Get started with Vault search and export

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

Welcome to Google Vault! This guide provides an overview of Vault's eDiscovery features, which you can use to search and export your organization’s Google Workspace data.

1. Sign in to Vault

Vault's interface is separate from other Google services.

Sign in to Vault

2. Create a matter

A matter in Vault is a virtual container for all of the data related to your inquiry. You can’t search Vault without one.

You can easily share matters with others, including external users.

3. Search for Gmail and classic Hangouts messages

Searching for messages in a large domain with many users can be tricky. Sometimes you'll find too many messages, and other times you won’t find enough. However, with the right search terms, Vault can find just the messages you’re looking for.

Count your search results

A quick way to assess the effectiveness of your search is to use the Count results function, available from the Search drop-down arrow. Vault counts the number of messages that match your search criteria. You can then widen or narrow your search based on the requirements of your matter.

You found too many messages

To reduce the number of messages Vault has found for you:

  • Are you looking for messages sent by specific users? Enter a name in the Accounts field, or try using search operators like and
  • Looking for a specific phrase? In many organizations, Gmail contains millions of messages and most of the commonly used words in a given language. You may find the words you’re searching for occur regularly in messages that are not pertinent to your matter. Try grouping words into phrases with quotation marks.
  • Too many copies of the same message? Vault saves multiple versions of a message as the sender composes it. If you don't need this much detail, click the Exclude drafts box to remove these messages from your search results.
  • Do you want to eliminate certain messages from your search results? Use a hyphen (-) to subtract messages from your search. For example, -subject:vacation removes all messages that have a subject that includes the word "vacation."


You didn't find enough messages

To find more messages:

  • Review your search terms. They may be limiting your results.
  • You can only search for messages in accounts that have been assigned a Vault license. Messages in unlicensed accounts are not retained and are not accessible through Vault. If your organization uses partial-domain licensing, see Assign Vault licenses.
  • Vault returns a message's entire conversation collapsed into a single thread.

    Collapsed thread:


    Click the thread to expand it. Click individual messages to read them:

More search tips

Here are some additional queries you can use to find just the messages needed for your matter.

How to Example query
Find all messages sent to or from an external domain This query returns all messages exchanged with the external domain, regardless of sender:
( OR
Find only chat messages This query returns chat messages and excludes email messages:
Find some words but exclude others This query returns invite and invitational, but not invitation nor invited:
(invit* -invitation -invited)
Find words that are near each other in a message This query returns “don’t ever distribute” but excludes “don’t think we should distribute”. Use any number from 1 to 50.
("don't AROUND 3 distribute")
Exclude deleted messages with a user-applied label This query excludes all deleted messages that have had the “travel” label applied by the user:
-(label:^deleted AND label:travel)
Find specific types of attachments This query returns all messages with PDF attachments:
(has:attachment filename:pdf)
Exclude messages that have been quarantined.

This query excludes messages in admin quarantine:

Refine your search

While you're reviewing search results, the top of the screen shows the terms you just entered.

Click the search bar to bring up the quick-search form and modify your terms.

4. Search Drive for files

When you search for files in Drive, you have to search either by account names or by an organizational unit (with fewer than 5,000 users). Vault searches file names and the contents of supported file types.

File types indexed by Vault
Note: Google Apps for Government customers cannot search the contents of files. However, they can search file names and other file properties.
You can preview files from Google Apps and most types of user-uploaded files directly in Vault.

5. Save your search

Once you’ve finalized your search parameters, you can save the query and quickly perform this search later. Saved searches are dynamic; that is, your future searches will include messages and files created since the last time you searched.

6. Export and analyze

After you've found the messages or files needed for your matter: 

  1. Export search results.
  2. Start analyzing the exported files.

Other Vault tasks

If you have the appropriate Vault privileges, here are some other tasks you may need to perform:

  • You can preserve specific messages and file as required by your organization's retention obligations. Review your retention policies and update them as needed.
  • You can create holds to preserve data for individual users or organizational units. Messages and files subject to a hold are never deleted, regardless of retention settings. 
  • Review the privileges that control what other users can do within Vault.
Was this helpful?
How can we improve it?