Go started with Vault search and export

Vault is for administrators and legal personnel. Before you tin use Vault, your Google Workspace admin needs to prepare your account. Who is my administrator?

Welcome to Google Vault! This guide provides an overview of Vault's eDiscovery features, which you can use to search and export your system's Google Workspace data.

one. Sign in to Vault

Become to https://vault.google.com and sign in with your Google Workspace account.

If y'all tin can't sign in to Vault, ask your Google Workspace administrator to turn on Vault for you lot.

ii. Create a matter, your search and export infinite

To search and export user data, you create a workspace called a thing. Think of a matter as a folder where you store your search queries and export packages. Yous can share matters with others, including external users.

  1. Click Matters and then Create.

    If you don't take the Create choice, ask your Google Workspace ambassador to give you lot the necessary privileges.

  2. Enter a name for the matter and, optionally, a description.
  3. Click Create.

3. Search for data

When you lot created a matter in the previous footstep, the matter opened to the Search tab.

If yous don't have the Search tab, ask your Google Workspace administrator to give yous the necessary privileges.

You lot can now offset your search:

  1. Select a Google service to search, such every bit Gmail.
  2. Enter your search parameters. You lot can cull which accounts to search and other weather condition. For example:

    • Find messages sent by specific users—Enter an electronic mail address in the Account email addresses field, or endeavor using search operators such as from:user1@company.com and to:user2@company.com.

    • Find messages with a specific phrase—In many organizations, Gmail contains millions of messages and most of the unremarkably used words in a given language. Try grouping words into phrases with quotation marks, such as "confidential project Ten". Notation: Search ignores the example and punctuation of phrases in quotation marks.

    • Exclude drafts—Gmail saves versions of a draft message equally the sender composes it. If you don't need this much particular, check the Exclude email drafts box to remove these messages from your search results.

    • Exclude matches—To subtract data from your search, put a hyphen (‑) before the search term. For example, ‑field of study:vacation excludes all letters that have a subject that includes the word "vacation."

    Learn more near how to search Gmail and classic Hangouts, Drive and Meet, Chat, Groups, and Voice.

    More search tips for letters
    Goal Example query
    Find all messages sent to or from an external domain This query returns all messages exchanged with the external domain, regardless of sender:

    (from:solarmora.com OR to:solarmora.com)

    Find only conversation messages This query returns chat messages and excludes email messages:

    is:chat

    Find some words but exclude others This query returns invite and invitational, but not invitation nor invited:

    (invit* -invitation -invited)

    Observe words that are near each other in a message This query returns "don't always distribute" merely excludes "don't think we should distribute". Employ any number from i to 19.

    ("don't Effectually iii distribute")

    Exclude deleted messages with a user-applied characterization This query excludes all deleted messages that have had the "travel" label applied by the user:

    -(characterization:^deleted AND label:travel)

    Detect specific types of attachments This query returns all messages with PDF attachments:

    (has:attachment filename:pdf)

    Exclude messages that take been quarantined. This query excludes messages in admin quarantine:

    -characterization:^admin_quarantine

  3. (Optional, supported for Gmail, classic Hangouts, and Groups) If you're worried your search will return too many results, which tin take a long time to process, click Count. Count reports the number of results faster than a total search.

    To refine your search, click Aggrandize and edit your search parameters.

  4. Click Search. After the search completes, Vault opens a tabular array of the results.

    Search limitations:

    • Purged data—Vault can search and return only information that isn't purged from Google production systems. Vault doesn't automatically retain any of your organisation'southward data. To brand sure you tin can search and export certain data, set up retention rules or holds.

    • Drive items—When you search Drive, you lot tin can search for text within files, including Microsoft Word, Excel, and Powerpoint, PDF, HTML, TXT, and RTF. You tin can't search within video, audio, image, or binary files.

    • Wildcard fault—Vault tin can't render search results when a wildcard search operator matches 100 or more words in a user's business relationship. For case, if subj:foo* produces too many matches, you might try searching for subj:food* (to observe "food") and subj:pes* (to find "pes" and "football"). Wildcard search isn't supported for Chat, Bulldoze, or Voice searches.

4. Preview your results

To preview a matching item, in the table of results, click a row and the preview opens in a side bar on the right.

Preview beliefs:

  • Letters—Vault returns a message's unabridged chat collapsed into a single thread. To expand a thread, click the bulletin. To preview private messages, click them.
  • Drive items—Y'all tin preview Google files such as Docs, Sheets, Slides, and Drawings, and user-uploaded files such as .docx, .pdf, and .xlsx.

Yous might not be able to preview all letters or files that are returned. Though your preview might be limited, when you export the search results, the export includes all matching data.

5. Salvage your search query

After y'all finalize your search parameters, y'all can relieve the query to quickly run this search again afterward.

  • To salvage your query, click Save. This action doesn't salvage your search results, only the query parameters. To save your current results, keep to the side by side step and export them.
  • To open up a saved query, click View saved queries and click query. Saved queries are dynamic—when you run the search again, the results include data created since the last time you searched.

six. Export and analyze

  1. To save the results of your query, in the Search tab, click Export.

    If you don't take the Export option, ask your admin to give you lot the necessary privileges.

  2. Get to the Exports tab to track the consign's progress. When it's complete, click Download. Y'all take 15 days after the export starts to download the export files.
  3. Your export includes a compressed file that contains the data returned past your search. Information technology also has a metadata file to correlate the data with associated accounts. Use third-party software to process the exported files.

Other Vault tasks

Here are another tasks you may need to do in Vault:

  • You tin preserve specific messages and file as required by your organisation'south retentivity obligations. Review your retention policies and update them as needed.
  • You can create holds to preserve data for individual users or organizational units. Messages and files subject to a concord are never deleted, regardless of retention settings.
  • Review the privileges that control what other users can exercise within Vault.

Was this helpful?

How can we better information technology?