Vault export contents

After you use Google Vault to search for the data you want, you can export a copy of that data and download it for further analysis. An export contains the following information:

• A comprehensive copy of the data that matched your search criteria.
• The metadata you need to link the exported data to individual users in your organization.
• The corroborating information required to prove that the exported data matches the data stored on Google’s servers.

Expand all  |  Collapse all

Gmail (new export)

You can now export Gmail and classic Hangouts messages using an improved system in Vault. The files exported by this system are a little different from the classic format.

If you exported in the classic format, go to Gmail (classic export).

Expand section  |  Close section & go to top

Export contents

Information	File name	Description
Message contents	export_name-N.zip	PST or mbox files with the contents and details of the exported messages. Learn about options for reviewing PST and mbox files. The message files are named export_name-account.mbox or export_name-account.pst, where account is the full email address of the custodian (the account that sent or received the message). When the messages for an account exceed 1 GB for PST files or 10 GB for mbox, they're exported in additional files In this case, the file name includes an increment. For example, an export named "export1" could contain the following files for "[e-mail]" when they have between 20 and 30 GB of messages exported: [e-mail] [e-mail] [e-mail]
Message metadata	export_name-metadata.csv	A CSV file that contains message metadata as it exists on Google servers. Open this file in a spreadsheet editor and use it to connect message metadata with the message contents from the mbox file. Note: PST file contents can’t be correlated with the XML file metadata. Learn more about the metadata file
Accounts and message count	export_name-result-counts.csv	A CSV file that lists the accounts of message owners included in the export, the number of messages owned by each account, and how many messages were successfully exported or had errors. Learn more about the count file
Error report	export_name-error.xml	An XML file that lists errors retrieving messages. It's always part of the export, even when no errors occurred. Learn more about the error report
Messages that didn't convert to PST	export_name-conversion_errors-N.zip	When you export in PST format, this file contains any messages that weren't converted to PST. Each message is a separate EML file named with the value of the Message-ID: header for each message. You get many zip files when there are more than 10 GB of messages.
File checksums	File checksums	A file that lists the message digest 5 (MD5) hash values for all files in the export.

Message parameters in the metadata file

The metadata CSV file lists the following information for each message. The value is blank if the information isn't available or doesn't apply to a message.

Column	Description	Note
Rfc822MessageId	A message ID that is the same for the receiver's and sender's messages. Use this value to correlate metadata with the message in an mbox export. For Hangouts, the value is for the first message in the thread.
GmailMessageId	A unique message ID. Use this value to manage specific messages with the Gmail API. For Hangouts, the value is for the first message in the thread.
Account	The account that had the message in their Inbox. For example, [e-mail] received a message sent to [e-mail] because they're a member of the group. If a search returns that message because it was in user1's Inbox, then the value of To is [e-mail] while the value of Account is [e-mail].
From	The sender account.
To	The recipient account. Multiple recipients are comma-separated and the list is in double quotes.	Gmail only
CC	Accounts in the cc: field.	Gmail only
BCC	Accounts in the bcc: field.	Gmail only
Subject	The message subject.	Gmail only
Labels	Labels applied to the message by Gmail or the user.	Gmail only
DateSent	The message send date in UTC (yyyy-MM-dd'T'HH:mm:ssZZZZ).	Gmail only
DateReceived	The message received date (yyyy-MM-dd'T'HH:mm:ssZZZZ).	Gmail only
SubjectAtStart	The subject of the conversation when the first message was sent.	Hangouts only
SubjectAtEnd	The subject of the conversation when the last message was sent.	Hangouts only
DateFirstMessageSent	The timestamp for when the first message in a conversation was sent.	Hangouts only
DateLastMessageSent	The timestamp for when the last message in a conversation was sent.	Hangouts only
DateFirstMessageReceived	The timestamp for when the first message in a conversation was received.	Hangouts only
DateLastMessageReceived	The timestamp for when the last message in a conversation was received.	Hangouts only
ThreadedMessageCount	The number of messages in the Hangouts conversation.	Hangouts only

Information in the count file

The count CSV file contains a list of the searched accounts and the number of messages in the export associated with each account.

