eDiscovery With Google Vault and Google Workspace: The Ultimate Guide

As it happens with data generated in Slack and other productivity suites like Microsoft 365, Google Workspace has become a key source of discoverable data, so it’s important to understand how to manage electronically stored information (ESI) in Google’s ecosystem, the eDiscovery capabilities available in Google Vault, and best practices in handling eDiscovery with Google data overall.

‍

The last time Google shared stats on Google’s Workspace (formerly G Suite) usage was in October 2020. They reported more than 2.6 billion monthly active users, which meant a 30% boost since the beginning of the pandemic. They now own more than 59% of the office suite market share, with its main competitor MS 365 servicing most of the remaining businesses.

And, with the consolidation of remote work and the preference of innovative teams for working collaboratively in the cloud, we can only expect to see Google’s tools gain even more traction in the future. 

In this guide, you’ll learn:

• How you can use Google Vault and Workspace to ensure a seamless collection and review of relevant ESI
• How to collect, process, review and produce Google Workspace data in different ways
• How to use Google Vault with an eDiscovery integration to work more efficiently and conduct your entire document review in one single secure place
• The best eDiscovery platform for forward-thinking teams that are used to the workflows enabled by Google apps
• Bonus: Useful hacks for conducting discovery in Google Workspace

Ready to take a deep dive into Google’s Workspace data universe? Well, first things first… 

‍

What Is Google Vault? 

When litigation or an investigation arises, you need to act fast to preserve, review, and ultimately produce pertinent ESI. If your organization uses Google Workspace, you will most likely be figuring out these steps using Google Vault.

‍Google Vault is Google Workspace’s main ESI preservation tool, which allows you to retain, hold, search, and export users’ data from Google’s Workspaces apps like Gmail, Google Chat, Google Meet, Google Voice, Google Drive, etc.

Google Vault lets you set up retention rules for different types of Workspace files. It also enables you to search for relevant evidence by account or Workspace app—even if the user whose documents you are reviewing had tried deleting it.

So, if your organization uses Google’s apps, you’ll need to use Google Vault and Workspace effectively to ensure defensible eDiscovery workflows.

‍

Is Google Vault available in all Google Workspace Licenses?

The short answer is no. 

Although Google Vault makes preserving and accessing your data much easier, you may not have access to Google Vault if you’re not on the right plan. 

A Google Vault license is included in Business Plus, Enterprise, Education, and G Suite Business plans and is available as an upgrade Enterprise Essentials and G Suite Basic plans.

Without a Google Vault license, the discovery process can be more cumbersome—but not impossible. Super administrators of Google Workspace plans without Google Vault installed can still export Workspace evidence using Google’s Data Export tool. To do so, an administrator would need to open Google Admin Console to open the Data Export tool and click “Start Export.” Once the export is complete, Google’s Export Tool will generate user data zip files that super administrators can open and send.

However, keep in mind that Export Tool can take anywhere from 72 hours to 14 days to process exports and will only allow you to perform new exports 30 days after a previously scheduled one. It’s also important to note that not all file types are supported by the Export Tool, and any exported data is available for 30 days and then it gets permanently deleted. 

Super administrators cannot download data from user accounts that are suspended, archived, or deleted, or app-specific data from users who are revoked access to particular Workspace apps.

To avoid all these drawbacks, it’s best practice to use Google Vault with your Workspace license and, if possible, integrate it with specialized eDiscovery software that allows you to process and review your collected data. 

eDiscovery With Google Vault: How to Collect and Produce Documents from Google Workspace

To leverage Google Vault’s eDiscovery capabilities, you will need to create an investigation file to organize your documents. In Google Vault-speak, this means you will need to create a "matter.”

Matters serve as virtual bins for storing and displaying the holds, searches, and exports you’re working with, all of which you can review within the Workspace platform. More specifically, matters include:

• A list of saved search queries
• A list of holds
• A list of the accounts that the matter is shared with
• A list of exports

From there, you can share your matter with other users for collaboration purposes and leverage many different options to search and retrieve pertinent ESI evidence.

