WorkfloweDiscovery & Litigation Support

Slack and Teams eDiscovery

Slack eDiscovery that replays each channel, chat and phone thread in the order it was sent, puts deleted and edited lines back in place, and codes each slice of a conversation as one decision.

See how a chat becomes one coded slice ↓
Watch with transcript →
The problem

A one-word reply in chat means nothing until you read the lines above it

Review tools load chat the way they load email: one message, one document, one call. A reviewer working a busy Teams channel codes short lines that mean little alone. The same manager turns up as a Slack handle, a Teams display name and a phone number, so a conversation that moves from one app to another falls apart.

The lines that matter are often the ones the export hides. A line deleted two minutes after it was sent shows only as a gray placeholder, and an edited one keeps only its final wording. Meanwhile the other side wants the review unit written into the ESI protocol, and a team that cannot show what each reviewer read has a production it cannot defend.

Built foreDiscovery managersReview managersContract reviewersLitigation support teams

The Problem Today

Chat now arrives in most matters, and read one line at a time it loses the meaning around each message.

42.5%
of practitioners see Slack or Teams data in most matters published

Rebuilt by hand in review today

  • Handles
  • Threads
  • Edits
  • Privilege
  • Deleted lines go unseenThe export view shows only that a line was deleted
  • The review unit is contestedThe other side asks how much context each reviewer read

The Solution

  1. Threads rebuilt as they wereSlack, Teams and phone messages in order, handles matched to people
  2. Deleted lines restoredEdits and deletions shown in place, with original text and time
  3. Slices proposed with reasonsAgents say where each relevant conversation starts and ends, and why
  4. Coded once, then producedA reviewer codes each slice; production follows the agreed unit

Built-in controls

  • A person codes each slice; agents only propose
  • Only an attorney decides privilege
  • Nothing is released until the project manager signs

What You Get

Review teams produce chat in the unit they agreed, and can show what each reviewer read and why.

57%
fewer reviewer hours: about 128 instead of about 299 our estimate
  • Deletions in plain sightOriginal text and time, in review and in the production
  • One person, one nameSlack handles, Teams names and phone numbers matched
  • A defensible review unitEach slice records why it starts and ends, and who coded it
Nine stages of chat review

Slack eDiscovery on nine screens, from the export to a signed volume

Each screen takes one stage of chat review, from load to production, and names who works there and what it spares them.

  1. 01Threads rebuilt

    Slack, Teams and phone threads rebuilt in the order they were sent

    How it works

    • Reads the enterprise Slack export, the Teams export with its edit history and four phone extractions
    • Rebuilds 2,100,000 messages into 48,300 conversations: threads, replies and channel-days
    • Counts each source: 1,240,000 Slack, 712,400 Teams and 147,600 phone messages

    Litigation support analystHands reviewers whole conversations from nine custodians. A flat load would give them 2.1M separate lines with no thread around any of them.

  2. 02Handles and coverage

    Each person's handles matched, and a phone's missing week flagged

    How it works

    • Ties 27 handles, display names and phone numbers to the 9 custodians
    • Draws coverage one cell per week, chat and phone apart
    • Marks the week a replaced iPhone holds no messages, in red
    • Sends that gap to the project manager as a preservation question

    eDiscovery project managerLearns about a missing week of texts early enough to explain it, before the other side finds the gap in the production.

  3. 03Edits and deletions

    Edits and deletions shown with the original wording, author and minutes

    How it works

    • Restores 1,960 edits and 412 deletions across all 2.1M messages
    • Sets the original beside what the export shows today, with who and when
    • Counts 37 edits and 9 deletions inside the 212 relevant slices
    • Charts time to delete: 141 within a minute, 118 within five

    Contract reviewerSees the words a manager deleted two minutes after sending them, where the export keeps only a note that a message was deleted.

  4. 04Proposed slices

    Slices proposed with a written reason for where each starts and ends

    How it works

    • Cuts 48,300 conversations into 6,400 slices worth reading, about 14 messages each
    • Draws each channel-day as a ribbon, colored by code
    • Explains a start in words: 74 minutes of silence, then a change of topic
    • Follows the matter's rules: a 45-minute silence, at most 60 messages

    eDiscovery project managerCan show the other side what each reviewer read and why each unit begins and ends, before anyone challenges the review unit.

  5. 05Conversation replay

    A chat replayed as it happened, with deleted lines back in place

    How it works

    • Shows the chat as its members saw it, with avatars, reactions and replies
    • Puts line 6 back in gray: deleted at 4:21 PM, 2 min after sending
    • Shows line 9 with its first wording struck through, edited 6 min later
    • Marks the 74 and 49 minutes of silence on either side

    Contract reviewerReads the exchange together, so a one-word reply is judged against the deleted line it answers.

  6. 06Slice coded hot

    A whole slice coded as one decision, each reason cited to a line

    How it works

    • Agents propose relevant and hot, citing lines 3, 6, 9 and 12
    • The reviewer can move the bracket's start or end one message at a time
    • One code covers all 14 messages: not relevant, relevant or hot
    • A hot slice goes to a second reviewer; privilege goes to an attorney

    Contract reviewerMakes one call on the whole exchange, so no line is coded cut off from the lines around it.

  7. 07Review progress

    Review progress counted in slices against the volume's due date

    How it works

    • Plots slices coded each working day toward the due date
    • Lists each reviewer's pace and how often they changed the agents' proposal
    • Sets 89,600 single-line decisions beside 6,400 slice decisions
    • Reads 10% of not-relevant slices a second time: 2 of 640 overturned

    eDiscovery project managerKnows whether six reviewers will finish before the volume is due, and has the quality checks to show the client behind each code.