The first row is for Totals, which lists the total exported and errored messages for all emails in the export. Results are sorted in descending order of the number of successfully exported messages for that email address.

Notes about counting

• If your organization has Hangouts messages, each thread is counted as one.
• If a message matches the export query but fails to convert to PST format, it's counted as a success in this file. You can review the messages that didn't convert in the export_name-conversion_errors-N.zip file.

Column	Description
Email	The email address of the sender or recipient.
AccountStatus	If messages for the email account were successfully exported. Value can be the following: Success–Vault retrieved all messages for export PartialAccountError–Vault was unable to retrieve all the messages for export AccountError–Vault was unable to retrieve any messages for export
SuccessCount	The number of messages successfully exported. Equivalent to the count value in the classic count file.
MessageErrorCount	The number of messages that aren’t included in the export. These messages are identified in the error CSV file.
ChatErrorCount	The number of Hangouts messages that aren't included in the export.

Gmail (classic export), Chat, and Groups exports

Expand section  |  Close section & go to top

Export contents

Information	File name	Description
Message contents	export_name-N.zip	Zip files of PST or mbox files. These files contain the contents and details of the exported messages. For Google Chat messages, these details include when the sender edited or deleted a message. Learn about options for reviewing PST and mbox files. You get multiple zip files in the following scenarios: The export includes messages from more than one account. The file size exceeds 1 GB for PST files or 10 GB for mbox. The file names end with an increment to distinguish the files.
Google Groups membership information	export_name-group-membership.csv	A CSV file that lists the following information for each group member: the member's email addresses the email address of the group when the user became a member of the group the member's role: MEMBER for a group member, MANAGER for a group manager, or OWNER for a group owner the type of account: USER for an individual user account or GROUP for a group email address
Message metadata	export_name-metadata.xml export_name-metadata.csv	export_name-metadata.xml–An XML file that contains Gmail and Hangouts, Groups, or Chat message metadata as it exists on Google servers. Learn more export_name-metadata.csv–A CSV file that contains Gmail and Hangouts metadata as it exists on Google servers. Learn more Note: PST file contents can’t be correlated with the XML file metadata.
Accounts and message count	export_name-results-count.csv	A CSV file that lists the accounts of message owners included in the export and the number of messages owned by each account.
Error reports	error.csv export_name–account-exceptions.csv (Gmail exports) export_name–failed-group-membership-lookups.csv (Groups exports)	Error reports are included only if the export encounters errors. error.csv—Lists errors retrieving messages. Learn more export_name–account-exceptions.csv—Lists Gmail accounts that were searched but not all matching messages were exported export_name-failed-group-membership-lookups.csv—Lists group email addresses that were searched but not all members were returned
File checksums	File checksums	The file lists the message digest 5 (MD5) hash values for all files in the export.

Message parameters in the metadata file

The metadata file contains the following information:

Included for Gmail and Groups messages

• #From—The email account of the sender
• #To—The email accounts of all recipients
• #CC—The email accounts of all Cc'd recipients
• #BCC—The email accounts of all Bcc'd recipients
• #Subject—The message subject
• #DateSent—The timestamp for when the message was sent
• #DateReceived—The timestamp for when the message was received

Included for Hangouts and Chat messages

• #SubjectAtStart—(Hangouts only) The subject of the conversation when the first message was sent
• #SubjectAtEnd—(Hangouts only) The subject of the conversation when the last message was sent
• #DateFirstMessageSent—The timestamp for when the first message in a conversation was sent
• #DateLastMessageSent—The timestamp for when the last message in a conversation was sent
• #DateFirstMessageReceived—The timestamp for when the first message in a conversation was received
• #DateLastMessageReceived—The timestamp for when the last message in a conversation was received

Included for all messages (Gmail, Groups, and Chat)

• Labels—Any labels applied by Gmail or Chat, such as ^INBOX, ^TRASH, and ^DELETED. Also shows any labels applied to the message by the user.
• FileName—A message identifier. Use this value to correlate metadata with the corresponding message in an email client or a text editor.
• FileSize—The size of the message in bytes.
• Hash—The MD5 hash of the message.

