Google Workspace (G Suite) Email Backup Options

Unlike on-premise email software solutions that usually provide no built-in data protection, Google Workspace (G Suite) includes some recovery capabilities.

Administrators can recover Gmail messages deleted within 30 days for the users that are not deleted from Google Workspace. Emails from the user accounts deleted from Google Workpace can be recovered within 25 days after the account deletion.

Deleted user emails cannot be recovered from some system labels (Trash, Spam and Drafts). For the messages that can be recovered, only their latest versions are available (no versioning).

The recovery process restores email messages deleted within specified time period to their original location.

How to recover emails using the built-in Google Workspace tools

To initiate the process Google Workspace (G Suite) admin needs to:

1. Open the admin panel (admin.google.com) and click "Users"

1. Find the right user and click "Restore"

1. Select the period when the emails were deleted and click "Restore".

Google Workspace will attempt a data recovery after you click "Restore". However, there will be no visible progress bar or report to check the restore status. The only way to check if the restore has been completed successfully is to ask the Google Workspace users to manually find the lost messages in their Gmail.

The native recovery capabilities may be insufficient for some organizations because of the 25 days limitation and limited recovery capabilities (the need to ask end-users to check the recovery status manually, no option to restore to a different Gmail account/location).

Google Takeout is the built-in service that lets you export your organizations’ Google Workspace (G Suite) Gmail data offline. You can use Takeout to manually backup Google Workspace users' Gmail data locally every 30 days (the maximum allowed frequency).

Takeout in combination with the built-in recovery capabilities described in the first section help implement the following semi-automated Google Workspace email backup approach:

• Execute Takeout offline Gmail data export every 30 days
• Always backup data using Takeout before deleting users from Google Workspace (to overcome the 25 days limitation and avoid the 5 days gap)
• Use exported data if you need to restore emails deleted 30+ days ago
• Use the built-in Google Workspace recovery if you need to restore emails deleted less than 30 days ago

This approach will ensure that you backup all your users' email data at all times, but it will require regular manual efforts.

Let's see how Takeout works.

To access Takeout you need to log in as a G Suite administrator and open the Customer Takeout page admin.google.com/u/1/ac/customertakeout.

You need to meet 3 requirements to be able to use Takeout. Firstly, your administrator account which you’re using for the data export needs to be at least 30 days old. Secondly, the admin account has to have 2-factor authentication enabled and enforced. Finally, you Google Workspace domain should have less than 1,000 users.

When we tried to use the tool, Takeout showed the default screen informing us that one of the 3 requirements are not met (without saying which).

Since our organization has less than 1,000 users and the admin account is 30+ days old, we assumed that the 2-step authentication is the problem.

We used the instructions to enable 2-FA and enforce it. However even after we enabled the 2-step verification we could not start the data export and the system continued to show the default message.

We got in touch with Google support and they suggested that we should:

• create a new G Suite Organizational Unit (OU),
• add our admin account to that OU,
• enforce 2FA for the entire OU.

The data export feature became available ~5 hours after we followed the instructions with the new OU. When we visited the Takeout screen, we saw the Start Export button.

Once you click the "Start Export" button, Google will inform you that the data is being exported.

We received the confirmation email 4 days later, saying that the export is completed and the data is available for download.

After you click the "Access archive" in the email, you will be redirected to the Google Cloud Storage bucket. However, there is no option to download the entire contents of the export in a single zip file. Data for each Google Workspace user is placed in a separate folder, with multiple zip files within each folder (Takeout splits exports into pieces of no larger than 2GB each).

You have to download each file separately and this is not feasible/practicable for most G Suite domains with more than just a handful of users. Our export had approx. 200 individual export files and we managed to download all of them, this is hardly a sustainable solution for recurring G Suite email backup.

Personal Gmail Backup

If you want to use Takeout to backup data from a personal Gmail account, then you need to use a different link. Tick the checkbox in Mail section in order to download your email messages in MBOX format.

Google Vault is the archiving and data retention add-on for G Suite. Its main capabilities are e-discovery and legal hold used by large organizations when they engage in legal proceedings or for compliance purposes.

Google Vault facilitates the electronic discovery by providing archive search and offline data export. Its legal hold capability helps ensure that whenever there is a reasonable anticipation of a litigation, the relevant data is preserved without any modification.

Administrators can configure Google Vault retention policies in order to use it as a simple email backup solution with unlimited retention period. However, there is a number of important limitations in this option, since Vault does not retain data for deleted Google Workspace users, does not retain metadata (such as labels or Gmail contacts) and has no restore capabilities (only offline export).

Vault data recovery limitations

To restore data using Vault administrators need to export data from Vault offline and then manually import the downloaded MBOX files back to users’ Gmail accounts.

Google Workspace has no built-in tools that let you upload MBOX directly to Gmail and you will have to use Thunderbird, Outlook, or another email client. To perform the import, connect an email client to your Gmail account, open the MBOX file using the client software and move the email messages to your Gmail.

