Slack

Overview

Slack is one of the highest-value third-party artifacts in enterprise investigations. The Electron app caches message context, attachments, and metadata locally, and stores long-lived authentication tokens. macfor parses workspaces, cached messages, auth material, cache entries, logs, and profiles. An opt-in raw collection captures the whole Slack data directory, including storage/slack-downloads, for offline analysis.

Analysis Tips

• xoxc- tokens: Long-lived workspace access tokens stored in Local Storage. Combined with the d cookie, they can authenticate against the Slack API outside the desktop app. macfor reports which token types are present but redacts the values
• Workspace enumeration: IndexedDB keys reveal every workspace the user is signed into, including former workspaces still cached
• Cached messages: The IndexedDB messages store often holds days/weeks of conversation history — including DMs and private channels
• Downloads: macfor does not parse storage/slack-downloads. It is captured only in the opt-in raw collection, for review with other tools
• Channel context: users and channels IndexedDB stores let you correlate user IDs to display names without hitting the Slack API

Related Artifacts

• Discord - Same Electron pattern; smaller forensic surface
• Quarantine Events - Confirms when files left Slack and landed on disk
• FSEvents - Corroborates download timestamps with file system activity

References

• Slack desktop architecture overview
• Chromium IndexedDB format