Included for Chat messages (not Hangouts)

• RoomID–The space, group chat, or DM identifier that the message belongs to.
• Participants–The email addresses of all users who participated in the conversation.
• RoomName–The value depends on the type of message:
  • For Chat spaces, the name of the space.
  • For group conversations created after early December 2020, Group chat.
  • For group conversations created before early December 2020 and DMs, a comma-separated list of accounts that participated.
• ConversationType–The message type:
  • For a group chat created after early December 2020 or a space, the value is Room.
  • For a group chat created before December 2020, the value is Group Direct Message.
  • For a DM, the value is 1:1 Direct Message.

Query parameters for the entire export

• UserQuery—The query submitted by the Vault user that retrieved the messages included in this export.
• TimeZone—The time zone used for date-based searches.
• Custodians—The email addresses of the users whose accounts were searched. If you searched for content rather than individual user accounts, there are no custodians listed here.

Message parameters in the metadata file (CSV)

The metadata CSV file lists the following information for Gmail and classic Hangouts messages. The value is blank if the information isn't available or doesn't apply to a message. Some values are available only for Gmail or only for classic Hangouts.

Note: This file doesn't include metadata for Groups or Chat messages.

Column	Description	Note
Rfc822MessageId	A message ID that is the same for the receiver's and sender's messages. Use this value to correlate metadata with the message in an mbox export. For classic Hangouts, the value is for the first message in the thread.
GmailMessageId	A unique message ID. Use this value to manage specific messages with the Gmail API. For classic Hangouts, the value is for the first message in the thread.
Account	The account that had the message in their Inbox. For example, [e-mail] received a message sent to [e-mail] because they're a member of the group. If a search returns that message because it was in user1's Inbox, then the value of To is [e-mail] while the value of Account is [e-mail].
From	The sender account.
To	The recipient account. Multiple recipients are comma-separated and the list is in double quotes.	Gmail only
CC	Accounts in the cc: field.	Gmail only
BCC	Accounts in the bcc: field.	Gmail only
Subject	The message subject.	Gmail only
Labels	Labels applied to the message by Gmail or the user.	Gmail only
DateSent	The message send date in UTC (yyyy-MM-dd'T'HH:mm:ssZZZZ).	Gmail only
DateReceived	The message received date (yyyy-MM-dd'T'HH:mm:ssZZZZ).	Gmail only
SubjectAtStart	The subject of the conversation when the first message was sent.	classic Hangouts only
SubjectAtEnd	The subject of the conversation when the last message was sent.	classic Hangouts only
DateFirstMessageSent	The timestamp for when the first message in a conversation was sent.	classic Hangouts only
DateLastMessageSent	The timestamp for when the last message in a conversation was sent.	classic Hangouts only
DateFirstMessageReceived	The timestamp for when the first message in a conversation was received.	classic Hangouts only
DateLastMessageReceived	The timestamp for when the last message in a conversation was received.	classic Hangouts only
ThreadedMessageCount	The number of messages in the conversation.	classic Hangouts only

Drive exports

Expand section  |  Close section & go to top

Export contents

Information	File name	Description
Files	export_name_N.zip	Contains all the files and sites found by your search. Vault exports up to 10 GB of data in a single compressed file. If you export more than 10 GB of data, Vault creates multiple files. Exported files are named with the original name of the file followed by an underscore ("_") and the Drive file ID. Exported Google files are converted as follows: Google Docs to DOCX Google Sheets to XLSX Google Forms to ZIP (HTML and CSV) Google Slides to PPTX Google Drawings to PDF Google Sites to PDF. Each page in a site is saved as a separate PDF file that's named using the following format: site-name_page-name_site-ID_page-ID.pdf Note: When you export client-side encrypted files, the files remain encrypted and the filenames end with .gcse. To decrypt the files, use Google client-side decrypter. When you decrypt a Google Docs, Sheets, or Slides file, the file name ends with .gdoc. The decrypter can’t convert these files to DOCX, XLSX, or PPTX yet.
File metadata	export_name-metadata.xml	Contains metadata, including: Document IDs (Note: These IDs are not the Drive file IDs. They correspond to values in the CSV file.) User email addresses Created and modified dates for each file Document types and titles Learn more
Accounts and doc IDs	export_name-custodian-docid.csv	Lists user accounts with their associated document IDs. Use this information to determine which users have access to the exported files.
Error reports	error.csv export_name-incomplete-accounts.csv	Error reports are included only if the export encounters errors. error.csv—Lists errors retrieving files and the file metadata. Learn more export_name-incomplete-accounts.csv—Lists accounts that were searched but not all matching files were exported
File checksums	File checksums	The file lists the message digest 5 (MD5) hash values for all files in the export.

