Add Slack Workspaces and Client Sessions Artifacts for Windows - #67
Open
Gear-I wants to merge 1 commit into
Open
Add Slack Workspaces and Client Sessions Artifacts for Windows#67Gear-I wants to merge 1 commit into
Gear-I wants to merge 1 commit into
Conversation
Add Slack Client Sessions artifact (Local Storage activitySession_*)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two new artifacts for Slack desktop's Local Storage LevelDB
(
Local Storage/leveldb), following the existing Discord/Wire LocalStorage artifact conventions:
slackWorkspaces) — parses thelocalConfig_v2key into one row per signed-in workspace: team ID, name, URL,
per-workspace user ID, most-recently-used and version timestamps,
last-viewed channel/DM ID, and a masked session token.
slackSessions) — parsesactivitySession_<teamId>keys into a usage timeline: sessionstart, last-activity, and last-logged times, plus a computed
duration.
Local Storage does not hold Slack message content (that lives in
IndexedDB), so these focus on what it does reliably hold: workspace
enumeration and usage/session timing, independent of message content.
Design notes
are preserved on disk. Both artifacts read all recoverable versions
(not just the live/current one), so a workspace that was later
removed, or an earlier session, still shows up.
xoxc-/xoxb-/xoxp-/xoxs-/xoxr-/xoxd-prefixed) are masked to the first 8 and last 4 characters — a full
token is a live credential, not a normal artifact value.
localConfig_v2fields (theme colors, sidebar gradients)are filtered out of the "Other Fields" column; anything else Slack
stores per-team is preserved there since it varies by client
version.
dependencies beyond the existing
scripts.chromium.local_storagereader already used by Discord/Wire.
Testing
Verified against a real multi-workspace Slack desktop profile
(Slack 4.51.180.0, Windows). Confirmed correct output for 3 real
workspaces and their usage sessions, including token masking and
timestamp conversion from both ISO 8601 and epoch formats.
pylintclean (10/10) on both files, no
pylint: disablesuppressions.Sample data
Both artifacts declare a
sample_dataentry for corpusslack_win_multiworkspace(Slack 4.51.180.0, Windows):slackWorkspaces: 5 rowsslackSessions: 4 rows