How to Create matters and Export data from the Google vault?

Create and Export data from the vault

Create and manage matters 

To hold, search, and export your organization's Google Workspace data in Vault, you create a workspace called a matter. A matter provides a container for the holds, searches, and exports related to a specific eDiscovery project, such as a litigation case or investigation.

A matter includes:

• A list of saved search queries
• A list of holds
• A list of the accounts that the matter is shared with
• A list of exports
• An audit log of Vault user activity in the matter

After you create a matter, you can share it with other Vault users so everyone involved in an eDiscovery project can use the same workspace.

When a matter is no longer needed, you can delete any remaining holds and then close and delete the matter.

A matter is owned by the user who creates it. If that user's Google Workspace account is deleted, the matter remains in Vault. Any Vault user with the "Manage Matters" privilege can still open and share that matter with other Vault users.

Required Vault privileges

In order to view or work with matters, your Google Workspace administrator must grant you the required privileges. 

To View matters

1. Sign in to vault.google.com.
2. Click Matters.
   
   

The Matters page opens and lists all active matters your account can access. These include matters you created and matters that are shared with you.

• To open a list of Closed or Deleted matters, click the Status menu and select the matter status you want to open.
  
  
  
  
• To filter the list by the owner, click the Owner menu and select from Owned by anyone, Owned by me, or Shared with me.
  
  
  
  
• To sort the list of matters by matter name or owner, click the corresponding column header.
• To open a matter, click the row.

Steps to create a matter:

1. Sign in to vault.google.com.
2. Click Matters > Create. If you don't have the Create option, ask your Google Workspace administrator to give you the necessary privileges.
   
   
   
   
3. Enter a descriptive name for the matter according to your organization's naming guidelines. Matter names must be unique.
   
   
   
   
4. (Optional) Enter a description of the matter. The description isn't shown in the list of matters, only when you open the matter.
5. Click Create. 
   
   

Close, reopen, delete, or restore a matter

When an investigation is complete, you can close and delete a matter:

Close -> When you close an active matter, Vault keeps any saved search queries and all audit data associated with the matter. Export files are immediately deleted. You can reopen closed matters or delete them. Note: You can't close a matter until all holds are deleted.

Reopen -> When you reopen a closed matter, the matter is moved back to the active matters list. The matter has its audit data and any saved search queries, but you must recreate any holds and exports.

Delete -> When you delete a closed matter, the matter is moved to the deleted matters list. Approximately 30 days after you delete a matter, Vault deletes the matter. Until the Vault deletes the matter, you can restore a deleted matter with all data intact.

Restore -> When you restore a deleted matter, the matter is moved to the active matters list. The matter has its audit data and any saved search queries, but you must recreate any holds and exports.

To change a matter's status:

1. Sign in to vault.google.com.
2. Click Matters and click the matter you want to close.
   
   
   
   
3. Click Holds. Delete any holds. For each hold:
   • Review the hold and confirm that it's OK to delete it.
   • In the list of holds, point to the hold and click Delete.
     
     
4. Click Matters to return to the list of matters.
5. Point to the matter and click Close.
6. To reopen or delete the matter after you close it:
   • At the top of the matters list, in the Status menu, select Closed.
   • Point to the matter you want to reopen or delete and click the corresponding button.
     
     
     
     
7. To review and restore deleted matters:
   • At the top of the matters list, in the Status menu, select Deleted. The list includes only matters deleted within approximately the last 30 days. Matters deleted earlier than that are permanently deleted by Vault.
   • Point to the matter you want to restore and click Restore.

Export data from Vault

After you identify and collect the data pertinent to your Google Workspace eDiscovery project with search, you can export it for further analysis. When you export data from Vault, the export contains copies of the data that matched your search. Your organization’s Google Workspace data isn’t modified or removed by the process.

 

Steps to start an export:

1. If you haven't already, sign in to https://vault.google.com, open the matter you want to export data from and search for the data.
2. Click Export.
   
   
   
   
3. Enter a descriptive name for the export. Don't use special characters (~!$'(),;@:/?) in the name, they can prevent you from downloading exports.
4. If your organization has a data region policy, select the data region for the export. Learn more about Vault exports and data regions.

  5. Set service-specific export options:

       -> For Gmail, you can choose the following options:

             a.Include or exclude the content of confidential mode messages. If you exclude                                    confidential mode message content, your export includes only the message metadata.
             b.Use the new Gmail export process. Note: The metadata file, error report, and count                         files are in a different format from classic exports.
             c. For messages, choose the format for message content files, PST or Mbox. Learn more                      about these formats.
             d.For items in Drive, choose to include access level information for accounts with                                 indirect access in the metadata file.

  6. Click Export. Vault immediately starts to process your export. You can close Vault and                  return later to check your export's status.

  7. To review the status of an export, click Exports. When the export is complete, the Status                 column has a green checkmark and the Download button is enabled.

   8. If your export takes more than 24 hours, Vault stops the export and delivers partial results.           To get complete results, resume the export.

   9. Download your exported data promptly. Export files are available for 15 days after you start          the export, and then they're automatically deleted and you must recreate the export.