[MID TEMPO MUSIC]
MITCH CHRISTOW: Welcome to the Google Cloud Security Showcase,
a special web series where we will
focus on security use cases that customers
can solve with Google Cloud.
My name is Mitch.
And I'm a product manager at Google Cloud.
Today, we will be walking through one
of the top questions we get from customers--
how can I perform legal discovery
in G Suite using Google Vault?
Google Vault helps the organization respond quickly
to legal inquiries, investigations,
and requests for records.
You can retain, search, and export
supported data types, such as email messages, Drive files,
Meet recordings, and on-the-record chats.
To get started, go to vault.google.com and sign in.
All information related to an inquiry or investigation
is stored in a container called a "matter."
A matter keeps information from one investigation
separate from any others.
To search, I need to create or open a matter.
I already started a matter related to this inquiry
called Omega.
I can filter the list to find the matter by entering
the name in this search bar.
This is really helpful if my company has a lot of matters.
Yep, there it is.
When I click it, I can see all the actions
I can take in a matter--
search, holds, exports, and audits.
To search, I select the Google service I want to search.
For this example, I'll choose Gmail.
I can use the search options to make my search as
narrow or wide as I want.
For example, to start, I'll search all accounts.
If I want to find only emails that
contain a certain keyword, such as a sensitive project name,
I can enter the keyword in the Terms field--
for example, Project Omega.
Before I search, I want to know how many results I will get.
This is faster than a full search
and can help me avoid starting a search that
will return too many messages.
I can see that there are nine messages that match my search
and two accounts of matching messages.
If I want more information about how many matches
there were for each account, I can
click to download a CSV file.
Now that I know the count, I'll run the search
to get the messages that match.
If I wanted to, I could change the search terms
to narrow or widen my search.
I can explore these results right in Vault.
When I click on a message, a preview
opens that shows the message contents.
After I review the message, I can
advance to the next message.
This query returns the messages I want.
So I'll export the messages.
I enter a descriptive name and start the export.
Depending on how many messages there are,
this task can take from several seconds to several hours.
So while my export runs, I'll save this query
so I can run it again later.
I can find my saved queries later
in the list of saved queries.
Here, I can pick a saved query from the list
or perform a search to narrow down my options from all
the saved searches.
My export should be done by now.
I can go to the export list and check its status.
The export list shows the status of all my exports,
including how long I have to download them.
Each export is deleted 15 days after it started.
I can download the messages that matched my search
and the metadata that links them to the sender and receiver
accounts.
Now I want to do another search for files and specific share
drives.
I'll go back to the search page in this matter.
First, I'll clear my current search.
This doesn't delete my saved query.
It just gives me a blank slate.
Now I'll select Drive from my Google service.
For the entity, I'll choose Shared Drives.
To find shared drives that a specific user has access to,
I enter their email address and get
a list of those shared drives.
I can then select the shared drives I
want to include in the search.
If there are a lot shared drives,
I can search for specific ones by name.
Since I want to see all the files this user has access to
across this shared drive, I won't enter any other search
parameters.
I just click Search.
The results show the filenames and which
shared drives the files are in.
I can preview the files, as before.
I can also export or refine my search.
Now you've seen how to accomplish e-discovery tasks,
like search and export, with Vault. Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MID TEMPO MUSIC]