Finding Edits to SLACK Messages in JSON Files

A recent webinar by Casey Sullivan of Logikull, The Lawyer’s Guide to Discovery and Investigations in Slack, pointed out how complex and difficult to review data exported from SLACK in JSON files is. The data in a JSON file will be in the below format, as shown in this posted on the SLACK help center,

It's important to note that a SLACK message can be edited. If a message has been edited, the exported JSON data will show the name of the user that edited a message, and the time the editing took place in the 'ts' field. See the bold-faced lines in the below example.

{

"type": "message",

"user": "UTXHL6F8A",

"upload": false,

"ts": "1590101612.000000",

"text": "Hello, this is the message after it was edited.",

"previous": {

"text": "Hello, this is the original message.",

"blocks": [

{

"type": "rich_text",

"block_id": "Bts",

"elements": [

{

"type": "rich_text_section",

"elements": [

{

"type": "text",

"text": "Hello, this is the original message."

}

]

}

]

}

]

},

"original_ts": "1590101603.000300",

"subtype": "message_changed",

"editor_id": "UTXHL6F8A",

"blocks": [

{

"type": "rich_text",

"block_id": "O+PJ",

"elements": [

{

"type": "rich_text_section",

"elements": [

{

"type": "text",

"text": "Hello, this is the message after it was edited."

}

]

}

]

}

]

}