How to use Vault to backup/recover data

If you plan to implement G Suite email backup with Google Vault you will need to subscribe to G Suite Business/Enterprise and install an on-premise email client software that will help you restore Gmail messages back to G Suite.

1. Once you have Google Vault enabled, go to admin.google.com to launch it.

1. To enable G Suite data retention you need to configure retention rules, specifying which application’s data to retain and for how long. Leave the Terms field empty unless you want to limit retention to emails containing specified keywords.

1. After the retention rules are in place you can go to Search section and find Gmail emails that contain a text string and which were sent within a specified time period. There is no option to limit your search to deleted messages only.

1. After the search is completed, you will see the list of matching emails. The system lets you preview and download individual emails, or export all G Suite email backup search results at once.

1. Once you execute the export, you can download the results as a single zip archive.

The export zip file includes multiple archive files (one per each G Suite user) with MBOX inside.

No retention for deleted users

Google Vault erases archived data when users are deleted from G Suite. To implement a Google Vault-based G Suite email backup you will therefore need to manually backup emails before you delete them from G Suite.

Google Vault cost

Vault is not priced as a standalone solution, its implied cost is around $6 per user monthly.

Google Workspace Business Plus plan is the cheapest plan that includes Google Vault. The plan costs $18 per user monthly, compared to $12 per user monthly price of the Business Standard plan (which does not include Vaul). Given the feature set differences between the two plans, we believe that $4-6 of the price difference can be attributed to Google Vault.

Email archiving solutions are typically used by large organizations to help retain the data and perform search & e-discovery for compliance and litigations. With some limitations the archiving tools can also be used as Google Mail email backup tools.

When you connect an archiving service, every incoming and outgoing Gmail message gets forwarded to the archiving provider and is retained there for a specified period of time. Because the retention of based on the email forwarding mechanism, much of the email metadata remains uncaptured. Gmail labels, draft versions of the emails and any changes made in Gmail but left unsent will not be retained.

Most email archiving services provide unlimited retention and advanced search capabilities, but have no restore capabilities. The data can be exported offline, with no option to restore it back to Gmail automatically.

Major archiving solutions include Mimecast, Proofpoint and Barracuda. In addition to the retention & search, they provide additional Gmail security can continuity services such as spam filtering, anti-phishing, encryption and email server disaster recovery (failover instance of email server that helps to maintain email service availability in case Gmail is down).

All the major archiving vendors focus on the enterprise space. The net price (after discounts) for an environment with 500 or more users is between $4 and $50 monthly depending on the services included in the archiving bundle (unlimited data retention is typically included in premium, more expensive offerings) - making the Google Apps email backup based on an archiving tool one of the costliest options.

There are 20+ backup vendors focused on G Suite backup. All of them provide provide basic capabilities, such as:

• unlimited backup data retention,
• automated G Suite Gmail data backup with 1x to 3x daily frequency,
• ability to restore messages back to G Suite,
• at least some offline export option.

In a separate blog post we compare features and performance speed for the most popular business Google Apps email backup tools. While all solutions in the review have the basic four capabilities listed above, they differ significantly in how well they support Gmail backup, browsing, data export and restore.

Below is the short summary of the most relevant G Suite user email backup features that are not universally supported by the backup vendors. In addition to the backup reliability, they help assess solutions' restore and management capabilities. You can use the outlined features to make sure that you test all important capabilities when tiraling / evaluating Google email backup software. Please read the full review if you'd like to get more details about the vendors on the market.

The cost of most cloud-to-cloud G Suite email backup solutions is within $3-4 per user monthly. For organizations with 250+ users the price is usually discounted to below $3 per user. This makes the cost of using the solutions cheper than most archiving products as well as Google Vault.

So what is the best way to take backup of G Suite user emails? Built-in recovery G Suite tool set and Takeout require no additional investments but are inherently limited. Archiving solutions (Vault and 3rd party tools) are typically used by large organizations and provide semi-automated G Suite email backup option where the recovery has to be performed manually. Third-party cloud G Suite backup options normally provide the most complete & automated service. Therefore:

1. If you have no budget, combine built-in G Suite recovery and Takeout to implement a manual G Suite email backup policy. Beware of their limitations and perform monthly Takeout data exports in order to be able to recover messages deleted 30+ days ago.
2. Use 3rd party backup tools to automate backup of G Suite email data. Make sure that the tool you select adequately supports the critical G Suite email backup requirements, including scheduled 3x regular daily backups, user self-service and granular Gmail data recovery options.
3. Use archiving tools if you are subject to data retention requirements. Organizations typically use archiving tools in combination with backup services. Archiving software provides data retention capabilities and in some cases can be used as G Suite email data backup solution. The software is useful if you don’t expect to restore emails back to Gmail and the retention of metadata is not needed.

All product names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation with or endorsement by them.