Skip to content

Add Slack Workspaces and Client Sessions Artifacts for Windows - #67

Open
Gear-I wants to merge 1 commit into
abrignoni:mainfrom
Gear-I:Slack_Desktop_Windows_Applications
Open

Add Slack Workspaces and Client Sessions Artifacts for Windows#67
Gear-I wants to merge 1 commit into
abrignoni:mainfrom
Gear-I:Slack_Desktop_Windows_Applications

Conversation

@Gear-I

@Gear-I Gear-I commented Aug 10, 2026

Copy link
Copy Markdown

Summary

Adds two new artifacts for Slack desktop's Local Storage LevelDB
(Local Storage/leveldb), following the existing Discord/Wire Local
Storage artifact conventions:

  • Slack Workspaces (slackWorkspaces) — parses the localConfig_v2
    key into one row per signed-in workspace: team ID, name, URL,
    per-workspace user ID, most-recently-used and version timestamps,
    last-viewed channel/DM ID, and a masked session token.
  • Slack Client Sessions (slackSessions) — parses
    activitySession_<teamId> keys into a usage timeline: session
    start, last-activity, and last-logged times, plus a computed
    duration.

Local Storage does not hold Slack message content (that lives in
IndexedDB), so these focus on what it does reliably hold: workspace
enumeration and usage/session timing, independent of message content.

Design notes

  • Because Local Storage is a LevelDB, superseded versions of a key
    are preserved on disk. Both artifacts read all recoverable versions
    (not just the live/current one), so a workspace that was later
    removed, or an earlier session, still shows up.
  • Session tokens (xoxc-/xoxb-/xoxp-/xoxs-/xoxr-/xoxd-
    prefixed) are masked to the first 8 and last 4 characters — a full
    token is a live credential, not a normal artifact value.
  • Cosmetic localConfig_v2 fields (theme colors, sidebar gradients)
    are filtered out of the "Other Fields" column; anything else Slack
    stores per-team is preserved there since it varies by client
    version.
  • Both modules are standalone — no shared helper file, no import
    dependencies beyond the existing scripts.chromium.local_storage
    reader already used by Discord/Wire.

Testing

Verified against a real multi-workspace Slack desktop profile
(Slack 4.51.180.0, Windows). Confirmed correct output for 3 real
workspaces and their usage sessions, including token masking and
timestamp conversion from both ISO 8601 and epoch formats. pylint
clean (10/10) on both files, no pylint: disable suppressions.

Sample data

Both artifacts declare a sample_data entry for corpus
slack_win_multiworkspace (Slack 4.51.180.0, Windows):

  • slackWorkspaces: 5 rows
  • slackSessions: 4 rows

Add Slack Client Sessions artifact (Local Storage activitySession_*)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant