eDiscovery for Google Workspace

Welcome to SpinOne for Google Workspace your all-in-one SaaS security platform.

Today, we will be discussing eDiscovery, SpinBackups, granular searching, and legal hold solution.

Select eDiscovery on the left hand toolbar, beneath backup to get started.

From here, you’re greeted with visibility into your cases.

Think of a case as the technical knowledge hub for the investigation you’re currently performing.

Within a case, there’s functionality such as holds and searches.

We’ll start with Searches.

Within Searches, you’ll have visibility into your pre-ran searches, as well as functionality to launch a new search.

When it comes to your already ran searches, select records found to be greeted with visibility and to the results of a specific search.

From here, you can determine if you want to restore this data to another user or a shared drive, or perhaps you would like to download it to your local device to act as a reminder of the criteria you used for this search, select Search Criteria.

When creating a new search, it’s important to know what it is that you’re looking for and of course, the specific service for Google Workspace that you want to investigate.

For today, we’ll say we’re looking at Gmail.

As far as the scope, we can determine all the users, specific OUs in the Google workspace, or even specific groups.

To take it a step further, we can also define specific users.

Once you’ve determined your scope, you can now create your search criteria.

We can look for things, for example, data being emailed from a specific user to a specific user.

We can also determine a specific subject or data within the body of an email.

From here, you can launch your search, and when this search is completed, you will see its results next to the respective search in the search’s menu.

Being that we’ve just detected the data that you were looking for, now you would want to create a hold, a hold that acts as a rule to prevent any of this data that’s just been detected from being deleted or tampered with.

Within a holds, you’ll see your holds menu, your currently active Holds, your previously active Holds, and holds that are also cancelled, to launch a new hold, simply select new Hold.

When it comes to your services, similarly to launching searches, you would want to establish which specific service of Google Workspace you would like this hold to apply to.

For example, Gmail and the scope once again determining the entities to whom the hold should apply.

As far as your attention, you consider it to be indefinitely, which is the length of the case itself, or a fixed hold, perhaps for a couple days or a few weeks.

This is you discovery for SpinBackup on Google Workspace.