Vault search FAQ
Vault searchHow does Vault handle time zones and daylight saving time?
You can specify a time zone when searching for data, and Vault uses it to determine the boundaries of dates for displaying and exporting results.
Important: Search might produce unexpected results in some time zones. Learn more.
Because of the way messages are stored and accessed on Google servers, the send time of Gmail and Groups messages are rounded to the nearest hour. Thus a message sent, for example, at 11:30 PM on December 31 would be included in Vault a search that begins on January 1. This rounding doesn't affect your searches in Drive.
If your search includes dates, the search boundaries are as follows:
|Gmail and Groups||Drive|
(the previous day)
(the next day)
If you don't choose a time zone for your search, Vault uses the time zone reported by your computer.
Daylight saving time
You may need to adjust the time zone to accommodate daylight saving time changes. For example, if you're searching for files created by a user in New York:
Choose GMT-5 for all files created from December 1 to January 31 (standard time is in effect).
- Choose GMT-4 for all files created from June 1 to July 31 (daylight saving time is in effect).
An incorrect time zone can lead to incorrect search results
The time zone you choose can change search results. For example, if you're searching for messages from an employee in France (GMT+1), but your search uses the Pacific Time Zone (GMT-8), your effective search range from 4:00 PM on the day before your start date to 3:59 PM on your end date.
Depending on the needs of your organization and any legal requirements that must be satisfied by your search, you may want to consider:
- performing multiple searches if the data being searched was generated by users located in multiple time zones.
- using the time zone where the organization's headquarters is located if the person doing the search is located in a different time zone.
- using the time zone specified in a court order or other legal document related to the search.
- the time of year and whether you need to adjust the time zone to accommodate daylight saving time.
These are just examples used to illustrate how time zone can affect search output. Your organization must define its own search strategies to account for the impact of time zone and daylight saving time on search results.
Occasionally a search will generate errors:
- Vault can't search an account while its data is being synchronized. This is a temporary issue, and the data should be available in approximately 10 minutes. If accounts remain unavailable, contact us for assistance.
- Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. If this happens, refine your search terms to make the search more specific. For example, if subj:foo* produces too many matches, you might try searching for subj:food* (to find "food") and subj:foot* (to find "foot" and "football").
Use the count feature to assess the scope of a query before you submit a Gmail search. Enter your search terms and click Count. After completing a count, Vault shows you:
- the number of accounts searched
- the amount of time required to complete the search
- the number of messages that match your query,
- the number of accounts that have matching messages.
Note: Messages can be counted twice. For example, if email@example.com sends a message to firstname.lastname@example.org, Vault counts that message twice because it exists in both mailboxes. When a user sends a message to someone outside the domain, that message is counted only once.
You can download a CSV file that includes account and message totals for your query. This file includes:
- the date and time
- the query that generated the count
- the number of accounts searched
- the number of accounts that couldn't be searched
- the number of accounts with matching messages
- the email address and name for each account with matches
- the number of matching messages from each account
Gmail and classic Hangouts search
Can I use Vault to search for chat messages?
Vault fully supports classic Hangouts chats that take place after April 8, 2015. You can retain, hold, search, and export chats that occur within Hangouts with history turned on.
For Hangouts that occurred before this date:
- only on-the-record chats can be searched, exported, and placed on hold
- retention policies are not properly applied to Hangouts messages
Vault also fully supports Hangouts Chat.
There is no impact to Vault when when this happens. However, a user who has exceeded the storage limit can no longer send or receive new email messages and may experience general account degradation.
For data that was deleted fewer than 25 days ago, we recommend that you use the Google admin console to restore a user’s Google Drive or Gmail data.
Add the following operator to your search terms: -(label:^deleted AND label:drafts)
Yes. When you search, select Organizational Unit, and then select the organizational unit you want to search. You can't select the top organizational unit and you can't add individual user accounts to an organizational unit-based search. You can also specify a date range and search terms.
Google Drive search
Vault searches Drive for all files owned by and directly shared with the users specified in your search entry. This includes files in a shared drive that are directly shared with a user, regardless of whether the user is a member of that shared drive.
Vault also searches:
- All files owned by and directly shared with the users specified in your search query.
- Shared drives in your organization that have been shared directly with users in your query.
- Files in shared drives that have been shared directly with users in your query.
- Files in external shared drives that have been shared directly with users in your query. Note that Vault can't search an externally owned shared drive that has been shared with users in your organization, even if it includes files that are shared directly with those users.
Yes, when you search for files in Drive, you have two options:
- When you're searching for files belonging to specific users or organizational units, you can check a box to include results from their associated shared drives in your search.
- You can use Vault to find shared drives. You can then search selected shared drives for files.
You can search for words and phrases that occur in file names and in the contents of files. Vault indexes the first 100 pages of text files and the first 10 pages of text in image PDFs.
You can search text within the following file types:
- Microsoft Word, Excel, and Powerpoint
- OpenOffice™ XML
- Wireless Application Protocol (.wap)
- Wireless Markup Language (.wml)
- Google Earth (.kml)
Vault doesn't index video, audio, image, or binary files.
You can preview these files:
- Google files such as Docs, Sheets, Slides, and Drawings
- User-uploaded files such as .docx, .pdf, and .xlsx
Users can link a Google file to another Google file. For example, someone writing in a Google Doc can create a chart that's linked to data contained in a Google Sheet. Whenever the spreadsheet is updated, the chart in the document is also updated.
When you search files in Drive, Vault returns only the files that match your search criteria. If those files include linked files that fall outside of your query, the linked files aren't included in your results.
No. You can search only the most recent version of a file. However, you can enter a version date as part of your search. When you enter a version date, Vault retrieves a snapshot of the file’s contents as of 12:00 AM UTC on the given date. Versioning is supported only in Google Drive for Google Docs, Sheets, Slides, and Drawings.
Some properties are reported for the current version, no matter what version date you specify. These include the title, who it was shared with, when it was last modified, and other data in Vault’s metadata.xml file.
Version snapshots include comments, subject to the following criteria:
- Open comments are included only if your organization has comment or edit access to the document. Comments aren’t included if you only have view access.
- An open individual comment (one with no replies) is included if: 1) the comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). A comment isn’t included in versions from before the comment was created.
- An open comment thread (one with replies) is included in its entirety if: 1) the first comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). For example, if a comment thread has two messages that were created on October 1 and October 5, a search with the version date of October 2 contains both comments even though the October 5 comment didn’t exist at the time.
- Edited comments are included as they currently exist, not how they were at the version time.
- Resolved or deleted comments aren’t included in a version, even if the comment was open at the version time.
No. You can't search the top organizational unit. Select a child organizational unit or individual users. You can search Drive for up to 5,000 users total (as individual users or members of organizational units).