Table of Contents
Email Content Search is a live search for your entire domain. Allowing Google Workspace Admins to search for any piece of text in any email in any mailbox across the domain.
As long as the email is not permanently removed from the bin folder, Email content search can find it. This process may take a long time if you are searching through many accounts at the same time.
Start Live Search #
To start a live search to find emails from one user’s account, select the following operators:
from: OR to: or “some sentence” etc.
For example:
from:david@generalaudittool.com “private and confidential” newer_than:30d is:read
- Any string in quotes ” “ is used to search both the subject and the body of the email.
- ‘newer_than:‘ is counted in (d)ays. ‘is:‘ can be read or unread or both states if omitted.
You should narrow down the search as much as possible to speed up the search. 
When the Query is applied.
- Apply the search query and enter it on the field
- Search for the Users – enter the User/Group/Org. Unit
- Click on Search emails
Note: Ignore Google Meet/Hangouts chat records by using ( -is:chat ), the (–) symbol excludes chat messages.
Note: Click on “∨ ” icon- to see Google Search tips
Result #
When the search results appear you can request access to view, delete(remove), or download the Emails. The results can be exported into Google Sheet (CSV) for further analysis. Select the emails and use the Unlock feature to request access via Security officer approval.
Take action – using Unlock #
More information regards the actions possible via Unlock can be found here
