Slack EDiscovery
SLACK EDISCOVERY · A GUIDE FOR UK LAWYERS Slack e Discovery Channels, DMs, Threads, Edits, Retention Tiers and Exports: Disclosing the Workspace Where Work Actually Happens COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the office that talks in channels 03 The data model: channels, DMs, threads, files, apps 04 The lattice: plan tiers, retention settings and what survives 05 Edits, deletions and message history 06 Collection routes: exports, APIs and their fidelity 07 Processing and review: making channels reviewable 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: INSLACK, THESUBSCRIPTIONTIERANDASETTINGSPAGE DECIDEWHATEVIDENCEEXISTS: AUDITTHELATTICEBEFOREPROMISINGANYTHING
§ 02 · FIRST PRINCIPLES The problem in plain English: the office that talks in channels
§ 03 · THE DATA MODEL The data model: channels, DMs, threads, files, apps COMPONENT EVIDENTIAL CHARACTER
§ 04 · THELATTICE The lattice: plan tiers, retention settings and what survives
§ 05 · MESSAGEDYNAMICS Edits, deletions and message history
§ 06 · GETTINGITOUT Collection routes: exports, APIs and their fidelity
§ 07 · INTO REVIEW Processing and review: making channels reviewable
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (ROUTE- (DIGESTS, WORKSPACE EMAIL DEPENDENT) FORWARDS) CLIENT INTEGRATIONS / CONNECT DELETED / CACHES MIRRORS COUNTERPART RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THERETENTIONRULEWITHABIRTHDAY EXAMPLE2 · THEDMLAYERTHEEXPORTNEVERREACHED EXAMPLE3 · THEEDITHISTORYTHATREVERSEDTHEREADING
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes JSON. Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SL AC KLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Slack checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can we get employees' Slack DMs, or are they private? Our client's Slack only goes back 90 days. Is the case dead? Are Slack messages disclosable documents like email? The key message says "(edited)". What can we find out? How should Slack evidence be presented to a tribunal? What about Teams, Discord, and the other chat platforms?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Slack EDiscovery, Computer Forensics Lab, https://e-discovery.uk/library/slack-ediscovery/pdf.