Setting up the search that collects your evidence

This search decides what comes in, and Google Vault performs the collection. The Search this job tab is a different thing: it works inside evidence that has already been collected, and it is run by ScoopVault.

The initial collection search is not a Search Run. A Search Run is the record of a post-ingest Exact, Connected or Proximity search over material already held.

A custodian is a mailbox or person placed within your authorised Vault scope. This decides whose mail may be collected at all.

A participant is a sender or recipient you match on inside the query. This narrows which messages within that authorised scope come back.

Naming someone as a participant does not widen your collection scope. If their mailbox is not within your authorised scope, matching on their address only finds messages where they appear in mail you were already authorised to collect.

On the New Search page you set out what you are looking for:

1. Confirm your authorised scope and custodians. Everything else operates inside it.
2. Optionally describe what you are looking for in your own words. There is a description box for this, capped at 2,000 characters. Descriptions above 2,000 characters are rejected before any provider request is made; they are not silently truncated.
3. Where AI-assisted interpretation is enabled for your workspace, use Generate Search. This turns your written description into structured search criteria: dates, people, keyword groups, exact phrases, and whether the message has an attachment.
4. Review the criteria in the Query Preview.
5. Submit the search. ScoopVault sends the authorised search and export request to Google Vault.
6. Google Vault performs the collection, then ScoopVault ingests what it returns and records every message with its fingerprint.
7. Only then can you use the Search this job tab and the rest of the investigation.

The structured criteria shown to you are the criteria that get compiled and submitted. Your written description is an input used to produce them. It is not a second, parallel instruction that keeps running alongside them. If the criteria are not what you meant, change the criteria.

Use a complete email address for anyone you want to match on.

The field may accept other forms of text. We are only telling you to rely on complete email addresses, because that is the form we can currently stand behind for matching. A person's display name is not something this guide asks you to depend on, and you should not assume a name alone will match the way an address does.

If interpretation does not produce valid structured criteria, no generated criteria are accepted. Nothing is guessed and no partial criteria are used. You can construct the structured criteria directly instead.

Where AI-assisted interpretation is not enabled for your workspace, you construct the structured criteria directly. Nothing else about collection changes.