Vault search FAQ

Vault search

How does Vault handle time zones and daylight saving time?

Time zones

You can specify a time zone when searching for data, and Vault uses it to determine the boundaries of dates for displaying and exporting results.

Because of the way messages are stored and accessed on Google servers, the send time of mail and Groups messages are rounded to the nearest hour. Thus a message sent, for example, at 11:30 PM on December 31 would be included in Vault a search that begins on January 1. This rounding doesn't affect your searches in Drive.

If your search includes dates, the search boundaries are as follows:

  Mail and Groups Drive
Start 11:30:00 PM 
(the previous day)
12:00:00 AM
End 12:29:59 AM
(the next day)
11:59:59 PM

If you don't choose a time zone for your search, Vault uses the time zone reported by your computer.

Daylight saving time

You may need to adjust the time zone to accommodate daylight saving time changes. For example, if you're searching for files created by a user in New York:

  • Choose GMT-5 for all files created from December 1 to January 31 (standard time is in effect).

  • Choose GMT-4 for all files created from June 1 to July 31 (daylight saving time is in effect).

An incorrect time zone can lead to incorrect search results

The time zone you choose can change search results. For example, if you're searching for messages from an employee in France (GMT+1), but your search uses the Pacific Time Zone (GMT-8), your effective search range from 4:00 PM on the day before your start date to 3:59 PM on your end date.

Depending on the needs of your organization and any legal requirements that must be satisfied by your search, you may be required to:

  • Perform multiple searches if the data being searched was generated by users located in multiple time zones.
  • Use the time zone where the organization's headquarters is located if the person doing the search is located in a different time zone.
  • Use the time zone specified in a court order or other legal document related to the search.
  • Consider the time of year and whether you need to adjust the time zone to accommodate daylight saving time.

These are just examples used to illustrate how time zone can affect search output. Your organization must define its own search strategies to account for the impact of time zone and daylight saving time on search results.

Why do some Vault searches result in errors?

Occasionally a search will generate errors:

  • Vault can't search an account while its data is being synchronized. This is a temporary issue, and the data should be available in approximately 10 minutes. If accounts remain unavailable,  contact us for assistance.
  • Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. If this happens, refine your search terms to make the search more specific. For example, if subj:foo* produces too many matches, you might try searching for subj:food* (to find "food") and subj:foot* (to find "foot" and "football").
How does the count feature work?

Use the count feature to assess the scope of search terms before you submit a search for mail or groups. Depending on the number of messages Vault counts, you may want to modify the search terms to further expand or restrict the results.

Messages can be counted twice. For example, if sends a message to, Vault counts that message twice because it exists in both mailboxes. When a user sends a message to someone outside the domain, that message is counted only once.

Gmail and classic Hangouts search

If a message isn't delivered in Gmail (for example, blocked spam messages), will Vault store it?

No. The message must be delivered to the mailbox for it to be archived in Vault.

Can I use Vault to search for chat messages?

Vault fully supports classic Hangouts chats that take place after April 8, 2015. You can retain, hold, search, and export chats that occur within Hangouts with history turned on.

For Hangouts that occurred before this date:

  • only on-the-record chats can be searched, exported, and placed on hold
  • retention policies are not properly applied to Hangouts messages

Vault also fully supports Hangouts Chat.

Can administrators require chats to be "on the record" so that they are retained with Vault?
  • Google Hangouts: Administrators can control whether history is on or off. Vault can retain all Hangouts chats that take place after April 8, 2015 with history on.
  • Google Talk: Administrators can only require chats to be "off the record" and can disable chat history.
What happens to a Vault user that has exceeded the G Suite storage limit?

There is no impact to Vault when when this happens. However, a user who has exceeded the storage limit can no longer send or receive any new mail and may experience general account degradation.

Can I restore messages retained in Vault back to Gmail?

For data that was deleted fewer than 25 days ago, we recommend that you use the Google admin console to restore a user’s Google Drive or Gmail data.

For email that was deleted more than 25 days ago and is covered by a hold or a retention policy, you can use Vault to restore Gmail messages.

How can I exclude automatically saved and discarded drafts in a Vault search?

Add the following operator to your search terms-(label:^deleted AND label:drafts)

Can I perform a Vault search within a specific organizational unit?

Yes. When performing a search within a matter, select Organization, and then select the organizational unit you want to search. Accounts cannot be included in an organizational unit-based search, but you can still (optionally) specify a date range and search terms.

How can I exclude messages that have been quarantined?

Add the following operator to your search terms-label:^admin_quarantine.

Learn more about admin quarantine.

Google Drive search

How does Vault search for files in Drive?

Vault searches Drive for all files owned by and directly shared with the users specified in your search entry. This includes files in a Team Drive that are directly shared with a user, regardless of whether the user is a member of that Team Drive.

Vault also searches files that are:

  • Shared with a group the user belongs to
  • Shared with the domain 
  • Shared publicly
Can I search Team Drives?

Yes, when you search for files in Drive, you have two options:

  • When you're searching for files belonging to specific users or organizational units, you can check a box to include results from their associated Team Drives in your search.
  • You can use Vault to find Team Drives. You can then search selected Team Drives for files.
Which part of files in Drive are searchable?

You can search for words and phrases that occur in file names and in the contents of files. Vault indexes the first 100 pages of text files and the first 10 pages of text in image PDFs.

You can search text within the following file types:

Note: G Suite for Government customers cannot search the contents of files. However, they can search file names and other file properties.

Vault doesn't index video, audio, image, or binary files.

What file types can I preview with Vault for Drive?

You can preview these files:

  • Google files such as Docs, Sheets, Slides, and Drawings
  • User-uploaded files such as .docx, .pdf, and .xlsx
Can I search within the revision history of a document?

No. Currently you can search only the most recent version of a file. However, you can enter a version date during search to view and export Google files as they existed on that date. Versioning is not supported in non-Google files like PDF and .docx.

A file's version history doesn't include changes to:

  • the title
  • who it was shared with
  • comments
Can Vault search Google Drive for my entire domain?

Vault can search up to 5,000 users (individual users or members of organizational units).

How does Vault handle files that are shared with but not owned by a user?

Vault can search, export, retain, and hold all files that are in a user’s Drive, which can include unopened files, as well as Team Drive files if they were shared specifically with that user. Files owned by a user outside of your domain, even if shared with a user in your domain, are not subject to your organization’s holds and retention rules.

Team Drive files are owned by the associated team and are shared with all team members. As such, Vault can also search, export, retain, and hold files in Team Drives associated with a user

Was this article helpful?
How can we improve it?