Use Vault to search Google Drive and Meet

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search for items in Google Drive, including shared drives and Meet recordings. You can search titles and the contents of supported file types. You can also preview items and export your search results.

Things to know before you search

Open all | Close all

How do searches by account, organizational unit, or shared drives work?

The files that Vault searches depend on the type of search:

Search type	Files searched
Specific accounts or Organizational unit	Vault searches: Files owned by the account. Files directly shared with the account, including files owned by users outside your organization. Files shared with a group the account is a member of (if the group has less than 200 members). Files shared with a group the account is a member of and that the account opened (if the group has 200 or more members). Files shared with everyone in the organization that the account opened. (Optional) Files in shared drives Vault doesn’t search files in shared drives unless you choose to include them in the search. When you include shared drives with an account-based or organizational unit-based search: Vault searches shared drives the searched account is a member of. Only files that match the ownership or sharing conditions listed above are included in the search. Vault doesn’t search all files in the shared drives the account is a member of. To search all files in a shared drive, do a shared drives-based search.
Shared drives	Vault searches all files in the selected shared drives.

Search type

Files searched

Specific accounts
or
Organizational unit

Vault searches:

Files owned by the account.
Files directly shared with the account, including files owned by users outside your organization.
Files shared with a group the account is a member of (if the group has less than 200 members).
Files shared with a group the account is a member of and that the account opened (if the group has 200 or more members).
Files shared with everyone in the organization that the account opened.

(Optional) Files in shared drives

Vault doesn’t search files in shared drives unless you choose to include them in the search. When you include shared drives with an account-based or organizational unit-based search:

Vault searches shared drives the searched account is a member of.
Only files that match the ownership or sharing conditions listed above are included in the search.
Vault doesn’t search all files in the shared drives the account is a member of. To search all files in a shared drive, do a shared drives-based search.

Shared drives

Vault searches all files in the selected shared drives.

Note: Vault search doesn't include folders or Drive shortcuts.

Which parts of items in Drive are searchable?

For all items, you can search the title, owner, date last modified, and other metadata.

For supported file types, you can search for words and phrases in the contents of files. Vault indexes the first 100 pages of text files and the first 10 pages of text in image PDFs.

You can search text within the following file types:

Google Docs, Sheets, Slides, and Forms, including open comments but not suggested edits
Microsoft Word, Excel, and PowerPoint
PDF
HTML
TXT
RTF
SBV
OpenOffice™ XML
Wireless Application Protocol (WAP)
Wireless Markup Language (WML)
Google Earth (KML)

Vault doesn't index the content of video, audio, image, or binary files.

How do I search for Meet recordings and associated chat, Q&A, and polls logs?

Recordings—You can search by the meeting title and metadata such as the owner, meeting ID, and recording start time. However, the content of Meet recordings isn’t indexed for search because they’re video files (MP4). To limit your search to only videos, you can use the search term type:video.
Chat logs—Chat logs are saved as SBV files. Chat logs contain message timestamps relative to recording start time, first and last names of senders, and message text. You can search by the file name, text in the log, and metadata such as when the file was created.
Q&A and polls logs—Q&A and polls logs are saved as Google Sheets files. These logs contain the questions, answers, and participants. You can search by the file name, text in the log, and metadata such as when the file was created.

Learn more about Meet recordings

What file types can I preview with Vault for Drive?

You can preview the following file types:

Files created with Google Docs, Google Sheets, Google Slides, and Google Drawings
Uploaded files such as .docx, .pdf, and .xlsx

Linked files may not be included when you search and export files in Drive

In some Google Docs editors, users can link a file to another file. For example, in a Google Docs document you can insert a chart that's linked to data in a Google Sheets spreadsheet. Whenever the spreadsheet is updated, the chart in the document is also updated.

When you search files in Drive, Vault returns only the files that match your search criteria. If those files are linked to files that don't match your query, the linked files aren't included in your results.

Can I search within the revision history of a document?

No. You can search only the most recent version of a file. However, you can enter a version date as part of your search. When you enter a version date, Vault searches the current version of the file, but you preview and export the contents of the last version saved before 12:00 AM UTC on the date. Versioning is supported only in Google Drive for Google Docs, Sheets, Slides, and Drawings.

Some properties are reported for the current version, no matter what version date you specify. These properties include the title, who it was shared with, when it was last modified, and other data in Vault’s metadata.xml file.

Version snapshots include comments, subject to the following criteria:

Open comments are included only if your organization has comment or edit access to the document. Comments aren’t included if you only have view access.
An open individual comment (one with no replies) is included if: 1) the comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). A comment isn’t included in versions from before the comment was created.
An open comment thread (one with replies) is included in its entirety if: 1) the first comment was created as of the version date, and 2) the commented text existed in that version (even if the commented text is now deleted). For example, if a comment thread has two messages that were created on October 1 and October 5, a search with the version date of October 2 contains both comments even though the October 5 comment didn’t exist at the time.
Edited comments are included as they currently exist, not how they were at the version time.
Resolved or deleted comments aren’t included in a version, even if the comment was open at the version time.

Can I search the top organizational unit of my organization?

No. You can't search the top organizational unit. Select a child organizational unit or individual accounts. You can search Drive for up to 5,000 accounts total (as individual accounts or members of organizational units).

