How to search Google Vault for emails between two parties

Two-party searches are common across a wide range of investigation types:

• Commercial disputes: what did your team actually say to the supplier about pricing, delivery, or contract terms?
• Approval and authorisation: what passed between the approver and the requester before a decision was made?
• HR and conduct: what were the direct communications between a manager and an employee over a given period?
• Compliance and data: what did an internal team share with an external party, and when?
• Legal and contract: what was communicated during negotiations, and does it contradict the final agreement?

In each case, the goal is not just to find everything about either party individually — it is to find the correspondence between them specifically.

This is the structural principle that makes two-party searches work. Within each party, you use OR to capture all their identifiers — different addresses, name variants, or domains. Between the two parties, you use AND to require both to be present in the same message.

Basic structure:

(from:alice@company.com OR to:alice@company.com OR cc:alice@company.com)
AND
(from:bob@vendor.com OR to:bob@vendor.com OR cc:bob@vendor.com)

This returns messages where both Alice and Bob appear as participants — either as sender or recipient. Without the AND, you get everything involving either party, which is usually far more than you need.

There is a practical distinction between messages where two parties communicated directly, and messages where both happened to appear on the same thread. A message sent to a distribution list that both parties received is different from a direct exchange between them.

For most dispute and contract investigations, direct communication is what matters. If you need to narrow results to direct exchanges, consider whether adding keywords or tightening date ranges can help filter out noise from shared threads.

In some investigations — particularly around internal decisions or escalations — co-presence on a thread is itself relevant: it establishes who was in the room, so to speak, when a decision was made or communicated.

Use full email addresses for precision. If a party uses multiple addresses — a personal account, an alias, or a different domain — include each with OR within that party's group:

(from:alice@company.com OR to:alice@company.com
  OR from:a.jones@company.com OR to:a.jones@company.com)
AND
(from:bob@vendor.com OR to:bob@vendor.com)

When you know one party's specific email address but only the other party's domain, use the domain in place of specific addresses. This is common in supplier disputes, client investigations, or cases involving an external organisation where the specific contact varies:

(from:alice@company.com OR to:alice@company.com OR cc:alice@company.com)
AND vendor.com

The domain term will match any address from that domain appearing in the custodians' messages. Note that this is a broader match — it captures any contact at that organisation, not just a specific individual. Validate results before treating the full dataset as narrowly scoped.

Once the two-party structure is correct, add keywords to focus on specific themes within that correspondence. Keywords should narrow the result set, not substitute for the party logic:

(from:alice@company.com OR to:alice@company.com OR cc:alice@company.com)
AND (vendor.com OR "Vendor Ltd" OR "Bob Smith")
AND (invoice OR payment OR rate OR approved)

Start with the two-party structure, run a broad first search, then add keywords based on what you see. Starting with keywords before the party logic is a common mistake — it can cause you to miss relevant messages that use different language.

For two-party searches, date ranges are especially important. Disputes, negotiations, and approval chains typically span a defined period — but the context that explains what happened often starts before the visible issue and continues after it.

Use the date range to capture the full arc: what was agreed before, what changed during, and what was said after the event. Refine based on what the initial results show.

In contract disputes or approval investigations, the documents that passed between parties are often as important as the messages. If the investigation centres on what was shared — a rate schedule, a contract draft, a specification — consider whether attachment-focused keywords can help identify those exchanges specifically.

Terms like the document name, version references, or specific values that would appear in the attachment subject line can narrow the correspondence to the exchanges where a document actually changed hands.

Before exporting, review a sample of results. Confirm that messages are genuinely between the two parties, that the volume is consistent with the scope of the matter, and that the date range has not excluded relevant context.

If the results include a large number of distribution list messages or unrelated threads, consider adding keywords or tightening the date range before exporting. Document each refinement — the iteration history becomes part of your audit trail.

A two-party search is a specific logical structure, not a loose combination of names. OR within each party's group. AND between the two groups. Keywords added after the structure is correct, not before.

Getting that structure right means your dataset reflects the actual correspondence between two parties — not everything involving either of them separately. That distinction is what makes the investigation faster, the findings clearer, and the output defensible.

Google Vault gives you access to the data. ScoopVault helps turn the right search into investigation-ready answers.