Use Vault to search Google Chat

To search your Google Chat messages in Chat, go here instead.

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search Google Chat messages, review message contents and participants, download attachments, and create an export of your search results. To search classic Hangouts messages, search in Gmail.

Things to know before you search

For even more information, review the Vault Search FAQ.

Open all  |  Close all

Search for Chat messages by specific accounts, an organizational unit, or specific rooms

Account-based search: You can search for direct messages (DMs) and group messages sent or received by specific accounts or all accounts in an organizational unit. You can include messages in rooms in your search, and the type of room determines what messages are returned. Learn more

Room-based search: You can search for messages in specific rooms. You can’t search all rooms. You select rooms by entering the account of a member of the room.

Learn more about the differences between group messages and rooms.

Use search terms and operators to filter your results

You can restrict the results of your search by sent date, time zone, and other terms such as keywords, attachment type, and room type. Learn more about Chat search operators.

The way Vault matches search terms depends on the message type and location. Search terms are matched to individual messages for DMs, group messages, and messages in unthreaded rooms. Search terms are matched to conversations (across messages) in threaded rooms.

For details, review the examples.

History must be on to search DMs, group messages, and messages in unthreaded rooms

Vault can search only DMs, group messages, and messages in unthreaded rooms that were sent with history turned on. Rooms with conversations (rooms with threaded replies) always have history on and messages are searchable until they’re purged.

A Google Workspace admin can control whether history is on or off, or they can allow users to decide.

Some files attached to messages can't be searched or exported

When someone shares a file stored in Drive, such as a doc, sheet, or PDF, Chat inserts a link rather than attaching a copy of the file to the message. You can search by the URL of the file, but Vault doesn't index the title or content of the file because it's stored in Drive. These link-based attachments aren't included when you search or export Chat messages

For files that are directly attached to a Chat message, Vault indexes the file name for search. Vault also indexes the content of most text-based file types (for example, files with .pdf, .xslx, and .docx extensions). These types of attachments are included when you search and export Chat messages, and they're covered by Chat retention rules and holds.

You can preview a maximum of 1000 messages per conversation or unthreaded message

Vault can export all messages that match your search, but you can preview only up to 1000 messages per conversation or unthreaded message. If you want to preview a large number of messages, use search terms and other criteria to reduce the number of messages.

Room properties control how Vault searches for messages associated with specific accounts or organizational units

When you search by accounts or organizational unit and include results from rooms, the messages Vault returns from rooms depends on the type of room:

  • Threaded rooms—Vault returns conversations in threaded rooms only if the searched participant or any account in the organizational unit sent at least one message. Conversations where a searched account may have viewed messages but didn't respond aren't included in search results.
  • Unthreaded rooms—Vault searches all rooms the searched account or any account in the organizational unit is a member of, even if they didn’t send any messages. If the account is no longer a member of a room, Vault searches only the messages sent before they left.

External rooms and external users

  • Rooms owned by another organization—You can't search for messages sent by users in your organization in rooms owned by another organization.
  • External user messages in your rooms—You can search for and export messages sent by external users in rooms created by someone in your organization.
Room properties control how Vault searches held data

You can restrict your search to held data, which are messages associated with a user account that's on hold. When you search held data, the messages Vault returns from rooms depends on the type of room:

  • Threaded rooms—Vault returns a conversations in threaded rooms only if a user on hold who matches your search parameters sent at least one message.
  • Unthreaded rooms—Vault returns messages from a room if a user on hold who matches your search parameters was a member, even if they didn’t send any messages in the room.

If all users on hold leave a room, a search for held messages returns only messages in the room that were sent before the last user on hold left.

Retention rules and holds don’t affect account-based Chat search results

When participants in a DM or group chat are subject to different retention rules or holds, some participants might be able to see the message history while others can’t. However, Vault searches all available messages (unless you restrict the search to only held data).

For example, participant 1 is in an organizational unit subject to a retention rule that purges DMs after 7 days and they chat with participant 2 who’s in an organizational unit subject to an indefinite retention rule for DMs. Seven days after participant 1 sends or receives a DM with participant 2, participant 1 loses access to the DM. But, because participant 2’s DMs are retained indefinitely, the DMs aren’t purged and participant 2 still has access to them.

Vault search isn’t affected by which account can still access the message, it only knows that the message is still available for search. Thus, you get the same messages returned when you search for messages by participant 1’s organizational unit as when you search by participant 2’s organizational unit.

Chat search examples

How search terms apply to messages in rooms

For example, you have a room that contains the following exchange:

    participant 1: hi

    participant 2: hello

 

If you use search terms*, search, preview, and export process the messages as follows:

Search term Threaded rooms (current) Unthreaded rooms (new)
hi All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 1 is returned because only that message matches the search term.

Preview and export: Participant 1's message plus all messages in the room that were sent 12 hours before and 12 hours after are included.

hello All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 2 is returned because only that message matches the search term.

Preview and export: Participant 2's message plus all messages in the room that were sent 12 hours before and 12 hours after are included.

hi hello All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

No messages are returned or exported because no individual message contains both search terms.

hi from:participant1@example.com All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 1 is returned because only that message matches both search terms.

Preview and export: Participant 1's message plus all messages in the room that were sent 12 hours before and 12 hours after are included.

hi from:participant2@example.com All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported. No messages are returned or exported because no individual message matches both search terms.
‑hi from:participant1@example.com No messages from the sample conversation are returned or exported because the conversation doesn't match both search terms. No messages from the sample conversation are returned or exported because no individual message matches both search terms.
‑hi from:participant2@example.com No messages from the sample conversation are returned or exported because the conversation doesn't match both search terms.

Search: Only the message from participant 2 is returned because only that message matches the search term.