Creation and modification time of an uploaded file depends on the source of the file

The creation time and modification time that Drive sets for a file when it's first uploaded might match the local file or be equal to the upload time, depending on how the file was added to Drive. The following table shows which time is used for different sources, where:

Upload—The timestamp is when the file was uploaded to Drive
Local—The timestamp is the same as the timestamp of the original file on the source device or service

File source (client)	Created time	Modified time
Web app	Upload	Before April 8, 2020: Upload After April 8, 2020: Local
Drive File Stream	Local	Local
Backup & Sync	Upload	Local
iOS	Upload	Upload
Android	Upload	Upload
G Suite Migrate	Local	Local
Drive API	Can be set by caller	Can be set by caller

Search for files in Drive

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

Sign in to https://vault.google.com.
Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
1. Click Create.
2. Enter a name for the matter and, optionally, a description.
3. Click Create.
The Search tab opens.
For the service, select Drive.
Select the source data to search:
- All data—Search all messages in your organization.
- Held data—Search only messages on hold for the matter.
Select the entity to search:
- Specific accounts—Enter up to 5,000 account email addresses.
- Organizational unit—Search all accounts in a specific organizational unit. In the dialog that opens, select an organizational unit.
  If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched. The organizational unit must have fewer than 5,000 members, including child organizational units
- Shared drives—Search one or more shared drives:
  1. In the dialog that opens, enter one or more shared drive members' email addresses.
  2. Click Find.
  3. In the list of shared drives, select one or more shared drives and click Add.
(Optional) If you search accounts or an organizational unit, to include messages in shared drives, click Include items from shared drives .
(Optional) Select a time zone.
(Optional) Enter a range for Date modified.
- If you enter a start date, Vault returns all items modified on or after that date.
- If you enter an end date, Vault returns all items modified on or before that date.
(Optional) In Terms, enter one or more search terms:
- To search for one or more keywords in the content, title, or metadata, enter words separated by spaces. For example, project goals.
- To search for a phrase, put the words in quotes. For example, "project goals".
- To search by account, sharing, item name, item type, or modification date, use search operators.
Search terms can't exceed 2,000 characters.
(Optional) To retrieve versions of Google Docs, Sheets, Slides, and Drawings saved on a specific date, enter a Version date. Learn more
Click one of the following:
- Search—Run your search and return a list of items that match your query.
- Export—Directly export the search results and skip the search results preview. Learn more about exports
After your search or export completes, you can take the following actions:
- To edit your search, click Expand.
- To open a preview of an item, click the item.
- To create an export of your search results, click Export. Learn more
- To save your query, click Save. Learn more
- To clear all fields and start a new search, click Clear.

Preview search results

These steps are for new Vault (vault.google.com). Go to steps for classic Vault

After you run a search, you can review and download the items that matched your query.

Preview is supported for Google files such as Docs, Sheets, Slides, and Drawings, as well as other common types such as PDF, DOCX, and XLSX. You can't preview ZIP, binary, video files (Learn more). In Google files, you can't preview comments, suggested edits, or revision history.

To preview an item, in the search results list, click the item.
- For supported file types, a preview of the item opens.
- For file types that aren't supported in preview, Vault shows an error but you can still download the item.
To download an item from the preview, click More Download.

Use classic Vault

Click below to open steps for classic Vault (ediscovery.google.com). Go to steps for new Vault

Search Drive and Meet files in ediscovery.google.com

Search for files in Drive

Create a new matter or click on an existing matter.
Click Search in the left pane, and then click Drive as the type of data to search.
Choose a Source:
- All data—Search all data in your organization.
- Held data—Search all data on hold for the matter.
Select a Search method:
- Specific accounts—Enter one or more accounts and search up to 5,000 Vault users in the domain. The search fails if you attempt to search more than 5,000 users or don't include at least one user. You can also check the box to Include results from shared drives.
- Organizational unit—Search within a specific organizational unit. If you choose one with sub-organizational units, all of the sub-organizational units will be searched.The organizational unit must have fewer than 5,000 members. You can also check the box to Include results from shared drives.
- Shared drives—Click Find shared drives:
  1. Add a shared drive member's email address.
  2. Start typing the name of the shared drive you're looking for, then click the one you want. You can choose multiple shared drives.
(Optional) Enter a date range and choose a time zone.
- If you enter a start date, Vault returns all files modified on or after the date you entered.
- If you enter an end date, Vault returns all files modified on or before the date you entered.
(Optional) Use Terms to specify one or more search terms. Use search operators for complex searches.
Vault searches only the latest version of a file. However, you can enter a version date to view and export Google files as they existed on that date. Learn more about what's included in a file's version history.
Click one of the following:
- Search—to perform a search.
- Export—to skip preview and immediately export the search results.
(Optional) Click the Search down arrow to:
1. Reset—to clear the search form.
2. Duplicate search form—to open another search form under the current form, pre-populated with the information you've already entered.

Preview search results

When your search completes, Vault opens a table of your results that includes the title, owner, and last modified date of each item. You can preview items in supported file types.

To view an item, in the results table, click the item.

To download the item, click More Download. You can download an item even if it doesn't load in preview.

Note: There are several known issues related to previewing files in Drive. Learn more

Was this helpful?

How can we improve it?