Get started with Vault search and export

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

Welcome to Google Vault! This guide provides an overview of Vault's eDiscovery features, which you can use to search and export your organization’s Google Workspace data.

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

1. Sign in to Vault

Go to https://vault.google.com and sign in with your Google Workspace account.

If you can't sign in to Vault, ask your Google Workspace administrator to turn on Vault for you.

2. Create a matter, your search and export space

To search and export user data, you create a workspace called a matter. Think of a matter as a folder where you store your search queries and export packages. You can share matters with others, including external users.

  1. Click Mattersand thenCreate.

    If you don't have the Create option, ask your Google Workspace administrator to give you the necessary privileges.

  2. Enter a name for the matter and, optionally, a description.
  3. Click Create.

3. Search for data

When you created a matter in the previous step, the matter opened to the Search tab.

If you don't have the Search tab, ask your Google Workspace administrator to give you the necessary privileges.

You can now start your search:

  1. Select a Google service to search, such as Gmail.
  2. Enter your search parameters. You can choose which accounts to search and other conditions. For example:
    • Find messages sent by specific users—Enter an email address in the Account email addresses field, or try using search operators such as from:user1@company.com and to:user2@company.com.

    • Find messages with a specific phrase—In many organizations, Gmail contains millions of messages and most of the commonly used words in a given language. Try grouping words into phrases with quotation marks, such as "confidential project X".

    • Exclude drafts—Gmail saves versions of a draft message as the sender composes it. If you don't need this much detail, check the Exclude email drafts box to remove these messages from your search results.

    • Exclude matches—To subtract data from your search, put a hyphen () before the search term. For example, ‑subject:vacation excludes all messages that have a subject that includes the word "vacation."

    Learn more about how to search Gmail and classic Hangouts, Drive and Meet, ChatGroups, and Voice.

    More search tips for messages

     

    Goal Example query
    Find all messages sent to or from an external domain This query returns all messages exchanged with the external domain, regardless of sender:

    (from:solarmora.com OR to:solarmora.com)

    Find only chat messages This query returns chat messages and excludes email messages:

    is:chat

    Find some words but exclude others This query returns invite and invitational, but not invitation nor invited:

    (invit* -invitation -invited)

    Find words that are near each other in a message This query returns “don’t ever distribute” but excludes “don’t think we should distribute”. Use any number from 1 to 50.

    ("don't AROUND 3 distribute")

    Exclude deleted messages with a user-applied label This query excludes all deleted messages that have had the “travel” label applied by the user:

    -(label:^deleted AND label:travel)

    Find specific types of attachments This query returns all messages with PDF attachments:

    (has:attachment filename:pdf)

    Exclude messages that have been quarantined. This query excludes messages in admin quarantine:

    -label:^admin_quarantine

     

  3. (Optional, supported for Gmail, classic Hangouts, and Groups) If you're worried your search will return too many results, which can take a long time to process, click Count. Count reports the number of results faster than a full search.

    To refine your search, click Expand and edit your search parameters.

  4. Click Search. After the search completes, Vault opens a table of the results.

    Search limitations:

    • Purged data—Vault can search and return only data that isn't purged from Google production systems. Vault doesn't automatically retain any of your organization's data. To make sure you can search and export certain data, set up retention rules or holds.

    • Drive items—When you search Drive, you can search for text within files, including Microsoft Word, Excel, and Powerpoint, PDF, HTML, TXT, and RTF. You can't search within video, audio, image, or binary files.

    • Wildcard error—Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. For example, if subj:foo* produces too many matches, you might try searching for subj:food* (to find "food") and subj:foot* (to find "foot" and "football"). Wildcard search isn't supported for Chat, Drive, or Voice searches.

4. Preview your results

To preview a matching item, in the table of results, click a row and the preview opens in a side bar on the right.

Preview behavior:

  • Messages—Vault returns a message's entire conversation collapsed into a single thread. To expand a thread, click the message. To preview individual messages, click them.
  • Drive items—You can preview Google files such as Docs, Sheets, Slides, and Drawings, and user-uploaded files such as .docx, .pdf, and .xlsx.

You might not be able to preview all messages or files that are returned. Though your preview might be limited, when you export the search results, the export includes all matching data.

5. Save your search query

After you finalize your search parameters, you can save the query to quickly run this search again later.

  • To save your query, click Save. This action doesn't save your search results, only the query parameters. To save your current results, go on to the next step and export them.
  • To open a saved query, click View saved queries and click query. Saved queries are dynamic—when you run the search again, the results include data created since the last time you searched.

