Use Vault to search Google Drive, Meet & Sites

Google Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin must set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Google Vault to search for items in Google Drive, including shared drives, Google Meet recordings, and new Google Sites sites. You can search titles and the contents of supported file types. You can also preview items and export your search results.

Things to know before you search

Before you search for messages, we recommend you review the supported data types for Drive, Meet, and Sites and the Vault search FAQ.

Expand all | Collapse all

What data is searched

Searched:

Text-based content and metadata of files in users' Drives and shared drives
External files shared with your users

Not searched:

Encrypted content
Linked files
Email layouts
Contents of video, audio, image, ZIP, or binary files
Videos automatically synced from a user's Google Currents account

Searchable content and metadata

For all items, you can search the title, owner, date last modified, and other metadata.

For supported file types, you can search for words and phrases in the contents of files. Vault indexes the first 100 pages of text files and the first 10 pages of text in image PDFs.

You can search text within the following file types:

Google Docs, Sheets, Slides, Forms, Sites, and Vids
Vault doesn't search comments (including tasks assigned in comments) and suggested edits.
Microsoft Word, Excel, and PowerPoint
PDF
HTML
TXT
RTF
SBV
OpenOffice XML
Wireless Application Protocol (WAP)
Wireless Markup Language (WML)
Google Earth (KML)

For more details, go to Supported services and data types (sections for Drive, Meet, and Sites).

How do searches by account, organizational unit, or shared drives work?

The files that Vault searches depend on the type of search:

Search type	Files searched
Specific accounts or Organizational unit	Vault searches: Files owned by the account Files directly shared with the account, including files owned by users outside your organization Files directly shared with the account, including files in shared drives Files in folders directly shared with the account, including folders in shared drives Files shared with a group the account was a member of at the time the group was granted access to the files (if the group has fewer than 200 members). Files shared with a group the account is a member of and that the account opened (if the group has 200 or more members) Files shared with everyone in the organization or publicly that the account opened (Optional) Files in shared drives Vault searches only files directly shared with an account or files in folders directly shared with an account. Shared drives are otherwise not included unless you choose to add them to your search. If you include shared drives in a search (when you search by account or by organizational unit), Vault searches the shared drives that the searched account belongs to.
Shared drives	Vault searches all files in the selected shared drives.

Search type

Files searched

Specific accounts
or
Organizational unit

Vault searches:

Files owned by the account
Files directly shared with the account, including files owned by users outside your organization
Files directly shared with the account, including files in shared drives
Files in folders directly shared with the account, including folders in shared drives
Files shared with a group the account was a member of at the time the group was granted access to the files (if the group has fewer than 200 members).
Files shared with a group the account is a member of and that the account opened (if the group has 200 or more members)
Files shared with everyone in the organization or publicly that the account opened

(Optional) Files in shared drives

Vault searches only files directly shared with an account or files in folders directly shared with an account. Shared drives are otherwise not included unless you choose to add them to your search. If you include shared drives in a search (when you search by account or by organizational unit), Vault searches the shared drives that the searched account belongs to.

Shared drives

Vault searches all files in the selected shared drives.

Note: Vault search doesn't include folders or Drive shortcuts.

Search for Meet recordings & associated chat, attendance, Q&A, poll logs, and meeting notes

Recordings—You can search by the meeting title and metadata such as the owner, meeting ID, and recording start time. If captions are turned on for the meeting, Vault searches the contents of the captions. To limit your search to only videos, you can use the search term type:video.
Chat logs—Saved as an SBV file. Chat logs contain message timestamps relative to recording start time, first and last names of senders, and message text. You can search by file name, text in the log, and metadata (such as when the file was created).
Attendance—Saved as a Google Sheets file. The logs contain the participants' names, emails, and length of time they were on the call. You can search by file name, text in the log, and metadata, such as when the file was created.
Q&A and polls logs—Saved as a Sheets file. The logs contain the questions, answers, and participants. You can search by file name, text in the log, and metadata, such as when the file was created.
Notes—Saved as a Google Doc file and created when you use Take meeting notes in Google Calendar. You can search by file name, text in the notes, and metadata, such as when the file was created.

Learn more about Meet recordings

How do I search for sites?

To limit your search results to sites created in new Sites, enter the search term type:site. To exclude sites, enter the search term -type:site or NOT type:site.

What file types can I preview with Vault for Drive?

You can preview the following file types:

Files created with Google Docs, Sheets, Slides, Sites, and Drawings
Uploaded files such as .docx, .pdf, and .xlsx
When you preview a site, you can also preview external links. You can preview embedded files if they are preview supported, such as an embedded sheet or doc, and you have access privileges to the file. If you don’t have access privileges, you need to search for the embedded file directly.

You can’t preview encrypted files, videos, or the contents of ZIP files.

Search within the revision history of a file

You can search only the most recent version of a file. However, you can enter a version date as part of your search. When you enter a version date, Vault searches the current version of the file, but you preview and export the contents of the last version saved before 12:00 AM on the specified date. You set the time zone in the query. Google Drive retains versions of files created with Google Docs, Sheets, Slides, Sites, Drawings, and Vids.

Early versions of very large files—except those subject to a hold—might be merged to save storage space. If you search Vault using Drive, you can't access the early versions. Instead, you get the earliest available merged version.

Some properties are reported for the current version, no matter what version date you specify. These properties include the title, who it was shared with, when it was last modified, approvers and approval status, and other data in Vault’s metadata.xml file.

Version snapshots include comments, subject to the following criteria:

Open comments are included only if your organization has comment or edit access to the document. Comments aren’t included if you only have view access.
An open individual comment (one with no replies) is included if: 1) the comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). A comment isn’t included in versions from before the comment was created.
An open comment thread (one with replies) is included in its entirety if: 1) the first comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). For example, if a comment thread has two messages that were created on October 1 and October 5, a search with the version date of October 2 contains both comments even though the October 5 comment didn’t exist at the time.
Edited comments are included as they currently exist, not how they were at the version time.
Resolved or deleted comments aren’t included in a version, even if the comment was open at the version time.

