How to Search and Export Google Drive Data Using Google Vault

Quick and easy-to-follow guide for Google Workspace administrators

Steps to take before you can search and export Google Drive data from Google Vault

Users must have a Google Vault license assigned for their data to appear in Google Vault
Once you create a matter, you can search data in any user’s Google Drive and Shared Drives
You can also export the data, but you must search and find what you need first. The whole process is covered step by step below.

Use cases - when to search and export Google Drive data

When you need to find and access specific files and folders
When you need to export data from any user’s Google Drive or from shared drives

How to search and export Google Drive data from Google Vault step-by-step with images

Step 1

Open Vault at https://vault.google.com and click Matters.

Step 2

Click the matter you want to use to for the search.

If you’re not familiar with matters, click here.

To see how to create a matter, click here.

Step 3

Under the SEARCH tab, click the Service option and select Drive.
Under Source, choose if you want to search All data, only data on hold, or only unprocessed data.
Next, under Entity, choose to search for data in Specific accounts or entire OUs. Then specify the users or OUs. Optionally, you can Include items from shared drives.
Select the date range for the search under Date sent and specify the Time zone if needed. The search will find items that have been modified in the time frame you select.
Fill in the Terms field to narrow down the scope of your search and find exactly what you need. You can use the following search operators: https://support.google.com/vault/answer/2474474. Expect our article on this soon.
When the Terms field is left blank, you will search for all data.
When you’re ready, click SEARCH at the bottom.
Click EXPORT to skip seeing the search results and immediately export data matched by your search.
Click CLEAR on top if you want to clear your search settings and start over.

Step 4

After you click SEARCH and the search results come up, you have the option to save the search query by clicking SAVE on top. Saving it allows you to quickly repeat it in the future by accessing the matter, then selecting the search by clicking VIEW SAVED QUERIES on the top right.

Click the Export button if you want to download the data.

Step 5

If you choose to export, first give your export a name.

Then enable Report access levels for accounts with indirect access to Drive items to get additional info about general access permissions.

Click EXPORT to start the export.

Step 6

Click the EXPORTS tab under the name of the matter.

You’ll see that the export is being prepared.

Step 7

Once it’s ready, a green checkmark icon will appear on its left, where the spinning loading circle used to be. Click Download to download the data, or Delete to delete the export.

Clicking Delete doesn’t delete the data from Vault or users’ accounts.

Step 8

Downloading the exported Google Drive data

After clicking Download, you’ll see a few download links.

The items you need are in the third link, as seen in the image above: export_name_N.zip. The contents and details are here. Vault exports up to 10 GB of data in a single compressed file. If you export more than 10 GB of data, you get multiple files.

Exported files get named after the original name of the file, followed by an underscore (“_”) and the Drive file ID.

Exported Google files get converted as follows:

-Google Docs to DOCX

-Google Sheets to XLSX

-Google Forms to ZIP (HTML and CSV)

-Google Slides to PPTX

-Google Drawings to PDF

-Google Sites to PDF. Each page in a site gets saved as a separate PDF file that’s named using the following format: site-name_page-name_site-ID_page-ID.pdf

Export_name-custodian-docid.csv lists user accounts with their associated document IDs. Use this information to determine which users have access to the exported files.

Export_name-metadata.xml contains metadata.

File checksums lists the message digest 5 (MD5) hash values for all files in the export.