Slack Attack: Surviving Discovery in a Post-Email World

Back to Blog Posts

When email fundamentally changed how humans interacted and communicated a few decades ago, the practice of law had to adapt. Now, with email usage on the decline and collaboration tools like Slack rapidly increasing in adoption, legal teams are facing another inflection point.

These collaboration tools offer a wealth of information potentially relevant to a litigation or an investigation but can be a nightmare to manage. It is important for practitioners to find a partner that understands these unique challenges as they incorporate Slack data into their ediscovery workflow. DISCO realized adoption of these tools was reaching a tipping point, and developed a specialized approach to Slack data to minimize headaches and maximize insights.  

Who is this new kid on the block?

In 2019, an estimated 293 billion emails will be sent daily, varying from mission-critical business communication to family photos or the dreaded spam. Inboxes are becoming bloated, unwieldy, and more importantly unmanageable. Professionals spend over 17 hours a week wading through their emails, distracting from critical tasks, and wasting company money.

In response to this behemoth email problem, short-form communication and real-time collaboration are rapidly replacing email. The clear collaboration leader, Slack, has been adopted by more than 600,000 organizations with over 10 million active users per day, including 65 of the Fortune 100. And this growth shows no signs of abating.

Slack's growth to 10 million users

While email is certainly not dead, it is no longer the uncontested 800-pound gorilla. Collaboration tools contain a wealth of relevant information in a litigation or investigation, possessing a richness in content not normally seen in email. The informal, rapid-fire, short-format nature of Slack communication makes it a treasure trove for identifying potentially highly relevant data in ediscovery.

So what does this mean? In order to get the full communication picture with many clients, looking at emails and texts is no longer enough. These new kids on the block are growing rapidly in adoption and in some cases nearly completely displacing email. To understand what actually happened for an investigation or build a narrative, litigators must to understand what relevant information tools like Slack may contain.

Change is here. Are you prepared?

In my prior life at the helm of a top litigation firm’s ediscovery program, I felt the impact of this seismic communication shift firsthand. Over the last 18 months, nearly every scoping discussion covered collaboration tools, social media, communication apps, instant messaging, and more. What was once considered “weird data” is now the new normal.

This shift changed my approach to scoping for ediscovery. Rather than defaulting to estimates based upon email, network shares, and text data volumes, I pushed for a more in-depth discussion with the stakeholders in a case. This meant asking not just IT, but actual custodians how they communicate in the course of their job.

Getting the big picture of how people were actually communicating helped:

  • ensure all relevant data sources were included in scoping and preservation efforts
  • prioritize custodians
  • validate content found in other data sources

Not every vendor was created equal in supporting these new data types. Due to the costly and time-consuming issues caused by partnering with an unqualified provider, this capability gap meant at times partnering with provider I was not fond of simply because they could better parse and visualize a data format.

So Slack is the new email. What’s the big deal?

While Slack can offer substantial efficiency and benefit to an enterprise, as noted by the rapid adoption across top organizations, it also poses unique challenges in terms of ediscovery.

The problem is, collaboration tools were not designed with ediscovery in mind. Data exported directly from Slack and other tools is nearly undecipherable in its raw format, a file format called JSON. Extracting all the relevant information from a multi-person stream with links, reactions, graphics, and shared files and then presenting a cohesive picture of the data is complicated.

While many providers claim expertise in parsing these files, my experience has found they are using a brute force approach that turns one conversation into hundreds or thousands of files that make building continuity difficult. These results are often as unusable as raw JSON files.

How Slack appears in DISCO vs the JSON file other vendors provide for review.

Slack is a headache. What options do I have?

Since Slack clearly is not going away, DISCO created a tool that recreates the visual structure of Slack in an intuitive and readily reviewable format. Workspaces and full channels, complete with links, usernames, and all active content are recreated in the DISCO viewer, providing a holistic picture of the Slack ecosystem for an organization.

The reviewer no longer has to toggle through multiple files to recreate context, and they can scroll through the communication stream in much the same fashion as the original user. This ease of use greatly reduces time to insight to uncover relevant custodians and topics of interest.

To further drive cost and time savings, DISCO forensic experts help refine scope, determining which Slack data is presented and ultimately pushed on for review.  

The Slacker’s path forward

Business communication today continues to rapidly evolve. Slack, much like email before it, continues to fundamentally change business communication — and as a result, the methods necessary to support ediscovery. DISCO understands that practitioners need the tools and expertise to get the job done and continues to innovate to keep pace with the rapidly shifting digital landscape.

If you would like to learn more about how DISCO can work with Slack please contact

Check out the rest of our blog series on emerging data types

Subscribe to the blog
Cat Casey
Quick Menu