Download "The Lawyer’s Guide to Discovery and Investigations in Slack"

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

The Lawyer’s Guide to Discovery and Investigations in Slack

Everything you always wanted to know about Slack discovery but were afraid to ask.
Chapter 3

Preserving, Collecting and Exporting Slack Data for Discovery

Summary: Exporting Slack Data for Review


As Slack data increasingly supplements, and occasionally supplants, email as a primary form of business communication, preserving, collecting, and reviewing Slack data is essential for a complete discovery or investigation process.

  • Slack's default retention setting is to retain everything, forever, but retention schedules may be adjusted by administrators or individual members themselves.
  • Slack allows users to edit and delete messages, but keeps a record of these changes.
  • Retention and export options vary be Slack account type.
  • Depending on your Slack plan, you may not have easy access to data from private channels and direct messages.

There Are Four Key Features of Data in Slack:

  • It is immense
  • It is shifting
  • It is not easily accessible
  • It is not easy to interpret
arrow down
Download Now

Data Retention in Slack

Slack can quickly generate vast amounts of data. There are, first and foremost, the millions of messages that can be exchanged in a workspace in one day. Then there is the associated metadata, the timestamps, channel information, edit logs and the like.

But Slack is more than chat. Through apps and integrations, information can be pulled from outside sources in to Slack. Documents, from the most complex database file to a funny photo, can also be directly uploaded and shared through the platform, adding even more information to the stockpile.

By default, that data is stored forever. But, Slack allows workspace owners to customize their message and file retention policies. Files may be kept for the lifetime of the workspace or deleted after a specified time period.


Slack Retention Settings

Slack differentiates between message retention and file retention.

Slack message retention can be set to:

  • Retain everything, forever
  • Retain all messages but not revisions
  • Delete messages and revisions after a specified period
  • Let users set their own retention policies

For file retention, only two settings are currently available:

  • Retain all files, forever
  • Keep all files (including deleted files) forever
  • Delete files after a set number of days
  • Delete files (including deleted files) after a set number of days

Retaining all information is Slack’s default setting. This includes free accounts, where administrators have access to only 10,000 of the most recent messages—but, under this retention setting, Slack itself preserves them all.

If an administrator does not take action to change their retention policy, they could soon find themselves sitting upon a vast history of Slack conversations, reactions, integrations, and more—a potentially valuable resource, or a possibly costly liability, depending on your perspective.

Alternatively, if an administrator sets too liberal of a retention schedule, or does not adjust the retention schedule in light of a legal hold or reasonably foreseeable litigation, spoliation could follow. Further, where individual team members control the retention of data in private channels and direct messages, one user’s messages could be eradicated at the end of every day, while another’s are preserved for all time.

Private channels may have individual retention settings.

For all but free accounts, retention settings can be chosen for the workspace as a whole as well as for private channels and direct messages, allowing retention policies to be tailored to specific channels as one might to traditional email inboxes and custodians. But, again, those retention policies must be actively monitored to ensure that Slack data is not edited, destroyed, or otherwise spoliated.

arrow down
Download Now

How Slack Account Type Impacts Retention Settings

The ability to customize retention policies, as with most workspace administration features, depends on the type of Slack account used. Slack currently has four account types available:

  • Free
  • Pro
  • Business+
  • Enterprise Grid

These plans differ primarily in cost, storage size, and admin features. Plus and Enterprise plans, for example, can limit who can post in specific channels—other accounts cannot. Paid plans can set retention policies around private channels and direct messages; free plans cannot. Enterprise accounts, which span multiple workspaces, can apply retention settings across all of their Slack workspaces, a feature not available to any other account type.

Constantly Changing Data

Even when Slack data sizes are small, they can be hard to get one’s hands around. One reason for this is that conversations may take place in a muddle of formats—across public channels, private DMs, and comments on documents.

Another is that most Slack data is easily editable. An offensive photo can be deleted, a mistaken disclosure erased. A message that says one thing today can be edited to say another tomorrow.

In Slack, deleting a message takes only a click

Yet Slack creates a record of such alterations, often without users realizing it. If a Slack workspace retains editing and deletion information, those changes will be recorded in the metadata—and available in a review tool that knows how to process Slack data.

Exporting Data From Slack—or Collecting Directly from your eDiscovery Tool

For teams looking into Slack data, accessing everything Slack records can be difficult. Currently, Slack allows workspace owners and administrators in all plans to easily export data from public channels.

To export that available data, administrators can navigate to their workspace settings and select 'Import/Export Data.'

Administrators can export workspace data based on date ranges including:

  • Data from the last 24 hours
  • Data from the last 7 days
  • Data from the last 30 days
  • Data for the entire workspace history
  • Data for specific date ranges

Once an export request is processed, the data can be downloaded in a .zip file with message history in JSON format and links to shared files. For single user’s channels and conversations, however, data can also be exported in TXT format.

What's Included in a Slack Export?

Every Slack plan has access to Slack's "Standard Export."

A standard export includes:

  • Messages shared in public channels
  • Links to files shared in public channels

Standard exports will not produce:

  • Messages and files shared in private channels
  • Messages and files shared in direct messages
  • Editing and deletion information

Exporting Slack Data From Private Channels and Direct Messages

To access all data, Slack requires any of the following:

  • Top-tier paid Business+ and Enterprise accounts
  • Valid legal process
  • Consent of members, or
  • A requirement or right under applicable laws

Finally, a Slack export will include available data from the entire workspace. Unless a user has an Enterprise account, it is not possible to limit exports to individual channels or users.

What you do with Slack data once you've obtained it, however, can be much trickier than getting your hands on it in the first place...
Chapter 4

Slack in Litigation:
Interpretation, Spoliation, Objections

Getting started is fast and free

Start a discovery project in minutes from anywhere.