Depending on your use of the tool, it may or may not work as a backup. So, let's explain what Google Vault does and doesn't do, so you can make your own decisions when implementing other backup tools in your business besides Vault.
Google Vault: A tool to search and find emails and files
Google Vault is constantly making copies of all emails and files that are created and modified in licensed accounts. Therefore, it is saving information all the time. If moj phone number data we have configured the information retention policies correctly, any item, whether created or deleted, can be found by this software.
When we need to search for an email, we can use a search engine that performs a search similar to the one we would do in Gmail, but in all mailboxes at the same time. Awesome! This can be very useful, for example, if we are looking for an email sent by a client and we don't know who in the company it was sent to.
search-emails-in-all-google-vault-accounts
When searching for Google Drive files, we need to select the specific person, organizational unit, or shared drive where the file we are looking for is located. For Google Docs, we can select a specific version by indicating the revision date. However, for other types of documents, such as Office documents or PDFs, only the latest version will appear.
For both emails and files, the tool searches for exactly what we need, but does not offer a restore option. The only option is to download it. Then, it will be our responsibility to upload the file back to its original location.
Google Vault does not protect you from ransomware
Google Vault does not protect you from ransomware because a ransomware attack usually modifies the file, encrypting its contents and renaming it. In some cases, they do delete the original files and create new encrypted files. When this happens, then you can recover them with Google Vault. However, in our experience, in all the ransomware cases we have seen, the files were modified and then renamed. They were not deleted and new ones were created.
Therefore, we can conclude that Google Vault does not protect you from ransomware because you will be unable to find the original, unencrypted files. The deleted file recovery tool provided by Google in the admin console will not be helpful in this case either.
The only two options you have to recover from such an attack are backup solutions outside of Google and the management of previous versions provided by Google Drive. In the latter case, it does allow you to download the file as it was before it was encrypted, but the drawback is that you have to do it file by file. Considering that a ransomware attack will probably have encrypted all the documents a user has access to, we could be talking about thousands of files.
