How Vault exports work

You can review Gmail and chat messages in Microsoft Outlook (PST) or Mozilla Thunderbird(mbox). This method is useful for viewing HTML messages and attachments that a text editor can't display.

PST and mbox files contain all of the details for the exported Gmail and chat messages. The Vault XML file reflects the message metadata as recorded by Google. Together these files provide a link between the messages stored on Google servers and the data you’ve exported from Vault.

1. Import and review messages in your email application. 
2. For messages that are important to the matter, view the headers:
   • Outlook—Varies depending on the version you're using. See the Microsoft documentation for viewing message headers.  
   • Thunderbird—Click View > Headers > All to display the headers for each message:
3. Each header includes a Message ID. Compare Message IDs with metadata in the XML file to correlate messages with the data stored on Google's servers.

An mbox file is a standard format for storing messages. It contains all of the details for the exported messages, including message text and any attachments. The Vault XML file reflects the message metadata as recorded by Google. Together these files provide a link between the messages stored on Google servers and the data you’ve exported from Vault.

After you export, you use the message parameters from the Vault XML file to identify corresponding messages in the mbox file. To get started, open the XML file in a text editor and look for the FileName parameter; for example:

<ExternalFile FileName='1463030154355209614-d7f2c19a-73f3-40e4-a17a-130b90c37aac.mbox'

This parameter includes a unique identifier and it corresponds to a similar entry in the mbox file called the From_ line. The From_ line contains the same identifier, along with the date and time (in UTC) that the message was received by Google; for example:

From 1463030154355209614-d7f2c19a-73f3-40e4-a17a-130b90c37aac.mbox@xxx Wed Mar 19 06:38:02 2014

The From_ line is the first entry for each message included in the mbox file. When you get to a new From_ line, you're looking at a different message.

The Vault XML file included with your export captures the following metadata:

Included with each Gmail message

• #From
• #To
• #CC
• #BCC
• #Subject
• #DateSent
• #DateReceived

Included with each chat message

• #SubjectAtStart–(classic Hangouts only)
• #SubjectAtEnd–(classic Hangouts only)
• #DateFirstMessageSent
• #DateLastMessageSent
• #DateFirstMessageReceived
• #DateLastMessageReceived

Included with both Gmail and chat messages

• Labels—Shows labels applied by Gmail, such as ^INBOX, ^TRASH, and ^DELETED. Also shows any labels applied to the message by the user.
• FileName—Shows the message identifier. Correlate this with the message ID shown in your exported PST or mbox file. 

Included with Hangouts Chat messages

• RoomID–Shows the room or DM identifier to which the conversation belongs.
• Participants–Shows the email addresses of all users who participated in the conversation.
• roomName–Shows the name of the room or a comma-separated list of accounts that participated in a DM.
• conversationType–Shows whether the conversation is from a room or a DM.

Query parameters for the entire export

• UserQuery—Shows the query submitted by the Vault user that retrieved the messages included in this export.
• TimeZone—Shows the time zone used for date-based searches.
• Custodians—Shows the email addresses of the users whose accounts were searched. If you searched for content rather than individual user accounts, there are no custodians listed here.

The XML file included with your export captures the following metadata:

Included with each file

• #Author—Shows the email address of the person who owns the file in Drive. For a shared drive file, it shows the shared drive name.
• Collaborators—Shows the accounts and groups that have direct permission to edit the file or add comments. Also includes users with indirect access to the file if you chose this option during export.
• Viewers—Shows the accounts and groups that have direct permission to view the file. Also includes users with indirect access to the file if you chose this option during export.
• Others—Shows the accounts from your query that have indirect access to the file if you opted to exclude access level information during export. May also include users for whom Vault couldn't determine permission levels at the time of export.
• #DateCreated—Shows the date a Google file was created in Drive. For non-Google files, this indicates when the file was uploaded to Drive.
• #DateModified—Shows the date the file was last modified.
• #Title—Shows the file name as assigned by the user. Because some operating systems can't expand zip files with extremely long file names, Vault truncates the file name at 128 characters during export. The value shown by the #Title tag isn't truncated.
• DocumentType—Indicates the file type for Google files. Possible values are DOCUMENT, SPREADSHEET, PRESENTATION, FORM, and DRAWING.
• SharedDriveID—Shows the identifier of the shared drive that contains the file (if applicable).
• SourceHash–Unique hash value for each version of a file. Can be used to deduplicate file exports and verify the exported file is an exact copy of the source file. Supported by Google Docs, Sheets, and Slides files only.

Query parameters for the entire export

• UserQuery—Shows the query submitted by the Vault user that retrieved the files included in this export.
• TimeZone—Shows the time zone used for date-based searches.
• Custodians—Shows the email addresses of the users whose accounts were searched. If you searched for content rather than individual user accounts, there are no custodians listed here.

When you export files from Drive, Vault may include metadata for users in your domain who have indirect access to, and have opened a file that matches your search criteria.

A user can have indirect access when a file or folder containing a file is:

• Shared with a group the user belongs to
• Shared with the domain 
• Shared publicly

During export, you have the option to choose the kind of information you want included in the metadata output:

• In the export dialog, check the box to have Vault determine the permission level for users in your domain who have indirect access to files. Each of these users is included in one of these categories when you open the XML file:

  • Collaborators—Users who have indirect permission to edit or add comments to a file.

  • Viewers—Users who have indirect permission to view a file.

  • Others—In some circumstances, Vault can't determine the type of access a user has at the time of export. This can happen, for example, if a file was shared with a group, and the user was later removed from the group.

  Vault needs additional time to determine what permissions these users have, so this option may increase the time it takes to prepare your files for download.

• In the export dialog, leave the box unchecked (default) to exclude access-level information for users in your domain with indirect access to files. These users are listed as Others in the XML file. 

If the error report includes email messages with transient errors, use each message’s RFC 822 identifier to find those specific messages when you search again. The format of the search operator is rfc822msgid:identifier.