  8. 08Privilege calls

    Privilege calls on every relevant slice where in-house counsel appears

    How it works

    • Flags counsel in the conversation and any request for legal advice
    • Proposes withhold or redact, with the basis in plain words
    • The attorney withholds 6 and redacts 13, each call marked as theirs
    • Previews each redaction burned in and labeled with its basis

    Privilege attorneySees who asked counsel for advice in each chat and makes each call without hunting for counsel's name in a line-by-line export.

  9. 09Production volume

    A volume packaged in the protocol's unit, held for the manager's signature

    How it works

    • Takes the 206 produced slices: 212 relevant, less 6 withheld
    • Expands each to its channel-day: 171 channel-days, 7,480 messages
    • Renders RSMF with a PDF of each thread, edits and deletions as metadata
    • Numbers 171 files and holds them until the project manager signs

    eDiscovery project managerProduces in the unit the protocol agreed while review ran on smaller slices, and signs only once the last privilege call is made.

A deleted warning, a softened reason and a missing phone week in one matter

What line-by-line review of the same export would have read without the lines around it, or not at all.

Deleted two minutes after sending

In the ops leads chat, the vice president of operations told the others to keep the subject out of email, then deleted it at 4:21 PM. Restored, it is line 6 of a hot slice.

A reason rewritten six minutes later

The regional dispatch manager first tied the employee's problems to the safety complaint, then edited the line to name Q4. Both versions stay in the slice and travel as metadata.

A week missing from one phone

A terminal manager's iPhone holds nothing for a week inside the complaint-to-termination window: the device was replaced and the old one was not imaged.

An unsent text naming the hotline

A dispatch manager typed a line about the hotline report and did not send it. Restored from the phone extraction, it is why slice S-2152 is coded hot.

Around the review

Six more Slack eDiscovery screens behind the coded slices

What the export showed, what the agents cite, and the rules the manager approved.

The chat as exportedBefore the restore, line 6 reads only as deleted and line 9 carries a bare edited mark. This is what a line-by-line review gets.
The record behind a restored lineEach cited line opens the export record it was drawn from: sender, time sent, the deleted flag and time, and the original text.
Hot slices onlyFiltered to hot: a direct-message slice where one line was deleted 35 minutes after sending, ending when the talk moves to a call.
A slice bounded by counselS-2041 starts at 1:15 PM when in-house counsel joins the channel and ends when counsel leaves. Proposed privileged; the attorney decided to withhold it.
One slice's historyLoad, rebuild, identity match, slice rules, proposals and assignment, each with the person or agent behind it. A change adds a line; nothing is overwritten.
Rules the manager approvesA 45-minute silence ends a slice, 60 messages at most, and a reply stays with its question. The production unit follows the protocol: 24 hours.

Slack and Teams exports, phone extractions and the protocol's agreed unit

The records each agent works from, and what each one holds.

Slack enterprise exportsChannels and direct messages, 41 in this matter, with their edit and deletion history.
Teams exports with edit historyChats and channel posts, each edited message with all its versions.
Phone extractionsiMessage and text messages from company phones, unsent drafts included.
RSMF filesShort-message files read as threads, and the format each produced channel-day goes out in.
The ESI protocolThe agreed production unit and format for chat, which the packager expands each produced slice to.
Issues and agreed search termsRetaliation timing, safety complaint and the matter's other issues, with the terms the parties agreed.

A reviewer codes, an attorney decides privilege, the manager signs the volume

The agents rebuild, match, propose and package. These people decide.

Litigation support analyst
Sees
Each export load, the custodian map and the handles the agents matched
Signs
Confirms each identity match before two handles count as one person
Contract reviewer
Sees
The replay, the proposed bracket and the agents' cited reasons
Signs
Codes each slice as one unit: not relevant, relevant or hot
Second reviewer
Sees
Each slice another reviewer coded hot
Signs
Reads it again before it counts as hot
Privilege attorney
Sees
Counsel in the chat, the advice asked for and the proposed redaction spans
Signs
Withholds or redacts each slice, and signs the privilege log
eDiscovery project manager
Sees
The slice rules, gaps raised as preservation questions, progress and the packaged volume
Signs
Approves the slice rules and signs each production

Slices, deletions and privilege: Slack eDiscovery questions

What is Slack eDiscovery?

Slack eDiscovery is the collection, review and production of Slack messages in a legal matter. This solution also reads Teams chats and phone texts: it rebuilds each conversation, restores edits and deletions, proposes slices worth reading, and lets a reviewer code each slice as one decision while an attorney decides privilege.

How does it decide where a conversation slice starts and ends?

It follows the slice rules the project manager approves for the matter: a long silence or a change of topic starts a new slice, a slice has a set maximum length, and a reply stays with its question. Each slice carries its reason in words, and the reviewer can move either end one message at a time.

Does it show deleted and edited Teams messages?

Yes. Where the export or the phone extraction keeps the history, it puts each deleted or edited message back in place with its original text and the time it changed. Reviewers see both versions, and the production carries them as metadata.

Can we produce chat in the unit our ESI protocol requires?

Yes. Review runs on slices, and the packager expands each produced slice to the agreed unit, such as the channel-day around a responsive message, then renders RSMF with a PDF of each thread. Nothing is released until the project manager signs.

Who decides privilege on chats with in-house counsel?

An attorney. The agents flag counsel in the conversation and any request for legal advice, and propose a basis and redaction spans. The privilege attorney withholds or redacts each slice and signs the log.

Do the chats leave the firm or train a model?

No. Each collection sits in the matter's workspace at the firm, and no model is built or tuned from its messages.

Put the deleted lines back
in a chat you already produced.

We’ll rebuild that chat’s threads, propose its slices and show your team the deleted lines, on a collection your reviewers already know.