Preview and export: Participant 2's message plus all messages in the room that were sent 12 hours before and 12 hours after are included.

Search for Chat messages

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

  1. Sign in to vault.google.com.
  2. Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
  3. If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
    1. Click Create.
    2. Enter a name for the matter and, optionally, a description.
    3. Click Create.

    The Search tab automatically opens.

  4. For the service, select Chat.
  5. Select the source data to search:
    • All data—Search all messages in your organization.
    • Held data—Search only messages on hold for the matter.
  6. Select the entity to search:
    • Specific accounts—Enter one or more accounts to search.
    • Organizational unit—Search all accounts in a specific organizational unit. In the dialog that opens, select an organizational unit.

      If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched.

    • Rooms—Search one or more rooms:
      1. In the dialog that opens, enter one or more email addresses of members of the rooms you want to search.
      2. Click Find.
      3. In the list of rooms, select the rooms you want to search and click Add.
  7. (Optional) If you search accounts or an organizational unit, to include messages in rooms, click Include messages in rooms "". Vault searches a room only when a searched account is a member of the room.
  8. (Optional) Select a time zone.
  9. (Optional) Enter a range for Date sent.

    Note: If you enter dates, Vault returns all conversations that have messages in that date range and match your query terms. The results might also include messages that match query terms but occur outside of your date range.

    • If you enter a start date, Vault returns all messages sent on or after that date.
    • If you enter an end date, Vault returns all messages sent on or before that date.
  10. (Optional) In Terms, enter one or more search terms:

    Search terms can't exceed 2,000 characters.

    • To search for one or more keywords in the message, enter words preceded by a plus (+) and separated by spaces. For example, +project +goals.
    • To search for a phrase, put the words in quotes and precede with a plus (+). For example, +"project goals".
    • To search only direct messages, enter is:dm. To search only messages in rooms, enter is:room.
    • To search by account, date, or message properties use search operators.
  11. (Optional) To exclude draft messages from this search, enable Exclude email drafts. When this option is disabled, Vault returns all draft messages that match your query, including automatically saved drafts.
  12. Click one of the following:
    • Search—Run your search and return a list of messages that match your query.
    • Export—Directly export the search results and skip the search results preview. Learn more about exports
  13. After your search or export completes, you can take the following actions:
    • To edit your search, click Expand.
    • To open a preview of a message and its conversation, click the message.
    • To create an export of your search results, click Export. Learn more
    • To save your query, click Save. Learn more
    • To clear all fields and start a new search, click Clear.

Preview messages in search results

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

After you run a search, you can review the messages that matched your query, see the conversation participants, and download attachments.

To preview a message, in the search results list, click the message. A list of messages in the conversation opens.

  • Messages with a "" have one or more attachments. To download an attachment, click Download.
  • The entire conversation that a message was part of is available in preview, but Vault exports only the messages that match your search.
  • For long threads, only the most recent 1000 messages are available in preview. However, an export of the search results includes all messages that match your query, including messages not in preview.

Use classic Vault

Click below to open steps for classic Vault (ediscovery.google.com). Go to steps for new Vault

Search Chat in ediscovery.google.com

Search for messages in Chat

  1. Create a matter or click an existing matter.
  2. Click Search in the left pane.
  3. Select Chat as the type of data to search.
  4. Choose a Source:
    • All data—Search all messages in your organization.
    • Held data—Search all messages on hold for the matter.
    • Unprocessed data—Search content that we have identified as partially processed.
  5. Select a search method:
    • Specific accounts—Enter accounts to search. 
    • Organizational Unit—Search within a specific organizational unit. If you choose one with suborganizational units, Vault searches the suborganizational units.
    • Rooms—Search within one or more rooms. 
  6. (Optional) If you select Specific accounts or Organizational Unit, you can check the box to include results from rooms​. Vault searches a room only if a user who is included in the search is a member of the room.
  7. If you select Rooms, click Find Rooms. To select a room:
    1. In the dialog, enter a room member and click Next.
    2. Enter a room and click the room to select it. Repeat to add more rooms.
    3. After you add all the rooms you want to search, click Done.
  8. (Optional) Enter a sent date range:
    Note: If you enter dates, Vault returns all conversations that have messages within that date range and match your query terms. Results may also include messages that match query terms but occur outside of your date range.
    • If you enter a start date, Vault returns all messages sent on or after the date you entered.
    • If you enter an end date, Vault returns all messages sent on or before the date you entered.
  9. (Optional) Choose a time zone, and Vault restricts the search to the time zone you select. However, search results are displayed and exported in GMT. 
  10. (Optional) Use Terms to specify one or more search terms. Use search operators for complex searches.
  11. Click one of the following:
    • Search—to perform a search.
    • Export—to skip preview and immediately export the search results.
  12. (Optional) Click the Search down arrow to:
    1. Reset—to clear the search form.
    2. Duplicate search form—to open another search form under the current form, prepopulated with the information you've already entered.

Preview Chat search results

Search preview includes the following:

  • Snippet—a brief synopsis of the conversation.
  • Owner—participants in an exchange of DMs or the room in which a conversation took place. 
  • Last sent—the date of the last message. If a user edits a message, it can change the last sent date. However, deleting messages has no effect on this date.

When you open a message, the entire conversation is displayed. Only the most recent 1000 messages are included in the preview in very long conversations. You can't preview earlier messages from the thread. However, all messages that match your search criteria are included when you export.

Note: Vault exports only the messages that match your search terms. Go back and modify your search terms if you need to export other messages from Chat.

Export Chat messages

When your search returns the results you need, you can: 

  1. Export the search results.
  2. Analyze the exported files.
Was this helpful?
How can we improve it?