Use Vault to search Gmail and classic Hangouts


Vault is for administrators and legal personnel. Vault won't work properly until your G Suite administratorsets up your account. 


Once you create a matter, use Vault to search Gmail and classic Hangouts messages. You can also use Vault to search for:

Things to know before you search

Before you search, you should understand the following. For additional information about searching for data, see the Vault Search FAQ.

What types of attachments are indexed?

Compatible text-based attachment file types (for example, files with .pdf, .xslx, and .docx extensions) are indexed for search. However, Vault doesn't index video, audio, image, and binary content.

How does Vault handle large messages and attachments?

Vault indexes and searches approximately the first megabyte of a message and any attachments. If Vault finds a match, it searches the rest of the data and makes it available for preview and export. 

System-generated Gmail labels may affect search results

Gmail uses labels to organize messages in user inboxes. There are two types of labels:

  • user-visible labels—these labels appear in Gmail's user interface. A few common labels are present in all Gmail accounts, and users can create new labels to help organize their messages.
  • system-generated labels—these labels are used by Gmail's backend systems to classify messages. They're invisible to end users.

System-generated labels control how messages are presented to Gmail users. For example, Gmail may apply the finance label to messages that come from a user's bank and the travel label to messages that include hotel reservations.

When a user creates a label that matches a system-generated label, Gmail can disambiguate these labels and display messages appropriately. However, Vault can't distinguish system-generated labels from user-created labels that have the same name. Using a system-generated label to search for messages could return more messages than you expect.

For example, let's say an organization is required to retain all data related to corporate finance for 7 years:

  • Employees are instructed to create a label named finance and apply it to messages that include corporate financial information.
  • Some employees have their personal bank statements sent to their corporate accounts; Gmail applies the system-generated label named finance to these messages.

In this scenario, a search that includes label:finance will return the messages with employees' personal bank statements.

We recommend you use caution when using the following labels in a search:

  • personal
  • social
  • promotion
  • promos
  • updates
  • forums
  • travel
  • purchases
  • finance
  • all
  • buzz
  • chat
  • chats
  • done
  • draft
  • drafts
  • important
  • inbox
  • lowpriority
  • low_priority
  • mute
  • muted
  • pinned
  • read
  • reminder
  • reminders
  • scheduled
  • sent
  • snoozed
  • spam
  • phishing
  • star
  • starred
  • task
  • tasks
  • trash
  • trips
  • unimportant
  • unread
  • voicemail
  • saved

Search for Gmail and classic Hangouts messages

  1. Create a new matter or click on an existing matter.
  2. Click Search in the left pane, and then click Mail as the type of data to search.
  3. Choose a Source:
    • All data—Search all data in your organization.
    • Held data—Search all data on litigation hold for the matter.
    • Unprocessed data—Search content that we have identified as partially processed.
  4. Select a Search method:
    • All Accounts—search all licensed Vault accounts in the domain.
    • Specific Accounts—enter accounts to search specific users. You can enter up to 500 accounts. This field searches for the envelope sender or recipient address. Use Terms to search by header, sender, or recipient address.
    • Organizational Unit—Search within a specific organizational unit. If you choose one with suborganizational units, all of the suborganizational units will be searched.
  5. (Optional) Enter a sent date range and choose a time zone.
    • If you enter a start date, Vault returns all messages sent on or after the date you entered.
    • If you enter an end date, Vault returns all messages sent on or before the date you entered.
  6. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches. Search terms can't exceed 2,000 characters.
    Tip: To search for classic Hangouts messages, use the search term is:chat.
  7. (Optional) Check the Exclude drafts box to exclude draft messages from this search. If left unchecked, Vault will return any draft messages that match your criteria, including automatically saved drafts.
  8. Click one of the following:
    • Search—to perform a search.
    • Count--to display the number of messages that match this query, along with the number of accounts that have matching messages. You can download a CSV file that includes account names and message totals for this query. Learn more about assessing the scope of a query.
    • Export—to skip preview and immediately export the search results.
  9. (Optional) Click the Search down arrow to:
    • Reset—to clear the search form.
    • Duplicate search form—to open another search form under the current form, pre-populated with the information you've already entered.

Preview search results

When you open a message, the thread's entire conversation is displayed. For very long threads, only the most recent 100 messages are included in the preview. You can't preview earlier messages from the thread. However, all messages that match your search criteria are included when you export.

Note: Vault exports only the messages that match your search terms. Go back and modify your search terms if you need to export additional messages from the thread.

  • To view basic header information for a message, click show details.

    Basic message details:
    • From
    • To
    • Date
    • Subject
    • System labels—Shows the status of the message in the user's account:
      • Unread
      • Inbox
      • Spam
      • Sent
      • Opened
      • Draft
      • Trash
      • Deleted
      • Chats
    • User labels—Shows any labels applied to the message by the user.
  • To view a message in its entirety, including all header information, click original.
  • Messages with a Turn on confidential mode were sent with Gmail confidential mode. You can hide or display their message contents when you preview and print these messages. Learn more about Gmail confidential mode.
  • To print an individual message, click print.
  • To print all messages in a conversation, click Print all.
  • For messages with attachments, you can Download the attached files. For some file types (such as .docx, .ppt, and .pdf) you can View the attachment without downloading it. 
Was this helpful?
How can we improve it?