You can create legal holds within matters to pull relevant data by document type, date range, user account, and department. You can also refine and narrow down your searches with Boolean shortcuts such as deliveredto:username or type:slide. Make sure you also leverage the specific search operators for different Google applications, like the ones for Gmail to get to the information you need faster. 

Another way you can reduce the scope of your search is by using Google Vault’s filters. Filtering by criteria like “data source,” “data type,” or “accounts” can save you a ton of time in collecting relevant data for your matter.

Once finished, you’ll need to export your data. To do this, select the Workspace files you want to export, click “Export Data,” select appropriate file formats for your evidence, and you’re set! 

If the export process takes more than 24 hours, keep in mind that you may receive a partial export and will need to start another export to retrieve any remaining data. Also, note that you won’t be able to export more than 20 files at a time within your organization.

One thing to consider is that exporting is not synonymous with “downloading” in Google’s lingo. You’ll need to go to the Exports section within your matter and download your exported files from there—then reupload that data to your review platform. 

You can also skip the manual export and download altogether by connecting Google Vault to your eDiscovery platform, where you can transfer files directly for review. Read on to learn more about this option.

‍

Google Takeout: An Alternative Solution for Straightforward Exports

If your exporting needs are relatively easy and you don’t need all the preservation options included in Google Vault, Google Takeout can be a good solution for you.

Although Google Takeout will not prevent users from deleting data from their accounts, this function allows you to download data on pretty much everything stored in Google applications (right down to comments you’ve made on YouTube videos). Therefore, it’s important that you know exactly the data you need in advance — or you could end up drowning in a pile of useless data. 

Also, you won’t be able to filter by date or any other criteria here (just by Google product), so any data that’s on your account for that particular application will be exported. 

‍

1. Log into your account, then go to takeout.google.com.
2. The tool’s default setting is to export every piece of data associated with your Google account. You can pick and choose what data you want to export by unchecking as many of those boxes as you like. Let’s say you only want Gmail and Google Chat data, then you’ll want to uncheck all boxes except “Mail” and “Hangouts”. Then click the Next Step button.
3. On the new screen, click the dropdown arrow to choose your delivery method. The most convenient will be the default “Send download link via email.”
4. You’ll be prompted to select the frequency with which you want to download. Unless you want to create a new record on a consistent basis, make sure “Export once” is selected.
5. Pick between .zip and .tgz file types for your export, choose the export size (2 GB is the default), and hit the “Create export” button.
6. You’ll receive an email letting you know that your request to archive your Google data has been processed. The export process can take hours or days, depending on the amount of data. When it’s complete, you’ll receive an email with a link to download your data.

‍

How to Export All Data From Your Google Workspace

By default, all Google Workplace users have the option to use Google Takeout, so you can ask specific users to export all their data and then send it to you. 

However, if you would like to do it yourself*, follow these instructions:

‍

1. From your Google Admin console, click Open at the top right, select the Tools menu, then click Data export.
2. Click Start export. This process could take anywhere from three to 14 days, but whenever it’s done you’ll receive an email prompting you to download your .zip file.

‍

*Note: you won’t be able to export data unless you’re a “super administrator” of your Google domain, have 2-step verification turned on, and have fewer than 1,000 users on your account. If you’re reading this post more than a year after it was published, please check the official documentation for possible process updates.

The merits of this process are obvious: it’s quick and simple. However, this export method doesn’t allow you to choose specific data to export, so it’s essentially the digital equivalent of being forced to buy every grocery item in a store when you only needed tonight’s dinner. It only works in a few rare exceptions. 

There’s a nifty little trick you can use to bypass this issue, though. Google allows you to set up Gmail with a third-party client. By using these instructions to set up Gmail through Microsoft Outlook, you can export your email data using Microsoft Outlook’s export tool.

However, unless your data collection is extremely limited, the best way to manage and collect Google data for discovery and investigations is by using Google Vault and then importing it to your eDiscovery software. 

Want to make the process even more streamlined? You can integrate Google Vault with a cloud-based eDiscovery platform.

‍

Using Google Vault With an eDiscovery Tool That Matches Your Philosophy

Google Vault on its own can be useful for preservation and collection, but by no means can you run search, review, and production using this tool alone. 

