Home‎ > ‎Resources‎ > ‎

Vault-Admins

VITA Vault for Administrators

Table of Contents
Legal Setup


Legal Setup

  • Access Vault
    • Go to https://ediscovery.google.com to access the Vault interface.

    • NOTE: It is suggested that if you plan to run a search to do so in an incognito window. The Virtru extension and other extensions interfere with Google Vault searches.  Running the search in an incognito window disables all Chrome extensions and makes the search run faster.

  • Edit retention rules
    • From the Vault homepage, click “Retention” from the menu at the left.
    • Vault has a default retention rule that applies to all messages.
      • Click “Modify default retention rule” to modify the default retention rule.

        Vault


        • Modify the default rule setting by reviewing the options and selecting yes or no.
        • Modify the length of retention coverage by entering a number of days or selecting Indefinitely.
        • Modify what should happen after retention coverag eexpires by reviewing the options and selecting an option for expunging the message.
          • A warning dialogue will appear if you select the option to “Expunge the message, EVEN IF it is presently in a user’s mailbox.” This means that a message will be deleted after the specified number of days, even if a user intended to keep that message.
        • Click “Save” to save the default retention rule.
      • Click “Add rule” to add a custom retention rule. If this retention rule has a longer length of retention coverage, it will override the default retention rule.

        Vault


        • Select the organizational unit this rule should apply to from the dropdown or leave it as is to apply to the whole domain.
        • Enter any conditions that must be met for a message to be covered by a retention rule. 
          • For an explanation of search operators that can be used in the terms field, see this help document.
        • Enter a length of retention coverage for this retention rule or select “Indefinitely.”
        • Click “Preview” to see a preview of the emails that will be covered by this retention rule.
        • Click “Save” to save the retention rule.

  • Create a matter
    • A matter is a container for all of the data related to a specific topic, such as a litigation case or investigation (see support topic). A matter includes:
      • Saved search queries
      • A list of accounts with data on litigation hold associated with the matter
      • A list of the accounts that can access the matter
      • Export sets for the matter
      • An audit trail for the matter

        Vault


    • The Vault home page shows a list of existing matters.
    • Click the “Create” button to create a new matter.
      • Give the matter a name and a description.
      • Click “Create new matter.”

        Vault


  • Add collaborators to a matter
    • From the Vault homepage, click on a matter to which you would like to add a collaborator.

      Vault


    • Click “Share” in the upper right corner.
    • Type the email addresses of the users you want to add in the “Add people:” field. The user must be set up as a Vault admin before being added as a collaborator.
    • Select whether to send email notifications.

      Vault


    • Click “Save and close.”

  • Create a hold
    • A hold allows you to preserve messages in Vault indefinitely to meet legal or preservation obligations (see support topic).
    • Open the matter that will contain the hold by clicking on it from the Vault home page.
    • Click the “Create Hold” button.
      • Enter a unique name for the hold.
      • Select Accounts and enter the accounts that are subject to this hold.
      • In the “Terms:” box, enter the search terms for the items you would like to hold.
        • You can use search operators to narrow down the items in your search. Some common search operators include:
          • To and From to search messages sent to or received from a particular email address (to:john.doe@domain.com, from:jane.doe@domain.com)
          • The “Has” search operator is useful for searching for emails that have an attachment (has:attachment).
          • After and Before allow you to search for a specific date range (after:2004/04/16 before:2004/04/18)
          • See the full list of search operators at this help article.
        • Check the box to exclude drafts.

          Vault


        • Click “Save.”


  • Search for the items in the label
    • A search allows you to view the email and chat messages in a user’s account.
    • Open the matter that will contain the search by clicking on it from the Vault home page.
    • Click “Search” on the left menu.
      • Searching for email
        • Make sure “Mail” is selected next to “Type:”.
        • Enter the user’s account in the “Accounts:” field.
        • In the “Terms:” box, enter the search term for the email items you would like to search for.
            • You can use search operators to narrow down the items in your search. Some common search operators include:
            • To and From to search messages sent to
            • or received from a particular email address (to:john.doe@domain.com, from:jane.doe@domain.com)
            • The “Has” search operator is useful for searching for emails that have an attachment (has:attachment).
            • After and Before allow you to search for a specific date range (after:2004/04/16 before:2004/04/18)
            • See the full list of search operators at this help article.
          • Check the box to exclude drafts.
          • Click the “Search” button.

            Vault


  • Save and export the search
    • To save this specific query, click “Save query” and give the query a name.
      • From now on, this query can be run by selecting it under the Search dropdown on the left menu.

        Vault


    • To export this query, click “Export results” and give the export a name. Exports will be available for 15 days. (Results obfuscated in the screenshot below).

      Vault


      • Once the export is complete, a green checkmark will appear to the left and details about the export will appear, including count, size, and export date.

        Vault


      • Click “View completed files”. The completed files include a zip file containing the mbox file of the emails or file included, an xml file containing just the metadata of the emails or files included, a csv file containing the number of items, and the file checksums.
    • To evaluate the files, download the zip file and extract to a folder on your hard drive.
      • Email exports are saved as mbox files. A mbox file can be viewed using a text editor or an email client like Mozilla Thunderbird.
      • Drive exports are converted to MS Office format and can be opened using any program compatible with MS Office.


  • Audit Vault user activity
    • From the Vault homepage, click the dropdown for “Reports” and click “Audit.”

      Vault


    • Enter a date range with a start and end date.
    • Select specific Vault users by typing their names into the field.
    • Begin typing a name and it should auto-populate the field.
    • Select the specific action types to audit.
    • Click “Download CSV.”

      Vault


    • Open the CSV in a text editor or a spreadsheet application to view the contents of the audit.