Use Vault to search Gmail and classic Hangouts

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search for Gmail and classic Hangouts messages, identify accounts of interest, review and print message contents, and view and download attachments.

Things to know before you search

For even more information, see the Vault Search FAQ.

What types of attachments are indexed?

Compatible text-based attachment file types (for example, files with .pdf, .xslx, and .docx extensions) are indexed for search. However, Vault doesn't index video, audio, image, and binary content.

How does Vault handle large messages and attachments?

Vault indexes and searches approximately the first megabyte of a message and any attachments. If Vault finds a match, it searches the rest of the data and makes it available for preview and export.

System-generated Gmail labels may affect search results

Gmail uses system-generated labels to categorize messages and user-visible labels to let users sort messages in their inboxes. Gmail might apply the system-generated finance label to messages that come from a user's bank and the system-generated travel label to messages that include hotel reservations.

Users can create and apply user-visible labels. Sometimes, these labels can match system-generated labels. When the 2 types of labels match, Vault search returns the messages with the user-created label and not to messages with the identical system-generated label. If you create a retention rule based on a label, you might include or exclude more messages than you intend to cover.

Example

You want to search all data related to corporate finance and the following actions occur:

  • Employees are instructed to create a label, finance, and apply it to messages that include corporate financial information.
  • Employees have their corporate credit card statements emailed to their work accounts. They don’t apply the user-created finance label, but Gmail applies the system-generated finance label to these messages.

In this scenario, a search query that includes messages with label:finance returns only the user-labeled messages but not the messages with the system-generated label that have the employees' personal bank statements.

Common system-generated labels

  • personal
  • social
  • promotion
  • promos
  • updates
  • forums
  • travel
  • purchases
  • finance
  • all
  • buzz
  • chat
  • chats
  • done
  • draft
  • drafts
  • important
  • inbox
  • lowpriority
  • low_priority
  • mute
  • muted
  • pinned
  • read
  • reminder
  • reminders
  • scheduled
  • sent
  • snoozed
  • spam
  • phishing
  • star
  • starred
  • task
  • tasks
  • trash
  • trips
  • unimportant
  • unread
  • voicemail
  • saved 

Search for Gmail and classic Hangouts messages

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

  1. Sign in to vault.google.com.
  2. Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
  3. If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
    1. Click Create.
    2. Enter a name for the matter and, optionally, a description.
    3. Click Create.

    The Search tab opens.

  4. For the service, select Gmail.
  5. Select the source data to search:
    • All data—Search all messages in your organization.
    • Held data—Search only messages on hold for the matter.
    • Unprocessed data—Search only messages that Vault is still processing.
  6. Select the entity to search:
    • All accounts—Search all accounts in your organization.
    • Specific accounts—Enter up to 500 account email addresses. Vault searches the envelope sender and recipient addresses for the specified accounts. To search by header, sender, or recipient address, enter query terms in the Terms field.
    • Organizational unit—Search accounts in a specific organizational unit. If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched.
  7. (Optional) Select a time zone.
  8. (Optional) Enter a range for Date sent.
    • If you enter a start date, Vault returns all messages sent on or after that date.
    • If you enter an end date, Vault returns all messages sent on or before that date.
  9. (Optional) In Terms, enter one or more search terms:
    • To search for one or more keywords in the message, enter words separated by spaces. For example, project goals.
    • To search for a phrase, put the words in quotes. For example, "project goals".
    • To search by account, date, message properties, or subject, use search operators.
    • To search only classic Hangouts messages, enter is:chat. To exclude classic Hangouts messages, enter NOT is:chat.

    Search terms can't exceed 2,000 characters.

  10. (Optional) To exclude draft messages from this search, enable Exclude email drafts. When this option is disabled, Vault returns all draft messages that match your query, including automatically saved drafts.
  11. Click one of the following:
    • Search—Run your search and return a list of messages that match your query.
    • Count—Calculate the number of messages that match your query and the number of accounts that have matching messages. To download a CSV file of the query count data, click Download Accounts With Matches. Learn more about assessing the scope of a query.
    • Export—Directly export the search results and skip the search results preview. Learn more about exports
  12. After your search, count, or export completes, you can take the following actions:
    • To edit your search, click Expand.
    • To open a preview of a message and its thread, click the message.
    • To create an export of your search results, click Export. Learn more
    • To save your query, click Save. Learn more
    • To clear all fields and start a new search, click Clear.