File parameters in the metadata file

The metadata file included with your export captures the following metadata:

Included with each file

• DocID—A unique identifier for the file. For sites exports, the value is the page ID.
• #Author—The email address of the person who owns the file in Drive. For a shared drive file, it shows the shared drive name.
• Collaborators—The accounts and groups that have direct permission to edit the file or add comments. Also includes users with indirect access to the file if you chose this option during export.
• Viewers—The accounts and groups that have direct permission to view the file. Also includes users with indirect access to the file if you chose this option during export.
• #DateCreated—The date a Google file was created in Drive. For non-Google files, usually the date the file was uploaded to Drive. Learn more about timestamps for uploaded files.
• #DateModified—The date the file was last modified. Learn more about timestamps for uploaded files.
• #Title—The filename as assigned by the user. Because some operating systems can't expand zip files with extremely long filenames, Vault truncates the filename at 128 characters during export. The value shown by the #Title tag isn't truncated.
• DocumentType—The file type for Google files. Possible values are:
  • DOCUMENT—A document created in Google Docs.
  • SPREADSHEET—A spreadsheet created in Google Sheets.
  • PRESENTATION—A presentation created in Google Slides.
  • FORM—A form created in Google Forms.
  • DRAWING—A drawing created in Google Drawings.
  • SITES_PAGE—A page from a site created in new Google Sites.
• Others—The accounts from your query that have indirect access to the file if you opted to exclude access level information during export. May also include users for whom Vault couldn't determine permission levels at the time of export.
• SitesTitle—For sites, the name of the page.
• PublishedURL—For sites, the web address of the published page. Value is empty for unpublished sites.
• DocParentID—For sites, a unique identifier for the site the page is part of.
• SharedDriveID—The identifier of the shared drive that contains the file (if applicable).
• SourceHash–A unique hash value for each version of a file. Can be used to deduplicate file exports and verify the exported file is an exact copy of the source file. Supported by Google Docs, Sheets, and Slides files only.
• FileName—The file name. Use this value to correlate the metadata with the file in the export ZIP file.
• FileSize—The size of the file in bytes.
• Hash—The MD5 hash of the file.
• ClientSideEncrypted—Indicates the file was encrypted with Google Workspace Client-side encryption. Files that aren't client-side encrypted don't include the ClientSideEncrypted tag.
• Reviews—A section that lists metadata for file approvals. Not included when no approvals were requested on the file. For each approval request, a Review section contains the following information:
  • ApprovalId—A unique identifier for the review.
  • CreatedAt—The time when approval was requested.
  • ModifiedAt—The last time the approval status changed.
  • Approvers—A comma-separated list of the approvers’ emails.
  • ApprovalStatus—The status of the approval. Possible values are:
    • IN_PROGRESS—Approval requested. 
    • APPROVED—All approvers approved the file.
    • DECLINED—An approver declined the request to approve the file.
    • CANCELLED—An approver rejected the file.

Query parameters for the entire export

• UserQuery—The query submitted by the Vault user that retrieved the files included in this export.
• TimeZone—The time zone used for date-based searches.
• Custodians—The email addresses of the users whose accounts were searched. If you searched for content rather than individual user accounts, there are no custodians listed here.

Exporting access-level information for users with indirect access to files

When you export files from Drive, the metadata file may include information about users in your organization who have indirect access to, and have opened, a file that matches your search criteria.