You’ll still need to ingest Google’s data (together with discoverable data from any other sources) into your discovery platform to process and review all your data in one single place. 

‍Forward-thinking legal teams benefit the most from a discovery platform that follows the same overarching philosophy as Google’s apps—cloud-based, available from anywhere, user-friendly, and with unlimited and instant collaboration capabilities.

 And if there’s one eDiscovery tool that perfectly matches this philosophy, that’s Logikcull. 

Here’s how your Google Vault discovery workflow would look like using Logikcull as your discovery platform:

With Logikcull’s Google Vault direct integration, you’ll be able to connect with your Google Vault account so that your data transfer automatically between platforms.

‍

‍

How is this helpful?

Well, on the one hand, it eliminates several cumbersome and time-consuming steps for you as you’ll no longer need to download data from Google Vault onto your local system only to then upload it once again to Logikcull—saving hours (if not days) of time and reducing the likelihood that data will be left somewhere it should not.

Once your data is synced between the 2 systems, Logikcull automatically applies more than 3000 processing steps, like deduping, OCRing, indexing, and metadata extraction, so you can quickly cull out the data that doesn't matter and focus on the documents that do. 

After that, you can simply cull and review your Google data, together with additional data from other sources, for relevance and privilege so your entire discovery process happens in one single place. You can leverage advanced filtering and search capabilities, which allow you quickly surface your most important documents and metadata. Review functionalities such as annotations, tagging, bulk redactions, and similar documents analysis help you get to the finish line of your discovery process in a seamless way. 

Finally, you’ll be able to securely share your productions with opposing parties— with the click of a button and in the right format. No need to worry about manually converting your Google Workspace data into the agreed file extension.

Bonus: Top Hacks for eDiscovery With Google Workspace

Finally, let’s take a look at some powerful hacks to make your Workspace eDiscovery process as seamless as possible. 

Regardless of whether you incorporate Google Vault into your Workspace licenses, your organization will need to be strategic in organizing new data from users and delegating eDiscovery tasks. During the collection phase, as you review your Workspace files for relevant or privileged information, make sure you follow the following tips:

• Turn on Comprehensive Mail Storage to ensure that any app-sent messages or notifications are discoverable on Google Vault.
• Put important data on hold so that it never gets accidentally deleted. Such data won’t even be deleted by Google Vault, even after the ‘retention’ period has passed.
• Label your files to ensure efficient searching and preservation, especially since Google Vault for government clients cannot analyze keywords within documents.
• Assign privileges to trusted IT, legal, and department contacts within your organization who can identify and segregate sources of discoverable ESI. It’s good practice to avoid having one user owning complete control over Google Vault, but rather delegating sensitive data management tasks across multiple trusted team members.
• Save your search queries in Google Vault. This may sound like an obvious one but many users don’t leverage this simple feature that can save you a lot of time when you have many recurrent searches.
• Create multiple search queries limited by account or by specific date ranges to shave hours off your export turnaround times.
• In setting parameters for data preservation, make sure you follow your country’s privacy laws.
• Mitigate your liability for storing older data by taking advantage of Google Vault’s custom retention rules to cycle out data deemed worthy of removal.

Getting the Most Out of eDiscovery with Google Workplace and Google Vault

If your organization uses Google Workplace, your discovery and internal investigations can turn into a walk in the park. Google Vault is most helpful in the early stages of discovery, especially when it comes to preserving and collecting relevant data, helping you defensibly meet your preservation obligations. 

But the real difference comes when you supercharge your discovery process with a tool that seamlessly integrates with your Vault, allowing you automatically ingest, process, and review all your discoverable data, from all your sources. 

And to ensure increased efficiency on your workflows, your discovery platform needs to match your preferred work style and philosophy. If you use Google applications, you probably enjoy the flexibility of working from anywhere, collaborating with your team in real-time, and with software that is truly powerful but not overly complicated.

That’s why Logikcull is the preferred option for teams that work with Google Workspace. Cloud-based, easy to use, and affordable, your discovery workflows mimic your working style, making the entire process more streamlined—and your life much easier.

‍

Want to see how Logikcull’s Google Vault integration would work for your organization? Book a personalized demo to see it for yourself!