Skip to content
Using ScoopVault4 min read

Searching your collected evidence

Once an investigation has collected its material, the Search this job tab lets you search within it. This is different from the Vault search that decided what to collect: that one chose what came in, this one works inside what is already here.

This article is about searching evidence you already have

There are two different search surfaces, and this article covers the second one: Exact, Connected and Proximity search over evidence that has already been collected, run by ScoopVault.

The search that decided what was collected is a separate surface, and Google Vault performs that collection. See Setting up the search that collects your evidence, linked below.

Three modes, chosen per search

You choose Exact, Connected or Proximity each time you search, not once for the whole matter. Each run is saved under Previous searches, where you can reopen the result recorded at the time without silently running it again.

Exact: only messages matching your search

Exact finds messages where your terms actually appear: in the sender, the recipients, the subject, the message the sender wrote, or an attachment filename.

Whole terms and quoted phrases. Searching "call" does not match inside "recall". Use double quotes for an exact phrase, for example "corporate box".

It does not correct your spelling, and it does not guess. If you search a word that isn't there, you get nothing, and we tell you plainly.

Every result shows why it matched: which field, which term, and the surrounding text.

Exact does not use AI. The same search over the same material always returns the same results.

Connected: matching messages plus the conversation around them

Connected does everything Exact does, and then adds the messages that are structurally connected to what it found. There are two ways a message can be structurally connected, and Connected tells you which one applies to each result.

The rest of the conversation. Messages in the same conversation as a direct match, in both directions, reconstructed from the reply structure of the collected material. These show which direct match they came from and how far away they are.

A separate thread between the same two people. Connected can also return a message that is not in the visible reply chain at all. This happens when the same sender and recipient, in either direction, continue in a separate thread within the standard window, and at least one further deterministic signal supports the connection: the two messages were sent close together in time, or the message contains one of the fixed, published channel-switch phrases. Continuation alone is never enough.

Both kinds are ordinary Connected results. There is no separate category and no special label; what differs is the reasons shown.

A connected message may also show one or more additional factual reasons, where another deterministic rule about the message or conversation also applies. Neither this nor the structural reason indicates the sender's intent, conduct, or that a conversation actually moved to another channel; each records an observable feature of the message for you to assess.

Connected does not use AI. The channel-switch reason checks only a fixed, published list of phrases, only against words the sender actually wrote, never quoted history.

Proximity: two terms within a chosen distance

Proximity finds messages where two terms appear within the number of words you choose. You can add up to five term pairs and match any pair or all pairs.

Each result shows both highlighted terms, how many words apart they are, where they matched and the surrounding context. Proximity is deterministic and does not use AI.

If proximity criteria were used on New Search, the collection-time result remains available under Previous searches as At collection: proximity criteria from New Search.

What Search does not do

Search does not adjust for misspellings and does not infer related meaning beyond the words you enter. It does not promise to surface every message that could conceivably matter. A search that finds nothing is still recorded, so you always know it ran.

Can't find what you need? Contact support. We aim to respond within one business day, during UK business hours.