A user can have indirect access when a file or folder containing a file is:

• Shared with a group the user belongs to
• Shared with the domain
• Shared publicly

During export, you can choose the information you want to include in the metadata output:

• In the export dialog, check the box to have Vault determine the permission level for users in your domain who have indirect access to files. Each of these users is included in one of these categories when you open the metadata file:

  • Collaborators—Users who have indirect permission to edit or add comments to a file.
  • Viewers—Users who have indirect permission to view a file.
  • Others—In some circumstances, Vault can't determine the type of access a user has at the time of export. This can happen, for example, if a file was shared with a group, and the user was later removed from the group.

  Vault takes time to determine what permissions these users have, so this option can increase the time it takes to prepare your files for download.

• In the export dialog, leave the box unchecked (default) to exclude access-level information for users in your domain with indirect access to files. These users are listed as Others in the metadata file.

Google Voice exports 

Expand section  |  Close section & go to top

Export contents

Information	File name	Description
Voice data files	export_name-N.zip	A zip file is generated for each account and contains PST or mbox files of text conversations, call logs, voicemail MP3 audio files, and voicemail transcriptions.
File metadata	export_name-metadata.xml	An XML file that contains metadata as it exists on Google servers.
File checksums	File checksums	A checksum file with message digest 5 (MD5) hash values for all files included in the export.
Error report	error.csv	Error reports are included only if the export encounters errors. Learn more

Note: Unlike other services, Voice exports don’t include a count file.

Voice data parameters in the metadata file

The metadata file contains the following information:

Information about each file

• DocID—A unique identifier for the file.
• #Author—The email address of the account that owns the file in Drive.
• #DateFirstMessageSent—For text conversations, the date the first message was sent. Note: this and the following 3 fields are identical in entries for voicemails and call logs.
• #DateLastMessageSent—For text conversations, the date the last message was sent.
• #DateFirstMessageReceived—For text conversations, the date the first message was received.
• #DateLastMessageReceived—For text conversations, the date the last message was received.
• ConversationType—The data type:
  • TEXT_MESSAGE—A text message.
  • VOICEMAIL—A voicemail.
  • INCOMING_CALL—A call log of an incoming call.
  • OUTGOING_CALL—A call log of an outgoing call.
  • MISSED_CALL—A call log of an unanswered incoming call.
• ParticipantPhoneNumbers—The phone numbers of the participants.
• OwnerPhoneNumbers—The value includes multiple phone numbers when the user's number changed.
• Labels—Any labels on the conversation. For example, deleted conversations have the DELETED label.
• ExternalFile FileName—The file identifier, which correlates to the Subject in the PST or mbox file.

Query parameters for the entire export

• UserQuery—The query submitted by the Vault admin.
• TimeZone—The time zone of the query
• Custodians—The email addresses of the accounts that were searched.

Error reports

When Vault is unable to export data from a service, Vault generates an error report. The report lists the items with export errors along with more details and metadata.

Vault reports two types of errors:

• Transient errors—A backend server was unable to retrieve the email message or file. The item should be available for export when you search for it later.
• Non-transient errors—Any error that's not explicitly labeled as transient is the result of an issue that cannot be corrected. Typically these errors occur when a message attachment or file was deleted, isn't supported for export, or can't be converted to the requested format.

To determine if the problem is transient or non-transient, open the CSV file with Google Sheets or another spreadsheet app and find the Error Description column (Note: error descriptions aren't available for Voice exports).

Recover from transient errors

You can use message and file details to search for and export the data that wasn't exported due to transient errors:

• If the error report includes messages with transient errors, use each message’s RFC 822 identifier to find those specific messages when you search again. The format of the search term is rfc822msgid:identifier.
• If the error report includes Drive files with transient errors, use each file's title to find those specific files when you search again. The format of the search term is title:"title-of-file".

Error report contents

Expand section  |  Close section & go to top

Error report contents for Gmail (new export)

Summary section

The error report contains the following data for the entire export in a Summary section.

