The Lawyer’s Guide to Discovery and Investigations in Slack
Everything you always wanted to know about Slack discovery but were afraid to ask.
‍
As Slack data increasingly supplements, and occasionally supplants, email as a primary form of business communication, preserving, collecting, and reviewing Slack data is essential for a complete discovery or investigation process.
.png)
Slack can quickly generate vast amounts of data. There are, first and foremost, the millions of messages that can be exchanged in a workspace in one day. Then there is the associated metadata, the timestamps, channel information, edit logs and the like.
But Slack is more than chat. Through apps and integrations, information can be pulled from outside sources in to Slack. Documents, from the most complex database file to a funny photo, can also be directly uploaded and shared through the platform, adding even more information to the stockpile.
By default, that data is stored forever. But, Slack allows workspace owners to customize their message and file retention policies. Files may be kept for the lifetime of the workspace or deleted after a specified time period.
‍
Slack differentiates between message retention and file retention.
Slack message retention can be set to:
For file retention, only two settings are currently available:
Retaining all information is Slack’s default setting. This includes free accounts, where administrators have access to only 10,000 of the most recent messages—but, under this retention setting, Slack itself preserves them all.
If an administrator does not take action to change their retention policy, they could soon find themselves sitting upon a vast history of Slack conversations, reactions, integrations, and more—a potentially valuable resource, or a possibly costly liability, depending on your perspective.
Alternatively, if an administrator sets too liberal of a retention schedule, or does not adjust the retention schedule in light of a legal hold or reasonably foreseeable litigation, spoliation could follow. Further, where individual team members control the retention of data in private channels and direct messages, one user’s messages could be eradicated at the end of every day, while another’s are preserved for all time.
For all but free accounts, retention settings can be chosen for the workspace as a whole as well as for private channels and direct messages, allowing retention policies to be tailored to specific channels as one might to traditional email inboxes and custodians. But, again, those retention policies must be actively monitored to ensure that Slack data is not edited, destroyed, or otherwise spoliated.
The ability to customize retention policies, as with most workspace administration features, depends on the type of Slack account used. Slack currently has four account types available:
These plans differ primarily in cost, storage size, and admin features. Plus and Enterprise plans, for example, can limit who can post in specific channels—other accounts cannot. Paid plans can set retention policies around private channels and direct messages; free plans cannot. Enterprise accounts, which span multiple workspaces, can apply retention settings across all of their Slack workspaces, a feature not available to any other account type.
Even when Slack data sizes are small, they can be hard to get one’s hands around. One reason for this is that conversations may take place in a muddle of formats—across public channels, private DMs, and comments on documents.
Another is that most Slack data is easily editable. An offensive photo can be deleted, a mistaken disclosure erased. A message that says one thing today can be edited to say another tomorrow.
Yet Slack creates a record of such alterations, often without users realizing it. If a Slack workspace retains editing and deletion information, those changes will be recorded in the metadata—and available in a review tool that knows how to process Slack data.
For teams looking into Slack data, accessing everything Slack records can be difficult. Currently, Slack allows workspace owners and administrators in all plans to easily export data from public channels.
To export that available data, administrators can navigate to their workspace settings and select 'Import/Export Data.'
Administrators can export workspace data based on date ranges including:
Once an export request is processed, the data can be downloaded in a .zip file with message history in JSON format and links to shared files. For single user’s channels and conversations, however, data can also be exported in TXT format.
Every Slack plan has access to Slack's "Standard Export."
A standard export includes:
Standard exports will not produce:
To access all data, Slack requires any of the following:
Finally, a Slack export will include available data from the entire workspace. Unless a user has an Enterprise account, it is not possible to limit exports to individual channels or users.
.svg)
.svg){kind=small}
.svg){kind=small}