How to Silently View Google Drive View Files from Any Google Workspace User #

We are going to use a powerful search feature in the GAT+ Google Drive audit where GAT+ can identify the contents of documents. This feature is called the ‘File content search’.

It allows admins/delegated auditors to use words or sentences to search through all of the files across your domain and it will return documents that contain them.

Apply filter #

Navigate to GAT+ > Drive > File Content Search

Fill in the necessary details

• Query – enter the Query you are searching for
• Full text only  – enable or disable by clicking on the checkmark
• User/Group/Org.Unit – select where to search the file, who are the users to search thru?
• Search files – Apply the filter
• Previous searches – select any of the previous searches that ran

In the example below, we search for a File that contains the sentence “Test for auto share removal”.

Multiple other queries can be used.

Result #

Note: It might take some time for the search to complete depending on the search performed and the number of files you have in your domain.

The result files will contain the sentence –  “Test for auto share removal” .Select the files you want to access, by clicking on the checkmarks beside the file title.

Send request #

Select the files needed -> File operations button -> Create new access request 

A pop-up window will be displayed.

• Request access until – pick a date until access to view the files will be granted
• Message – leave an (optional) Message to the Security officer
• Send request – to proceed

Security officer approval #

When the request is sent, the Security officer will receive an email notification for approval.

When “click here” the Security officer can Approve or Deny the request.

When it is approved, an email will be sent to the requester, that it is approved.

Access the files #

When the request is approved, the Admin can click on the “previous searches” button and select the previous filter applied.

Click on the green checkmark under Actions

This will filter back the previous search and show the result. This time, the result will include the files we requested also access to.

View file content #

From the right side under Actions > (lock icon) option:

• Download
• Show File content 

A carbon copy of the selected File will be opened, the end-user will not see that their file was accessed.

Show file content  #

Show file content – will open a new tab showing its content.

It will be a carbon copy of the file, not the actual file, therefore there will be no log of the file being accessed by Admin – as they will not be added to the actual file.

Admin Log #

All of the above actions will be shown in the immutable Admin log.