Blog >> Slcak for Windows

Investigating Slack for Windows

28/09/2022 Wednesday

Slack is a cross-platform productivity and communication app utilized by individuals and enterprises. Users can share messages, documents, and images on Slack “Channels,” and each channel is part of Slack “Workspace.” Enterprises can manage and track teams by creating different workspaces. Teams can develop project-based channels and track the progress of the projects using Slack. Slack integrates the vast majority of tools and applications, such as Google Drive and Microsoft Teams. These integrational capabilities, versatile configuration options, and central administration make it different from other collaboration tools.

Digital Forensics Value of Slack Artifacts

Slack is very popular among enterprises. According to their website, Slack is used by more than 750,000 businesses, which makes it an essential source of evidentiary information. By analyzing Slack artifacts, we can collect valuable details related to the users, like users' info, workspaces, downloaded images, etc.

Location of Slack Artifacts

In windows, Slack artifacts are located at

Analyzing Slack Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Slack artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Slack artifacts:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the Proton VPN artifacts in ArtiFast.

Slack Cache: This artifact contains information about all the cache files saved by Slack.

Slack Downloads: This artifact contains information about images downloaded by the users.

Slack Information: This artifact contains general information about the app.

Slack Users: This artifact contains information related to the users.

Slack Workspaces: This artifact contains information about the user's workspaces.

Slack Cache Image: This artifact contains information about all the cache Images saved by Slack.

For more information or suggestions please contact: [email protected]