The Rising Need for Slack Data Collections

Much like Microsoft Teams and Zoom, Slack is reporting a significant spike in usage recently. With more employees leveraging cloud collaboration platforms during the COVID-19 crisis, the need to acquire Slack data for investigative or discovery purposes will undoubtedly increase. It’s important to note that your ability to acquire Slack data will significantly vary depending on the Slack plan that is in place. The following are your options for acquiring Slack data.

Standard Export

A standard export is available to Slack workspace owners or administrators. However, a standard export only provides public channels for export. If private channels and/or private user messages (direct and multiparty) are required, you will need to leverage another method.

Corporate Export

Corporate exports are only available for Plus plan users. The client will need to complete Slack’s corporate export application process which will require documentation to ensure either user consent is in place, or the export is required for legal needs. The corporate export will provide both public and private data, however it will be provided in a format that will require additional processing to prepare for legal review.

Slack Export Options

Source: Slack.com

3rd-Party Tools

Several 3rd-party tools have the ability to connect to Slack through one of Slack application programming interfaces (APIs) designed for data transfer. Several forensic tools can connect to a client’s Slack environment and have the ability to collect public and private data; authentication is needed, which can typically be accomplished with user credentials and admin support.

Again, the type of Slack plan will dictate which tool can be used. If a client is on an Enterprise plan, they will be required to use a 3rd-party tool since corporate exports are not available, and Slack’s Enterprise Grid provides a unique API only accessible to approved 3rd-party tools.

If the need for an acquisition of Slack data arises for one of your cases, contact Archer Hall to discuss your options!