Get started with Vault search and export

Google Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin must set up your account. Who is my administrator?

This guide provides an overview of Google Vault's eDiscovery features, which you can use to search and export your organization’s Google Workspace data.

How can I perform legal discovery in Google Workspace using Google Vault?

Step 1: Sign in to Vault

Go to https://vault.google.com and sign in with your Google Workspace account.

If you can't sign in to Vault, ask your Google Workspace administrator to turn on Vault for you.

Step 2: Create a matter

To search and export user data, you create a workspace called a matter. Think of a matter as a folder where you store your search queries and export packages. You can share matters with others, including external users.

Click MattersCreate.
If you don't have the Create option, ask your Google Workspace administrator to give you the necessary privileges.
Enter a name for the matter and, optionally, a description.
Click Create.

Step 3: Search for data

When you created a matter in Step 2, the matter opened to the Search tab. You can now start your search.

If you don't have the Search tab, ask your Google Workspace administrator to give you the necessary privileges.

Select a Google service to search, such as Gmail.
Enter your search parameters. You can choose which accounts to search and conditions to use. For example:
- Find messages sent by specific users—Enter an email address in the Account email addresses field, or try using search operators such as from:user1@example.com and to:user2@example.com.
- Find messages with a specific phrase—In many organizations, Gmail contains millions of messages and most of the commonly used words in a given language. Try grouping words into phrases with quotation marks, such as "confidential project X". Note: Search ignores the case and punctuation of phrases in quotation marks.
- Exclude drafts—Gmail saves versions of a draft message as the sender composes it. If you don't need this much detail, check the Exclude email drafts box to remove these messages from your search results.
- Exclude matches—To exclude data from your search, put a hyphen (‑) before the search term. For example, ‑subject:vacation excludes all messages that have a subject that includes the word "vacation."
  
  Learn more about how to search Gmail, Drive and Meet, Chat, Calendar, Groups, and Voice. For more Gmail search tips, go to More search tips for messages (below on this page).
(Optional, supported for Gmail and Groups) If you're worried your search will return too many results, which can take a long time to process, click Count. Count reports the number of results faster than a full search.
To refine your search, click Expand and edit your search parameters.
Click Search. After the search completes, Vault opens a table of the results.

Search limitations:
- Purged data—Vault can search and return only data that isn't purged from Google production systems. Vault doesn't automatically retain any of your organization's data. To make sure you can search and export certain data, set up retention rules or holds.
- Drive items—When you search Drive, you can search for text within files, including Microsoft Word, Excel, and Powerpoint, PDF, HTML, TXT, and RTF. You can't search within video, audio, image, or binary files.
- Wildcard error—Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. For example, if subj:foo* produces too many matches, you might try searching for subj:food* (to find "food") and subj:foot* (to find "foot" and "football"). Wildcard search isn't supported for Calendar, Chat, Drive, or Voice Searches.

More search tips for messages

Goal	Example query
Find all messages sent to or from an external domain	This query returns all messages exchanged with the external domain, regardless of sender: `(from:solarmora.com OR to:solarmora.com)`
Find only chat messages	This query returns chat messages and excludes email messages: `is:chat`
Find some words but exclude others	This query returns invite and invitational, but not invitation nor invited: `(invit* -invitation -invited)`
Find words that are near each other in a message	This query returns “don’t ever distribute” but excludes “don’t think we should distribute”. Use any number from 1 to 19. `("don't AROUND 3 distribute")`
Exclude deleted messages with a user-applied label	This query excludes all deleted messages that have had the “travel” label applied by the user: `-(label:^deleted AND label:travel)`
Find specific types of attachments	This query returns all messages with PDF attachments: `(has:attachment filename:pdf)`
Exclude messages that have been quarantined.	This query excludes messages in admin quarantine: `-label:^admin_quarantine`

Step 4: Preview your results

To preview a matching item, in the table of results, click a row and the preview opens in a side bar on the right.

Preview behavior:

Messages—Vault returns a message's entire conversation collapsed into a single thread. To expand a thread, click the message. To preview individual messages, click them.
Drive items—You can preview Google files such as Docs, Sheets, Slides, and Drawings, and user-uploaded files such as .docx, .pdf, and .xlsx.

You might not be able to preview all messages or files that are returned. Though your preview might be limited, when you export the search results, the export includes all matching data.

Step 5: Save your search query

After you finalize your search parameters, you can save the query to quickly run this search again later.

To save your query, click Save. This action doesn't save your search results, only the query parameters. To save your current results, go on to the next step and export them.
To open a saved query, click View saved queries and click query. Saved queries are dynamic—when you run the search again, the results include data created since the last time you searched.

Step 6: Export and analyze

To save the results of your query, in the Search tab, click Export.
If you don't have the Export option, ask your admin to give you the necessary privileges.
Go to the Exports tab to track the export's progress. When it's complete, click Download. You have 15 days after the export starts to download the export files.
Your export includes a compressed file that contains the data returned by your search. It also has a metadata file to correlate the data with associated accounts. Use third-party software to process the exported files.

Other Vault tasks

Here are other tasks you can do in Vault:

Preserve specific messages and files as required by your organization's retention obligations.
Review your retention policies and update them as needed.
Create holds to preserve data for individual users or organizational units. Messages and files subject to a hold are never deleted, regardless of retention settings.
Review the privileges that control what other users can do within Vault.

Was this helpful?

How can we improve it?