conversation was received
• RoomID–Space, group chat, or DM identifier that the message belongs to
• Participants–Email addresses of all users who participated in the conversation
• Labels—Labels applied by Chat, such as ^INBOX, ^TRASH, and ^DELETED. Also shows any labels applied to the message by the user.
• RoomName–The value depends on the type of message:
  • For Chat spaces, the name of the space
  • For group conversations created after early December 2020, Group chat
  • For group conversations created before early December 2020 and DMs, a comma-separated list of accounts that participated
• ConversationType–The message type:
  • For a group chat created after early December 2020 or a space, the value is Room
  • For a group chat created before December 2020, the value is Group Direct Message
  • For a DM, the value is 1:1 Direct Message

Metadata for all messages (Groups and Chat)

• FileName—Message identifier. Use this value to correlate metadata with the corresponding message in an email client or a text editor.
• FileSize—Size of the message in bytes
• Hash—MD5 hash of the message

Query parameters for the entire export

• UserQuery—Query submitted by the Vault user that retrieved the messages included in this export
• TimeZone—Time zone used for date-based searches
• Custodians—Email addresses of the users whose accounts were searched. If you search for content rather than individual user accounts, no custodians are listed here.

The metadata file included with your export captures the following metadata:

Included with each file

Query parameters for the entire export

When you export files from Drive, the metadata file may include information about users in your organization who have indirect access to, and have opened a file that matches your search criteria.

A user can have indirect access when a file or folder containing a file is:

• Shared with a group the user belongs to
• Shared with the domain
• Shared publicly

During export, you can choose the information you want to include in the metadata output:

• In the export dialog, check the box to have Vault determine the permission level for users in your domain who have indirect access to files. Each of these users is included in one of these categories when you open the metadata file:

  • Collaborators—Users who have indirect permission to edit or add comments to a file.
  • Viewers—Users who have indirect permission to view a file.
  • Others—In some circumstances, Vault can't determine the type of access a user has at the time of export. This can happen, for example, if a file was shared with a group, and the user was later removed from the group.

  Vault takes time to determine what permissions these users have, so this option can increase the time it takes to prepare your files for download.

• In the export dialog, leave the box unchecked (default) to exclude access-level information for users in your domain with indirect access to files. These users are listed as Others in the metadata file.

Note: Unlike other services, Voice exports don’t include a count file.

The metadata file contains the following information:

Information about each file

• DocID—A unique identifier for the file.
• #Author—The email address of the account that owns the file in Drive.
• #DateFirstMessageSent—For text conversations, the date the first message was sent. Note: This and the following 3 fields are identical in entries for voicemails and call logs.
• #DateLastMessageSent—For text conversations, the date the last message was sent.
• #DateFirstMessageReceived—For text conversations, the date the first message was received.
• #DateLastMessageReceived—For text conversations, the date the last message was received.
• ConversationType—The data type:
  • TEXT_MESSAGE—A text message
  • VOICEMAIL—A voicemail
  • INCOMING_CALL—A call log of an incoming call
  • OUTGOING_CALL—A call log of an outgoing call
  • MISSED_CALL—A call log of an unanswered incoming call
• ParticipantPhoneNumbers—The phone numbers of the participants
• OwnerPhoneNumbers—The value includes multiple phone numbers when the user's number changed
• Labels—Any labels on the conversation. For example, deleted conversations have the DELETED label
• ExternalFile FileName—The file identifier, which correlates to the Subject in the PST or mbox file

Query parameters for the entire export

• UserQuery—The query submitted by the Vault admin
• TimeZone—The time zone of the query
• Custodians—The email addresses of the accounts that were searched

Summary section

The error report contains the following data for the entire export in a Summary section.

Lists of errors

After the Summary section, the export contains metadata for the accounts and messages that had errors. Values aren't reported if the data isn't available or applicable for a message.

The error report contains the following fields for each message. Fields are blank if the data isn't available or applicable for a message.

The error report contains the following fields for each message. Fields are blank if the data isn't available or applicable for a message.

The error report contains the following fields for each file. Fields are blank if the data isn't available or applicable for a file.

The error report lists accounts that were searched but not all matching files were exported.

Summary section

The error report contains the following data for the entire export in a Summary section.

Lists of errors

After the Summary section, the export contains metadata for the accounts and events that had errors. Values aren't reported if the data isn't available or applicable for an event.