Use Vault to search Gmail and classic Hangouts

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search for Gmail and classic Hangouts messages, identify accounts of interest, review and print message contents, and view and download attachments.

Things to know before you search

Before you search for messages, we recommend you review the Gmail messages supported in Vault and the Vault Search FAQ.

Open all  |  Close all

Gmail search includes most group conversations from Chat

As of early December 2020, if your organization still has classic Hangouts turned on for users, most group messages in Chat are synchronized to group conversations in classic Hangouts. However, messages deleted by users but retained by Vault don't sync to classic Hangouts. To make sure your search returns all matching messages available to Vault, search in Chat.

How can I exclude automatically-saved or discarded drafts in a Vault search?

A user's Gmail data can include 3 types of draft messages. You can exclude all or only certain types of draft messages in search results and exports:

  • To exclude all draft types, check the Exclude drafts box before you search. Previews still include automatically saved versions of draft messages, but these aren’t included when you export.
  • To exclude automatically-saved drafts, add the following operator to your search terms: ‑label:^r_ad.
  • To exclude discarded drafts and automatically saved versions, and include only unsent drafts, add ‑(label:^deleted AND label:drafts) to your search terms. Preview will still include automatically saved versions of draft messages, but these aren’t included when you export.
How can I exclude messages that have been quarantined?

Add the following operator to your search terms: ‑label:^admin_quarantine.

Learn more about admin quarantine.

Search for Gmail and classic Hangouts messages

  1. Sign in to vault.google.com.
  2. Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you're allowed to access is searchable from any matter.
  3. If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
    1. Click Create.
    2. Enter a name for the matter and, optionally, a description.
    3. Click Create.

    The Search tab opens.

  4. For the service, select Gmail.
  5. Select the source data to search:
    • All data—Search all messages in your organization.
    • Held data—Search only messages on hold for the matter.
    • Unprocessed data—Search only messages that Vault is still processing.
  6. Select the entity to search:
    • All accounts—Search all accounts in your organization.
    • Specific accounts—Enter up to 500 account email addresses. Vault searches the envelope sender and recipient addresses for the specified accounts. To search by header, sender, or recipient address, enter query terms in the Terms field.
    • Organizational unit—Search accounts in a specific organizational unit. If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched.
  7. (Optional) Select a time zone.
  8. (Optional) Enter a range for Date sent.
    • If you enter a start date, Vault returns all messages sent on or after that date.
    • If you enter an end date, Vault returns all messages sent on or before that date.
  9. (Optional) In Terms, enter one or more search terms:
    • To search for one or more keywords in the message, enter words separated by spaces. For example, project goals.
    • To search for a phrase, put the words in quotes. For example, "project goals".
    • To search by account, date, message properties, or subject, use search operators.
    • To search only classic Hangouts messages, enter is:chat. To exclude classic Hangouts messages, enter NOT is:chat.

    Search terms can't exceed 2,000 characters.

  10. (Optional) To exclude draft messages from this search, turn on Exclude email drafts. When this option is turned off, Vault returns all draft messages that match your query, including automatically saved drafts.
  11. Click one of the following:
    • Search—Run your search and return a list of messages that match your query.
    • Count—Calculate the number of messages that match your query and the number of accounts that have matching messages. To download a CSV file of the query count data, click Download Accounts With Matches. Learn more about assessing the scope of a query.
    • Export—Directly export the search results and skip the search results preview. Learn more about exports
  12. After your search, count, or export completes, you can take the following actions:
    • To edit your search, click Expand.
    • To open a preview of a message and its thread, click the message.
    • To create an export of your search results, click Export. Learn more
    • To save your query, click Save. Learn more
    • To clear all fields and start a new search, click Clear.

Preview messages in search results

After you run a search, you can review and print the messages that matched your query, and view and download attachments.

  1. In the search results list, click the message. A list of messages in the thread opens and automatically displays the content of the most recent message in the thread.
    • Messages with a "" have one or more attachments. Click the message to download or view the attachment.
    • Messages with a Turn on confidential mode were sent with Gmail confidential mode. You can hide or display their message contents when you preview and print these messages. Learn more
    • For long threads, only the most recent 100 messages are available in preview. However, an export of the search results includes all messages that match your query, including messages not in preview.
  2. To show the contents of an individual message, click the message. To show the contents of all messages in the thread, click Expand all "".
  3. To view a message and all its header content, click Original.
  4. To print an individual message, click Print. To print all messages in a thread, click Print thread "".
Was this helpful?
How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
96539
false