Google Vault Data Discovery

Google Vault holds archived mail and Drive data that does not appear in a standard Google Workspace discovery. This guide covers identifying which of your users are actually licensed for Vault, counting their archived data for scoping, and running the scoped Drive and Gmail exports.

For discovery of the live environment rather than the archive, see Google Data Discovery. To scope a search to deleted mail only, see Archive Vault FAQ: Searching Google Vault for Deleted Mail Only.

Step 1: Identify Vault-licensed users with GAM

GAM (Google Apps Manager) is the best way to obtain the list of Vault users, and the only one we would recommend. The Admin Console does not give you a clean, exportable list of who holds a Vault license, so anything assembled by hand will be incomplete on a tenant of any size, and an incomplete user list means an incomplete export.

The command depends on how Vault is licensed on the tenant, so check the subscription before running either one.

Enterprise customers (Vault bundled)

Where the organisation is on Google Workspace Enterprise, Vault is bundled into the core license. Use:

gam redirect csv ./vault_users.csv print licenses products Google-Apps,101034

Non-Enterprise customers (Vault add-on)

On lower-tier Workspace subscriptions Vault is bought as a separate add-on, and it carries its own product code. Use:

gam redirect csv ./vault_users.csv print licenses products Google-Vault

The ./ in both commands writes vault_users.csv into GAM’s own working directory, which is the GAM folder you specified when you installed GAM. That is where to look if you cannot find the file afterwards.

Note: Running the wrong command for the subscription type returns an empty or partial file rather than an error, so confirm the row count in vault_users.csv looks right for the tenant before moving on.

Step 2: Prepare the user list

The Matter search expects every account address on a single line, as one comma-separated list. It will not take a column of addresses pasted straight from the CSV, and it will not take a list broken across several lines, so the file needs converting first.

1. Open vault_users.csv in Google Sheets or Microsoft Excel.
2. Find the column holding the email addresses, typically column A.
3. In an empty cell, join them together with:
   =TEXTJOIN(", ", TRUE, A2:A500)
4. Adjust the range to match the actual number of addresses, then copy the resulting string. You will paste this into Vault in the steps below.

Step 3: Count archived items for scoping

For a Vault migration the metric that matters is the number of items (emails and Drive files), not the data size.

Note: Vault search does not include folders or Drive shortcuts, so a Drive figure is a count of files only. Do not expect it to reconcile with a folder-aware count taken anywhere else.

Note: Vault reports item counts only. Neither the interface nor the Vault API will return a data size, so any scoping that depends on volume in GB has to come from somewhere else, such as the Admin Console usage columns covered in Google Data Discovery.

1. Log in to Google Vault.
2. Create a Matter and select it.
3. Go to the Search menu and set the service you are scoping.
4. Set the source to All Data.
5. Select Organizational unit and choose the required OU.
6. Run the search.

Note: Moving the users to be migrated into a dedicated OU first makes this scoping considerably easier.

Getting the numbers out

There is no Count button in the Google Vault Matter search. Counting is done one of two ways.

Via the Vault API. The matters.count method returns the number of matching messages without running an export, which is much faster and avoids the export overhead. It supports Gmail and Groups only, not Drive.

Via an export. This is the only route for Drive, and the only route at all if you are not using the API.

1. With your search results on screen, click Export.
2. Go to the Exports tab inside the Matter and wait for the export to complete.
3. Click Download.
4. Open the metadata file included with the export in Google Sheets or Excel. It lists one row per exported item.
5. Select the first populated column and read the row count, discounting the header row. =COUNTA(A2:A) gives the same figure.

Note: exporting purely to obtain a count can be expensive. Large exports are slow and are subject to Vault API quotas that cap concurrent exports across the whole organisation, so scope the accounts and the date range down first. See Google’s Vault API limits.

Step 4: Export Drive data

1. Go to Google Vault at vault.google.com.
2. Select Matters and click Create a Matter, or open an existing one.
3. Set the service to Drive.
4. Set the source to All data.
5. Set the entity to Specific accounts.
6. Paste the comma-separated list from Step 2 into Account email addresses.
7. Ensure Not included is selected for shared drives.
8. Click Search to review the results, then click Export.

Step 5: Export Gmail data

Repeat the process for mail, with slightly different parameters.

1. Inside the same Matter, go back to the Search tab.
2. Set the service to Gmail.
3. Set the source to All data.
4. Set the entity to Specific accounts.
5. Paste the same comma-separated list into Account email addresses.
6. Click Search to review the results, then click Export.

Step 6: Download the exports

Vault builds exports in the background, so neither export is ready the moment you click Export. Both the Drive and the Gmail export land in the same place.

1. Inside your Matter, go to the Exports tab.
2. Wait for the status to show the export as complete. Large exports can take some time.
3. Click Download against each completed export.