Pro plugin

Slack Desktop

Collects workspace metadata, cached messages, authentication tokens, application logs, and user profiles from Slack Desktop local storage

communication.slackPromacOS 10.13+v1.0.0communicationuserenterprise

Run this plugin

Trigger collection for Slack Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin communication.slack --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin communication.slack --dry-run

Compatibility

macOS 10.13+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (7 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

metadata

Artifact	Format	Path	Notes
Slack Workspaces slack_workspacesSensitivehigh value	json	`~/Library/Application Support/Slack/storage/*.json`	Workspace identifiers, team names, domains, and authenticated user metadata.
Slack Profiles slack_profilesSensitivemedium value	json	`~/Library/Application Support/Slack/storage/`	User profile data, workspace configuration, and display preferences.
Slack Raw Files slack_rawOptionalOpt-in	binary	`~/Library/Application Support/Slack/`	Raw application data directory for offline analysis.

messaging

Artifact	Format	Path	Notes
Slack Messages slack_messagesSensitivehigh value	leveldb	`~/Library/Application Support/Slack/IndexedDB/https_app.slack.com_0.indexeddb.leveldb/`	Cached message records including sender, channel, timestamp, and message text from IndexedDB.

credentials

Artifact	Format	Path	Notes
Slack Authentication slack_authSensitivehigh value	sqlite	`~/Library/Application Support/Slack/Cookies` +1 more `~/Library/Application Support/Slack/Local Storage/leveldb/`	Session cookies, OAuth tokens (xoxc-/xoxd-), and workspace authentication material.

media

Artifact	Format	Path	Notes
Slack Cache slack_cacheSensitivemedium value	binary	`~/Library/Application Support/Slack/Cache/Cache_Data/`	Chromium disk cache entries including file uploads, downloads, avatars, and thumbnails.

logs

Artifact	Format	Path	Notes
Slack Logs slack_logsmedium value	text	`~/Library/Application Support/Slack/logs/`	Application logs recording workspace connections, errors, and operational events.