Skip to main content

Obtaining Slack Data for Discovery

Slack Data Gears

Summary

As Slack data increasingly supplements, and occasionally supplants, email as a primary form of business communication, preserving, collecting, and reviewing Slack data is essential for a complete discovery or investigation process.

  • Slack's default retention setting is to retain everything, forever, but retention schedules may be adjusted by administrators or individual members themselves.
  • Slack allows users to edit and delete messages, but keeps a record of these changes.
  • Retention and export options vary be Slack account type.
  • Depending on your Slack plan, you may not have easy access to data from private channels and direct messages.

There are four key features of data in Slack:

  • It is immense
  • It is shifting
  • It is not easily accessible
  • It is not easy to interpret

Retain everything, forever

Retain messages, not revisions

Set a retention schedule

Users set retention schedule

Data Retention in Slack

Slack can quickly generate vast amounts of data. There are, first and foremost, the millions of messages that can be exchanged in a workspace in one day. Then there is the associated metadata, the timestamps, channel information, edit logs and the like.

But Slack is more than chat. Through apps and integrations, information can be pulled from outside sources in to Slack. Documents, from the most complex database file to a funny photo, can also be directly uploaded and shared through the platform, adding even more information to the stockpile.

By default, that data is stored forever. But, Slack allows workspace owners to customize their message and file retention policies. Files may be kept for the lifetime of the workspace or deleted after a specified time period.

Slack Retention Settings:

Slack differentiates between message retention and file retention.

Slack message retention can be set to:

  • Retain everything, forever
  • Retain all messages but not revisions
  • Delete messages and revisions after a specified period
  • Let users set their own retention policies

For file retention, only two settings are currently available:

  • Retain all files, forever
  • Delete files after a set number of days

Retaining all information is Slack’s default setting. This includes free accounts, where administrators have access to only 10,000 of the most recent messages—but, under this retention setting, Slack itself preserves them all.

If an administrator does not take action to change their retention policy, they could soon find themselves sitting upon a vast history of Slack conversations, reactions, integrations, and more—a potentially valuable resource, or a possibly costly liability, depending on your perspective.

Alternatively, if an administrator sets too liberal of a retention schedule, or does not adjust the retention schedule in light of a legal hold or reasonably foreseeable litigation, spoliation could follow. Further, where individual team members control the retention of data in private channels and direct messages, one user’s messages could be eradicated at the end of every day, while another’s are preserved for all time.

Setting Slack Private Channel Data Retention


Private channels may have individual retention settings.


For all but free accounts, retention settings can be chosen for the workspace as a whole as well as for private channels and direct messages, allowing retention policies to be tailored to specific channels as one might to traditional email inboxes and custodians. But, again, those retention policies must be actively monitored to ensure that Slack data is not edited, destroyed, or otherwise spoliated.

Free

No customization

Standard

Can set retention policies

Plus

Can set retention policies

Enterprise

Access to Slack API

How Slack Account Type Impacts Retention Settings

The ability to customize retention policies, as with most workspace administration features, depends on the type of Slack account used. Slack currently has four account types available:

  • Free
  • Standard
  • Plus
  • Enterprise

These plans differ primarily in cost, storage size, and admin features. Plus and Enterprise plans, for example, can limit who can post in specific channels—other accounts cannot. Standard, Plus, and Enterprise plans can set retention policies around private channels and direct messages; free plans cannot. Enterprise accounts, which span multiple workspaces, can apply retention settings across all of their Slack workspaces, a feature not available to any other account type.

Constantly Changing Data

Even when Slack data sizes are small, they can be hard to get one’s hands around. One reason for this is that conversations may take place in a muddle of formats—across public channels, private DMs, and comments on documents.

Another is that most Slack data is easily editable. An offensive photo can be deleted, a mistaken disclosure erased. A message that says one thing today can be edited to say another tomorrow.

Slack Message Being Deleted


In Slack, deleting a message takes only a click

Yet Slack creates a record of such alterations, often without users realizing it. If a Slack workspace retains editing and deletion information, those changes will be recorded in the metadata—and available in a review tool that knows how to process Slack data.

GET THE GUIDE

The Lawyer's Guide to Discovery and Investigations in Slack

Downloaded by thousands. Get your copy today.

CLAIM YOUR COPY

Slack Guide

Exporting Data From Slack

For teams looking into Slack data, accessing everything Slack records can be difficult. Currently, Slack allows workspace owners and administrators to easily export data from public channels.

To export that available data, administrators can navigate to their workspace settings and select 'Import/Export Data.'

Administrators can export workspace data based on date ranges including:

  • Data from the last 24 hours
  • Data from the last 7 days
  • Data from the last 30 days
  • Data for the entire workspace history
  • Data for specific date ranges

Once an export request is processed, the data can be downloaded in a .zip file with message history in JSON format and links to shared files.

JSON definition

What's Included in a Slack Export?

Every Slack plan has access to Slack's "Standard Export."

A standard export includes:

  • Messages shared in public channels
  • Links to files shared in public channels

Standard exports will not produce:

  • Messages and files shared in private channels
  • Messages and files shared in direct messages
  • Editing and deletion information

To access all data, Slack requires any of the following:

  • Top-tier paid Plus and Enterprise accounts
  • Valid legal process
  • Consent of members, or
  • A requirement or right under applicable laws

Finally, a Slack export will include available data from the entire workspace. Unless a user has the highest-paid tiers, it is not possible to limit exports to individual channels or users.

Overcoming Slack Objections - Sample Letter Brief

Facing objections to Slack discovery? Sign up for Logikcull's blog and get a sample letter brief addressing burden and proportionality objections.

By submitting this form, you agree to Logikcull's privacy policy.

What you do with Slack data once you've obtained it, however, can be much trickier than getting your hands on it in the first place...

Searching Slack Chat

NEXT

Slack in Litigation: Interpretation, Spoliation, and Objections

Next