Extract from Damir Kahvedžić’s article “Supercharging Slack Data Handling with Workstream”
Slack is an extremely popular chat messaging service that is often found in ProSearch’s matters. The format in which the data is exported from the service is extremely challenging to handle from an eDiscovery perspective, specifically how to handle attachments. This article illustrates ProSearch’s home grown solution, WorkStream, and how the latest update has addressed key client concerns and drastically cut down the time needed to process it fully.
The Problem
Slack has very limited export options in its native interface. Admins can apply a date range and if the tenant has the Slack Enterprise license, target a specific user of Slack. But that’s it. Slack then gathers all chats across all channels for that person and exports them as a set of JSON files.
Files shared in chats are not included in the Slack delivery. They are only found as URL links with the JSONs. This keeps the export deceptively small. During processing we must follow the links and download a copy of the file during processing. It is not unusual for a delivery to take days to complete and balloon in size ten-fold due to all the downloaded attachments.
Typical discoveries may involve multiple users many of whom may have been part of the same channels or conversations. Data from each of those users must be collected separately. The same messages, attachments and data may be found multiple times across all custodians. Software would have to process all chats and all attachments before any sort of deduplication can take place.
