Search
Clear search
Close search
Google apps
Main menu

Search for data

Once you create a matter, use Vault to search for:

Things to know before you search

Before you search, you should understand the following. For additional information about searching for data, see the Vault Search FAQ.

Expand all Collapse all

 

What types of attachments are indexed?

Compatible text-based attachment file types (for example, files with .pdf, .xslx, and .docx extensions) are indexed for search.

What types of content are not processed for indexing?

Video, audio, image, and binary content are not processed for indexing.

Do search results that are displayed in Vault contain only the first megabyte of data?

No. Although approximately the first megabyte is indexed and searched, if there's a match, the whole email and any attachments are displayed in Vault.

Can I search Team Drives?

Yes, when you search for files in Drive, you have two options:

  • When you're searching for files belonging to users or organizational units, you can check a box to include results from their associated Team Drives in your search.
  • You can use Vault to find specific Team Drives that you can then search for files. 
How does Vault handle time zones and daylight saving time?

Time zones

You can specify a time zone when searching for data, and Vault uses it to determine the boundaries of dates for displaying and exporting results.

Because of the way messages are stored and accessed on Google servers, the send time of mail and Groups messages are rounded to the nearest hour. Thus a message sent, for example, at 11:30 PM on December 31 would be included in Vault a search that begins on January 1. This rounding doesn't affect your searches in Drive.

If your search includes dates, the search boundaries are as follows:

  Mail and Groups Drive
Start 11:30:00 PM 
(the previous day)
12:00:00 AM
End 12:29:59 AM
(the next day)
11:59:59 PM

If you don't choose a time zone for your search, Vault uses the time zone reported by your computer.

Daylight saving time

You may need to adjust the time zone to accommodate daylight saving time changes. For example, if you're searching for files created by a user in New York:

  • Choose GMT-5 for all files created from December 1 to January 31 (standard time is in effect).

  • Choose GMT-4 for all files created from June 1 to July 31 (daylight saving time is in effect).

An incorrect time zone can lead to incorrect search results

The time zone you choose can change search results. For example, if you're searching for messages from an employee in France (GMT+1), but your search uses the Pacific Time Zone (GMT-8), your effective search range from 4:00 PM on the day before your start date to 3:59 PM on your end date.

Depending on the needs of your organization and any legal requirements that must be satisfied by your search, you may be required to:

  • Perform multiple searches if the data being searched was generated by users located in multiple time zones.
  • Use the time zone where the organization's headquarters is located if the person doing the search is located in a different time zone.
  • Use the time zone specified in a court order or other legal document related to the search.
  • Consider the time of year and whether you need to adjust the time zone to accommodate daylight saving time.

These are just examples used to illustrate how time zone can affect search output. Your organization must define its own search strategies to account for the impact of time zone and daylight saving time on search results.

Search for mail and chat messages

  1. Click a matter name.
  2. Click Search in the left pane.
  3. Choose a Source:
    • All data—Search all data in your organization.
    • Held data—Search all data on litigation hold for the matter.
    • Unprocessed data—Search content that we have identified as partially processed.
  4. Click Mail as the type of data to search.
  5. (Optional) Select a Search method:
    • Users—Leave blank to search all licensed Vault users in the domain, or enter accounts to search specific users. You can enter up to 500 accounts. This field searches for the envelope sender or recipient address. Use Terms to search by header, sender, or recipient address.
    • Organizational Unit—Search within a specific organizational unit. If you choose one with sub-organizational units, all of the sub-organizational units will be searched. 
  6. (Optional) Enter a sent date range and choose a time zone.
  7. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches.
  8. (Optional) Check the Exclude drafts box to exclude email drafts from this search. If left unchecked, Vault will return any draft messages that match your criteria, including automatically saved drafts.
  9. Click Search.
  10. (Optional) Click the Search drop-down arrow to:
    • Count results—Displays the number of messages found by the search terms you've entered. You can then modify your search criteria to further expand or restrict the results.
    • Export results—Skips search preview and immediately exports the search results.
    • Duplicate search form—Loads another search dialog prepopulated with the information you've already entered.
    • Reset—Clears the search form.

Search for messages in Groups

  1. Click a matter name.
  2. Click Search in the left pane.
  3. Choose a Source:
    • All data—Search all data in your organization.
    • Held data—Search all data on litigation hold for the matter.
    • Unprocessed data—Search content that we have identified as partially processed.
  4. Click Groups as the type of data to search.
  5. Enter one or more Groups separated by commas. You can search up to 50 Groups. The search fails if you don't specify at least one Group.
  6. (Optional) Enter a sent date range and choose a time zone.
  7. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches.
  8. Click Search.
  9. (Optional) Click the Search drop-down arrow to:
    1. Count results—Displays the number of messages found by the search terms you've entered. You can then modify your search criteria to further expand or restrict the results.
    2. Export results—Skips search preview and immediately exports the search results.
    3. Duplicate search form—Loads another search dialog prepopulated with the information you've already entered.
    4. Reset—Clears the search form.

Search for files in Drive

  1. Click a matter name.
  2. Click Search in the left pane.
  3. Choose a Source:
    • All data—Search all data in your organization.
    • Held data—Search all data on litigation hold for the matter.
  4. Click Drive as the type data to search.
  5. Select a Search method:
    • Users—Enter accounts to search up to 5,000 Vault users in the domain. The search fails if you attempt to search more than 5,000 users or don't include at least one user. You can also check the box to Include results from Team Drives.
    • Organizational Unit—Search within a specific organizational unit. If you choose one with sub-organizational units, all of the sub-organizational units will be searched.The organizational unit must have fewer than 5,000 members. You can also check the box to Include results from Team Drives​.
    • Team Drives—Click Find Team Drives:
      1. Add a Team Drive member's email address.
      2. Start typing the name of the Team Drive you're looking for, then click the one you want. You can choose multiple Team Drives.
  6. (Optional) Enter last modified date range and choose a time zone.
  7. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches.
  8. Vault only searches the latest version of a file. However, you can enter a version date to view and export Google files as they existed on that date. Versioning is not supported in non-Google files like PDF and .docx.
  9. Click Search.
  10. (Optional) Click the Search drop-down arrow to:
    1. Count results—Displays the number of files found by the search terms you've entered. You can then modify your search criteria to further expand or restrict the results.
    2. Export results—Skips search preview and immediately exports the search results.
    3. Duplicate search form—Loads another search dialog prepopulated with the information you've already entered.
    4. Reset—Clears the search form.
Was this article helpful?
How can we improve it?