Create a Matter in Google Vault:
Log into Google Vault.
Click on "Matters" and then "Create".
Name the matter appropriately (e.g., User Investigation).
Share the matter with the litigation team members by adding their email addresses under the "Sharing" settings.
Create a Hold on the User's Mailbox:
In the created matter, go to the "Holds" tab.
Click on "Create Hold".
Specify the user's email address to place their mailbox under hold.
Set the parameters for the hold to ensure all relevant data is preserved and cannot be tampered with.
Reference
Google Workspace Admin: Create and manage matters in Google Vault
Google Workspace Admin: Create and manage holds in Google Vault