The investigation tabs explained

• Search done returns to the matter, where the job was created and where its status updates while Google Vault collects.
• The other four stages group the tabs below. The current stage is highlighted.
• The tabs remain available in any order.

Overview: the summary, Key Cases, Key Findings and timeline. Key Cases and Key Findings each show how many items have an investigator's review decision ("Reviewed: supports concern", "Reviewed: no concern", "Needs further review"), and a Review state filter. The decision is always the investigator's own; AI never sets it.

Risks: advisory review-priority signals with neutral category labels. Select a row to open the message in Explore. They are not determinations of wrongdoing or required action.

Explore: every collected email, to filter, sort, read and flag as evidence.

Ask: questions answered from this job's emails, with links to the sources.

Clusters: groupings by thread, participant and topic.

Search this job: Exact, Connected and Proximity search within what this job has already collected. All three modes use fixed rules rather than AI. Saved runs appear under Previous searches and can be reopened exactly as recorded. See "Searching your collected evidence".

Notes: notes on the job and on individual emails.

If proximity criteria were used when the evidence was collected, that result appears in Previous searches as At collection: proximity criteria from New Search.

Record: the Chain of Custody PDF, the report PDF, the audit log CSV and Verify Integrity.

Exports: MBOX, EML (ZIP), and a PDF of the messages flagged as evidence.

Overview, Risks, Ask and Clusters include AI-assisted, advisory material, marked as such on screen. Investigators return to the source emails and decide what the evidence means.