6. Export and analyze

  1. To save the results of your query, in the Search tab, click Export.

    If you don't have the Export option, ask your admin to give you the necessary privileges.

  2. Go to the Exports tab to track the export's progress. When it's complete, click Download. You have 15 days after the export starts to download the export files.
  3. Your export includes a compressed file that contains the data returned by your search. It also has a metadata file to correlate the data with associated accounts. Use third-party software to process the exported files.

Use classic Vault

Click below to open steps for classic Vault (ediscovery.google.com). Go to steps for new Vault

Search and export in ediscovery.google.com

1. Sign in to Vault

Vault's interface is separate from other Google services.

Sign in to Vault

2. Create a matter

A matter in Vault is a virtual container for all of the data related to your inquiry. You can’t search Vault without one.

You can easily share matters with others, including external users.

3. Search for Gmail and classic Hangouts messages

Searching for messages in a large domain with many users can be tricky. Sometimes you'll find too many messages, and other times you won’t find enough. However, with the right search terms, Vault can find just the messages you’re looking for.

Count your search results

A quick way to assess the effectiveness of your search is to use the Count results function, available from the Search drop-down arrow. Vault counts the number of messages that match your search criteria. You can then widen or narrow your search based on the requirements of your matter.

You found too many messages

To reduce the number of messages Vault has found for you:

  • Are you looking for messages sent by specific users? Enter a name in the Accounts field, or try using search operators like from:user1@company.com and to:user2@company.com.
  • Looking for a specific phrase? In many organizations, Gmail contains millions of messages and most of the commonly used words in a given language. You may find the words you’re searching for occur regularly in messages that are not pertinent to your matter. Try grouping words into phrases with quotation marks.
  • Too many copies of the same message? Vault saves multiple versions of a message as the sender composes it. If you don't need this much detail, click the Exclude drafts box to remove these messages from your search results.
  • Do you want to eliminate certain messages from your search results? Use a hyphen (-) to subtract messages from your search. For example, -subject:vacation removes all messages that have a subject that includes the word "vacation."

 

You didn't find enough messages

To find more messages:

  • Review your search terms. They may be limiting your results.
  • You can only search for messages in accounts that have been assigned a Vault license. Messages in unlicensed accounts are not retained and are not accessible through Vault. If your organization uses partial-domain licensing, see Assign Vault licenses.
  • Vault returns a message's entire conversation collapsed into a single thread.

    Collapsed thread:

     

    Click the thread to expand it. Click individual messages to read them:

More search tips

Here are some additional queries you can use to find just the messages needed for your matter.

How to Example query
Find all messages sent to or from an external domain This query returns all messages exchanged with the external domain, regardless of sender:
(from:solarmora.com OR to:solarmora.com)
Find only chat messages This query returns chat messages and excludes email messages:
is:chat
Find some words but exclude others This query returns invite and invitational, but not invitation nor invited:
(invit* -invitation -invited)
Find words that are near each other in a message This query returns “don’t ever distribute” but excludes “don’t think we should distribute”. Use any number from 1 to 50.
("don't AROUND 3 distribute")
Exclude deleted messages with a user-applied label This query excludes all deleted messages that have had the “travel” label applied by the user:
-(label:^deleted AND label:travel)
Find specific types of attachments This query returns all messages with PDF attachments:
(has:attachment filename:pdf)
Exclude messages that have been quarantined.

This query excludes messages in admin quarantine:
-label:^admin_quarantine

Refine your search

While you're reviewing search results, the top of the screen shows the terms you just entered.

Click the search bar to bring up the quick-search form and modify your terms.

4. Search Drive for files

When you search for files in Drive, you have to search either by account names or by an organizational unit (with fewer than 5,000 users). Vault searches file names and the contents of supported file types.

File types indexed by Vault
Note: Google Apps for Government customers cannot search the contents of files. However, they can search file names and other file properties.
You can preview files from Google Apps and most types of user-uploaded files directly in Vault.

5. Save your search

Once you’ve finalized your search parameters, you can save the query and quickly perform this search later. Saved searches are dynamic; that is, your future searches will include messages and files created since the last time you searched.

6. Export and analyze

After you've found the messages or files needed for your matter: 

  1. Export search results.
  2. Start analyzing the exported files.

Other Vault tasks

Here are some other tasks you may need to do in Vault:

  • You can preserve specific messages and file as required by your organization's retention obligations. Review your retention policies and update them as needed.
  • You can create holds to preserve data for individual users or organizational units. Messages and files subject to a hold are never deleted, regardless of retention settings.
  • Review the privileges that control what other users can do within Vault.
Was this helpful?
How can we improve it?