Below are some common question about Vault searches.
Common questions
Important: Search might produce unexpected results in some time zones. Learn more
You can specify a time zone when searching for data. Vault uses the time zone to determine the boundaries of dates for displaying and exporting results.
Because of the way messages are stored and accessed on Google servers, the send time of messages from Gmail and groups are rounded to the nearest hour. A message sent, for example, at 11:30 PM on December 31 is included in a Vault search that begins on January 1. This rounding doesn't affect your searches in Drive.
If your search includes dates, the search boundaries are as follows:
| Gmail & Groups | Drive | |
|---|---|---|
| Start | 11:30:00 PM (the previous day) |
12:00:00 AM |
| End | 12:29:59 AM (the next day) |
11:59:59 PM |
If you don't choose a time zone for your search, Vault uses the time zone reported by your computer.
Daylight saving time
You might need to adjust the time zone to accommodate daylight saving time changes. For example, if you're searching for files created by a user in New York, choose an option:
-
Choose GMT-5 for all files created from December 1 to January 31 (standard time is in effect)
- Choose GMT-4 for all files created from June 1 to July 31 (daylight saving time is in effect)
An incorrect time zone can lead to incorrect search results
The time zone you choose can change search results. For example, if you're searching for messages from an employee in France (GMT+1), but your search uses the Pacific Time Zone (GMT-8), your effective search range from 4:00 PM on the day before your start date to 3:59 PM on your end date.
Depending on the needs of your organization and any legal requirements that must be satisfied by your search, you might want to take the following issues into consideration:
- Performing multiple searches if the data being searched was generated by users located in multiple time zones.
- Using the time zone where the organization's headquarters is located if the user doing the search is located in a different time zone.
- Using the time zone specified in a court order or other legal document related to the search.
- The time of year and whether you need to adjust the time zone to accommodate daylight saving time.
The above issues are examples used to illustrate how time zone can affect search output. Your organization must define its own search strategies to account for the impact of time zone and daylight saving time on search results.
Occasionally a search will generate errors, such as the following:
- Vault can't search an account while its data is being synchronized. This is a temporary issue, and the data should be available in approximately 10 minutes. If accounts remain unavailable, contact us for assistance.
- Vault can't return search results when a wildcard search operator matches 100 or more words in a user's account. If this happens, refine your search terms to make the search more specific. For example, if subj:foo* produces too many matches, you might try searching for subj:food* (to find "food") and subj:foot* (to find, for example, "foot" and "football").
Use the count feature to assess the scope of a query before you submit a Gmail search. Enter your search terms and click Count.
Messages can be counted twice. For example, if alex@example.com sends a message to dana@example.com, Vault counts that message twice because it exists in both mailboxes. When a user sends a message to someone outside the domain, that message is counted only once.
After completing a count, Vault shows you the following information:
- Number of accounts searched
- Amount of time required to complete the search
- Number of messages that match your query
- Number of accounts that have matching messages
You can download a comma-separated values (CSV) file that includes account and message totals for your query. The file includes the following information:
- Date and time
- Query that generated the count
- Number of accounts searched and accounts that couldn't be searched
- Number of accounts with matching messages
- Email address and name for each account with matches
- Number of matching messages from each account
Vault fully supports Google Chat. Vault also supports classic Hangouts chats that take place after April 8, 2015.
You can retain, hold, search, and export chats that occur within classic Hangouts with history turned on. For chats that occurred before this date, be aware of the following restrictions:
- Only on-the-record chats can be searched, exported, and placed on hold
- Retention policies are not properly applied to classic Hangouts messages
- Google Chat–Administrators can control whether history is on or off. Vault can retain all classic Hangouts chats that take place after April 8, 2015 with history on.
- Google Talk–Only admins can require chats to be "off the record" and can turn off chat history.
There is no impact to Vault when when a user exceeds their storage limit. However, the user can no longer send or receive new email messages and can experience general account degradation.
For data that was deleted recently, we recommend that you use the Google Admin console to restore a user’s Google Drive or Gmail data.
For details, go to Recover deleted files and folders for Drive users and Restore a user's permanently deleted email.
To exclude automatically-saved drafts, add the following operator to your search terms: -label:^r_ad
To exclude discarded drafts, add the following operator to your search terms: -(label:^deleted AND label:drafts)
Yes. to do so, select Organizational Unit, and then select the organizational unit you want to search.
You can't select the top organizational unit and you can't add individual user accounts to an organizational unit-based search. You can also specify a date range and search terms.
Add the following operator to your search terms: -label:^admin_quarantine. For details, go to Use Vault to search Gmail.
Learn more about admin quarantine.