Can I search the top organizational unit of my organization?

No. You can't search the top organizational unit. Select a child organizational unit or individual accounts. You can search Drive for up to 5,000 accounts total (as individual accounts or members of organizational units).

Creation and modification time of an uploaded file depends on the source of the file

When a file is first uploaded to Google Drive, it is assigned a creation date and a modification date. These dates match either the local file’s creation date or the upload date, depending on how the file was added to Drive.

The following table shows which time is used for various sources:

Upload—The timestamp when the file was uploaded to Drive
Local—The timestamp of the original file's creation time on the source device or service

File source (client)	Creation time	Modification time
Web app	Upload	Before April 8, 2020: Upload After April 8, 2020: Local
Google Drive for desktop	Upload	Local
Backup & Sync	Upload	Local
iOS	Upload	Upload
Android	Upload	Upload
G Suite Migrate	Local	Local
Drive API	Can be set by caller	Can be set by caller

Search for files in Drive

Sign in to https://vault.google.com.
Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
1. Click Create.
2. Enter a name for the matter and, optionally, a description.
3. Click Create.
The Search tab opens.
For the service, select Drive.
Select the source data to search:
- All data—Search all messages in your organization.
- Held data—Search only messages on hold for the matter.
Select the entity to search:
- Specific accounts—Enter up to 5,000 account email addresses.
- Organizational unit—Search all accounts in a specific organizational unit. In the dialog that opens, select an organizational unit.
  If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched. The organizational unit must have fewer than 5,000 members, including child organizational units.
- Shared drives—Search one or more shared drives.
  Select the shared drives and click Add. If you have many shared drives and the list is paginated, your selection is preserved as you change pages. If you check the Select all box at the top of the list, it selects only the current page. You can also search the list by a member’s email or by the shared drive’s name.
  1. To filter the list by the email address of a member:
    1. Click Find by member email.
    2. Enter one or more accounts.
    3. Click Find.
  2. To filter the list by the name of the shared drive (if your organization has less than 1,000 shared drives):
    1. Click Filter by name and enter letters in the name of the shared drive. For example, pr matches shared drives named “Sales projects”, “Marketing Projects”, and “Product management”, but not “Repairs”.
      The paginated list automatically updates as you add letters.
    2. Check the box or boxesclick Enter.
  3. To find the shared drive by name (if your organization has more than 1,000 shared drives):
    1. Click Find by shared drive name.
    2. Enter one or more words in the name of the shared drive. Note: Words must be exact and complete. For example, marketing, projects matches shared drives named “Marketing projects Q4’22” and “Projects for marketing”. It doesn’t match a shared drive named “Marketing project archive” because “project” doesn’t end with an “s”. Similarly, ma doesn’t match any of these shared drives because it’s only part of a word, not the complete word.
    3. Click Find.
- Sites—Search for sites by URL.
  1. In the dialog that opens, enter one or more published site URLs, separated by commas. The URL format is sites.google.com/domain/site-name. Note: You can’t search by page URL, only site URL. You can’t search by site URL for sites shared by external organizations.
  2. Click Find.
  3. In the list of sites, select the sites you want to include in your search and click Add.
(Optional) If you search accounts or an organizational unit, to include files in shared drives, click Include items from shared drives .
(Optional) Select a time zone.
(Optional) Enter a range for Date modified.
- If you enter a start date, Vault returns all items modified on or after that date.
- If you enter an end date, Vault returns all items modified on or before that date.
(Optional) In Terms, enter one or more search terms:
- To search for one or more keywords in the content, title, or metadata, enter words separated by spaces. For example, project goals.
- To search for a phrase, put the words in quotes. For example, "project goals".
- To search by account, sharing, item name, item type, or modification date, use search operators.
Search terms can't exceed 2,000 characters.
(Optional) To retrieve versions of files created in Google Docs, Sheets, Slides, Sites, Drawings, and Vids saved on a specific date, enter a Version date. For details, on this page go to the section on version history.
(Optional) To search only client-side encrypted files or exclude them from your search, click Advanced search options and select which files to search (default is all files). Note: This option is available only if Google Workspace Client-side encryption is turned on.
Click one of the following:
- Search—Run your search and return a list of items that match your query.
- Export—Directly export the search results and skip the search results preview. Learn more about exports.
After your search& or export completes, you can take the following actions:
- To edit your search, click Expand.
- To open a preview of an item, click the item. Note: In your results list, client-side encrypted files have an Encrypted icon next to them.
- To create an export of your search results, click Export. Learn more about exports.
- To save your query, click Save. Learn more about saved queries.
- To clear all fields and start a new search, click Clear.

Preview search results

After you run a search, you can review and download the items that matched your query.

Preview is supported for Google files such as Docs, Sheets, Slides, Sites, Drawings, and Vids, as well as other common types such as PDF, DOCX, and XLSX. You can't preview ZIP, binary, video, or encrypted files. In Google files, you can't preview comments, suggested edits, or revision history.

Note: The Google Sheets IMAGE function can reference an image by URL, such as "https://example.com/images/logo.jpg". When you preview the spreadsheet in Vault, the image is retrieved in real time from the source. For images uploaded or inserted in the spreadsheet, Vault stores and displays the image available at the date specified in your search.

To preview an item, in the search results list, click the item.
- For supported file types, a preview of the item opens.
- For file types that aren't supported in preview, Vault shows an error but you can still download the item.
To download an item from the preview, click More Download.

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}

Was this helpful?

How can we improve it?