Slack eDiscovery Collections: Preserving Conversation Context, Attachments and RSMF Reviewability

Slack is not email. A single relevant conversation can include public channels, private channels, direct messages, group direct messages, threads, reactions, edits, files, links, Slack Connect content and messages involving multiple custodians. Treating a Slack export like a folder of ordinary documents can strip away the context that makes the communication understandable.

Start with the license and export path

Slack’s available export and preservation options depend on the organization’s plan and configuration. Enterprise environments can support legal holds and Discovery API workflows, while administrative export capabilities vary by plan and approval status. Before collection, confirm the workspace or Enterprise organization structure, the applicable Slack plan, retention settings and whether the matter requires a standard export, organization-level export, Discovery API collection or legal hold.

Preserve the conversation structure

Slack exports commonly contain JSON plus referenced files and metadata. The JSON files are not interchangeable. Root-level user, channel, direct-message and group-message information can be required to interpret the individual conversation folders correctly. Repackaging or filtering must therefore preserve the relationships used by downstream processing.

Relativity can convert supported Slack data to Relativity Short Message Format (RSMF). RSMF is designed to normalize conversational data so reviewers can search and review messages with context, including participants, timestamps and supported events. Attachment handling is equally important because attachments need to remain associated with the correct conversation and message.

Custodian filtering and deduplication

Slack creates an eDiscovery challenge when the same channel is collected for multiple custodians. Loading each custodian’s full copy without normalization can multiply review volume and create inconsistent coding. A defensible workflow should distinguish between preserving the original source export and creating a normalized review set. Deduplication decisions should be documented so the review set can reduce redundant content without losing custodian association or conversation context.

Common technical failure points

• Collecting only public channels when private channels or direct messages are in scope.
• Filtering JSON without preserving required root metadata.
• Dropping attachments because download links expire or files are no longer available.
• Splitting conversations in a way that creates orphaned messages or destroys thread context.
• Failing to account for retention settings before preservation is established.
• Assuming every Slack plan provides the same export scope.

Practical takeaway

Slack collection should be planned as a conversational-data workflow from the beginning. Preserve the original export, document the collection method, validate the JSON structure, maintain attachment relationships, and choose a review format such as RSMF when the downstream platform supports it. Proper normalization can make Slack data dramatically easier to search and review while maintaining defensible traceability to the source.