Field	Description
AccountErrorsCount	The number of accounts that Vault was unable to retrieve any messages for export.
PartialAccountErrorsCount	The number of accounts that Vault was unable to retrieve all messages for export.
MessageErrorsCount	The number of messages that Vault was unable to retrieve completely from Gmail. For these messages, Vault retrieves the metadata but not all the message content.
Account	The account that had the message in their Inbox. For example, [e-mail] received a message sent to [e-mail] because they're a member of the group. If a search returns that message because it was in user1's Inbox, then the value of To is [e-mail] while the value of Account is [e-mail].
Count	The number of errored messages associated with a specific account.
PSTConversionErrorsCount	The number of messages that weren’t converted to PST.
ChatErrorsCount	The number of Hangouts threads that Vault was unable to retrieve one or more messages for export.
ThreadCount	The number of errored Hangouts threads associated with a specific account.

Lists of errors

After the Summary section, the export contains metadata for the accounts and messages that had errors. Values aren't reported if the data isn't available or applicable for a message.

Field	Description
AccountErrors	A list of the users whose messages couldn't be searched. Each entry includes values for Account and Reason.
Reason	For accounts that Vault was unable to retrieve any messages for export, the error returned by Gmail.
PartialAccountErrors	A list of users whose messages were only partially searched.
MessageErrors	The metadata for messages that couldn't be exported. Fields are the same as the metadata file
PSTConversionErrors	For PST-formatted exports, a list of the Account and Rfc822MessageId values for messages that weren't converted for PST. These messages are available in their original EML format in the export_name-conversion-errors-N.zip file included in the export.
ChatErrors	The metadata for a message in a Hangouts conversation that had at least one matching message but couldn't be exported. The metadata representing the conversation is from an arbitrary message and may not be the message that matched the search query.

Error report contents for Gmail (classic export) and Groups

The error report contains the following fields for each message. Fields are blank if the data isn't available or applicable for a message.

Field	Description
Document ID	A unique identifier for the file
Document type	The document type. Value is mail.
File type	The file type. Value is mail
Attachments count	The number of attachments to the message
Attachment names	The file names of the attachments
Subject	The message subject
Size	The message size
From	The sender's email account
To	The email accounts of all recipients
Cc	The email accounts of all Cc'd recipients
Sent time	The timestamp for when the message was sent
Source account	The account that was included in the search query
Error description	A description of the error
RFC 822 Message-ID	A unique identifier for a message that's added by mail servers Example: rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl- [e-mail]

 

Error report contents for Chat

The error report contains the following fields for each message. Fields are blank if the data isn't available or applicable for a message.

Field	Description
Document ID	A unique identifier for the file
Filename	The document type. Value is mail.
Conversation Type	The type of message. Value is mail.
space Name	The name of the space
Error description	A description of the error

 

Error report contents for Drive files

The error report contains the following fields for each file. Fields are blank if the data isn't available or applicable for a file.

Field	Description
Document ID	A unique identifier for the file
Document type	Indicates the file type for Google files. Possible values are DOCUMENT, SPREADSHEET, PRESENTATION, FORM, DRAWING, and SITES_PAGE.
File type	The file format, such as PDF or XLSX
Title	The filename as assigned by the user
Size	The size of the file
Creator	The email address of the person who owns the file in Drive. For a shared drive file, it shows the shared drive name.
Collaborators	The accounts and groups that have direct permission to edit the file or add comments. Also includes users with indirect access to the file if you chose this option during export.
Viewers	The accounts and groups that have direct permission to view the file. Also includes users with indirect access to the file if you chose this option during export.
Others	The accounts from your query that have indirect access to the file if you opted to exclude access level information during export. May also include users for whom Vault couldn't determine permission levels at the time of export.
Creation time	The date a Google file was created in Drive. For non-Google files, this indicates when the file was uploaded to Drive.
Last modified time	The date the file was last modified
Error description	A description of the error
Drive Document ID	A unique identifier for a file in Drive

 

Error report contents for Voice data

The error report lists accounts that were searched but not all matching files were exported.

Field	Description
Account	The email address of the account that some data wasn’t exported for.
Failed Conversation Count	The number of conversations that weren’t exported. If the number is unknown, the value is Unknown Failure Count.