Preview messages in search results

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

After you run a search, you can review and print the messages that matched your query, and view and download attachments.

  1. In the search results list, click the message. A list of messages in the thread opens and automatically displays the content of the most recent message in the thread.
    • Messages with a "" have one or more attachments. Click the message to download or view the attachment.
    • Messages with a Turn on confidential mode were sent with Gmail confidential mode. You can hide or display their message contents when you preview and print these messages. Learn more
    • For long threads, only the most recent 100 messages are available in preview. However, an export of the search results includes all messages that match your query, including messages not in preview.
  2. To show the contents of an individual message, click the message. To show the contents of all messages in the thread, click Expand all "".
  3. To view a message and all its header content, click Original.
  4. To print an individual message, click Print. To print all messages in a thread, click Print thread "".

Use classic Vault

Click below to open steps for classic Vault (ediscovery.google.com). Go to steps for new Vault

Search Gmail and classic Hangouts in ediscovery.google.com

Search for Gmail and classic Hangouts messages

  1. Create a new matter or click an existing matter.
  2. Click Search in the left pane, and then click Mail as the type of data to search.
  3. Choose a Source:
    • All data—Search all data in your organization.
    • Held data—Search all data on hold for the matter.
    • Unprocessed data—Search content that we have identified as partially processed.
  4. Select a Search method:
    • All Accounts—search all licensed Vault accounts in the domain.
    • Specific Accounts—enter accounts to search specific users. You can enter up to 5,000 accounts. This field searches for the envelope sender or recipient address. Use Terms to search by header, sender, or recipient address.
    • Organizational Unit—Search within a specific organizational unit. If you choose one with suborganizational units, all of the suborganizational units will be searched.
  5. (Optional) Enter a sent date range and choose a time zone.
    • If you enter a start date, Vault returns all messages sent on or after the date you entered.
    • If you enter an end date, Vault returns all messages sent on or before the date you entered.
  6. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches. Search terms can't exceed 2,000 characters.
     
    Tip: To search for classic Hangouts messages, use the search term is:chat.
  7. (Optional) Check the Exclude drafts box to exclude draft messages from this search. If left unchecked, Vault will return any draft messages that match your criteria, including automatically saved drafts.
  8. Click one of the following:
    • Search—to perform a search.
    • Count--to display the number of messages that match this query, along with the number of accounts that have matching messages. You can download a CSV file that includes account names and message totals for this query. Learn more about assessing the scope of a query.
    • Export—to skip preview and immediately export the search results.
  9. (Optional) Click the Search down arrow to:
    • Reset—to clear the search form.
    • Duplicate search form—to open another search form under the current form, pre-populated with the information you've already entered.

Preview search results

When you open a message, the thread's entire conversation is displayed. For very long threads, only the most recent 100 messages are included in the preview. You can't preview earlier messages from the thread. However, all messages that match your search criteria are included when you export.

Note: Vault exports only the messages that match your search terms. Go back and modify your search terms if you need to export additional messages from the thread.

  • To view basic header information for a message, click show details.

    Basic message details:
    • From
    • To
    • Date
    • Subject
    • System labels—Shows the status of the message in the user's account:
      • Unread
      • Inbox
      • Spam
      • Sent
      • Opened
      • Draft
      • Trash
      • Deleted
      • Chats
    • User labels—Shows any labels applied to the message by the user.
  • To view a message in its entirety, including all header information, click original.
  • Messages with a Turn on confidential mode were sent with Gmail confidential mode. You can hide or display their message contents when you preview and print these messages. Learn more about Gmail confidential mode.
  • To print an individual message, click print.
  • To print all messages in a conversation, click Print all.
  • For messages with attachments, you can Download the attached files. For some file types (such as .docx, .ppt, and .pdf) you can View the attachment without downloading it. 
Was this helpful?
How can we improve it?