Google Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin must set up your account. Who is my administrator?
This guide provides an overview of Google Vault's eDiscovery features, which you can use to search and export your organization’s Google Workspace data.
- Step 1: Sign in to Vault
- Step 2: Create a matter
- Step 3: Search for data
- Step 4: Preview your results
- Step 5: Save your search query
- Step 6: Export and analyze
- Other Vault tasks
Step 1: Sign in to Vault
Go to https://vault.google.com and sign in with your Google Workspace account.
If you can't sign in to Vault, ask your Google Workspace administrator to turn on Vault for you.
Step 2: Create a matter
To search and export user data, you create a workspace called a matter. Think of a matter as a folder where you store your search queries and export packages. You can share matters with others, including external users.
- Click Matters
Create.
If you don't have the Create option, ask your Google Workspace administrator to give you the necessary privileges.
- Enter a name for the matter.
- (Optional) Enter a description and specify a data region for the matter.
- Click Create.
Create.
Step 3: Search for data
When you created a matter in Step 2, the matter opened to the Search tab. You can now start your search.
If you don't have the Search tab, ask your Google Workspace administrator to give you the necessary privileges.
- Select a Google service to search, such as Gmail.
- Enter your search parameters. You can choose which accounts to search and conditions to use. For example:
-
Find messages sent by specific users—Enter an email address in the Account email addresses field, or try using search operators such as from:[email protected] and to:[email protected].
-
Find messages with a specific phrase—In many organizations, Gmail contains millions of messages and most of the commonly used words in a given language. Try grouping words into phrases with quotation marks, such as "confidential project X". Note: Search ignores the case and punctuation of phrases in quotation marks.
-
Exclude drafts—Gmail saves versions of a draft message as the sender composes it. If you don't need this much detail, check the Exclude email drafts box to remove these messages from your search results.
-
Exclude matches—To exclude data from your search, put a hyphen (‑) before the search term. For example, ‑subject:vacation excludes all messages that have a subject that includes the word "vacation."
Learn more about how to search Gmail, Drive and Meet, Chat, Calendar, Groups, and Voice. For more Gmail search tips, go to More search tips for messages (below on this page).
-
- (Optional, supported for Gmail and Groups) If you're worried your search will return too many results, which can take a long time to process, click Count. Count reports the number of results faster than a full search.
To refine your search, click Expand and edit your search parameters.
-
Click Search. After the search completes, Vault opens a table of the results.
Search limitations:
-
Purged data—Vault can search and return only data that isn't purged from Google production systems. Vault doesn't automatically retain any of your organization's data. To make sure you can search and export certain data, set up retention rules or holds.
-
Drive items—When you search Drive, you can search for text within files, including Microsoft Word, Excel, and Powerpoint, PDF, HTML, TXT, and RTF. You can't search within video, audio, image, or binary files.
-
Wildcard error—Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. For example, if
subj:foo*produces too many matches, you might try searching forsubj:food*(to find "food") andsubj:foot*(to find "foot" and "football"). Wildcard search isn't supported for Calendar, Chat, Drive, or Voice Searches.
-
| Goal | Example query |
|---|---|
| Find all messages sent to or from an external domain | This query returns all messages exchanged with the external domain, regardless of sender:
|
| Find only chat messages | This query returns chat messages and excludes email messages:
|
| Find some words but exclude others | This query returns invite and invitational, but not invitation nor invited:
|
| Find words that are near each other in a message | This query returns “don’t ever distribute” but excludes “don’t think we should distribute”. Use any number from 1 to 19.
|
| Exclude deleted messages with a user-applied label | This query excludes all deleted messages that have had the “travel” label applied by the user:
|
| Find specific types of attachments | This query returns all messages with PDF attachments:
|
| Exclude messages that have been quarantined. | This query excludes messages in admin quarantine:
|
Step 4: Preview your results
To preview a matching item, in the table of results, click a row and the preview opens in a side bar on the right.
Preview behavior:
- Messages—Vault returns a message's entire conversation collapsed into a single thread. To expand a thread, click the message. To preview individual messages, click them.
- Drive items—You can preview Google files such as Docs, Sheets, Slides, Drawings, and Vids, and user-uploaded files such as .docx, .pdf, and .xlsx.
You might not be able to preview all messages or files that are returned. Though your preview might be limited, when you export the search results, the export includes all matching data.
Step 5: Save your search query
After you finalize your search parameters, you can save the query to quickly run this search again later.
- To save your query, click Save. This action doesn't save your search results, only the query parameters. To save your current results, go on to the next step and export them.
- To open a saved query, click View saved queries and click query. Saved queries are dynamic—when you run the search again, the results include data created since the last time you searched.
Step 6: Export & analyze
- To save the results of your query, in the Search tab, click Export.
If you don't have the Export option, ask your admin to give you the necessary privileges.
- Go to the Exports tab to track the export's progress. When it's complete, click Download. You have 15 days after the export starts to download the export files.
- Your export includes a compressed file that contains the data returned by your search. It also has a metadata file to correlate the data with associated accounts. Use third-party software to process the exported files.
Other Vault tasks
Here are other tasks you can do in Vault:
- Preserve specific messages and files as required by your organization's retention obligations.
- Review your retention policies and update them as needed.
- Create holds to preserve data for individual users or organizational units. Messages and files subject to a hold are never deleted, regardless of retention settings.
- Review the privileges that control what other users can do within Vault.