For most of eDiscovery's history, the center of gravity was email: discrete messages, with attachments, that could be collected and produced in well-understood ways. Collaboration platforms broke that model. Microsoft 365, Teams, and Slack generate conversational, continuously edited, deeply interlinked data — and treating it like email is how collections go wrong.

Why collaboration data is different

Three characteristics make modern sources challenging:

  • Conversation, not documents. A Teams channel or Slack thread is a continuous stream, not a set of discrete files. Where does a "document" begin and end? How much surrounding context is needed to make a message intelligible?
  • Living content. A document in OneDrive, SharePoint, or Google Drive may have rich version history, simultaneous editors, and comments. A message in chat can be edited or deleted after the fact. The state of the data at collection time matters.
  • Links instead of attachments. Modern messages frequently share a link to a cloud-hosted file rather than attaching a copy. Collecting the message without resolving the linked file — sometimes called a "modern attachment" or cloud attachment — can produce an incomplete record.
The core risk

Collecting collaboration data with email-era assumptions tends to produce two opposite failures at once: over-collection of irrelevant chatter that inflates review cost, and under-collection of the context, edits, and linked files that make the relevant content meaningful.

Preserve before you collect

Collaboration platforms have short and configurable retention, and some content is ephemeral by default. That makes preservation the urgent first move. Each platform has native legal-hold and retention controls, and using them correctly — rather than relying on custodians to "not delete anything" — is what actually stops the clock. The preservation step should be part of your hold workflow, routed to the administrators who control these settings.

A source-by-source approach

Defensible collection means pre-deciding the method for each source rather than improvising per matter.

Microsoft 365 (Exchange, SharePoint, OneDrive)

  • Decide how mailbox, site, and drive content will be preserved and exported, and how metadata is retained.
  • Account for version history on documents and for content that lives in shared, not personal, locations.

Microsoft Teams

  • Recognize that Teams content is distributed: chat messages, channel posts, shared files, and meeting artifacts live in different underlying stores.
  • Plan for how threads and reactions are captured so the conversation reads faithfully in review and production.

Slack

  • Understand that export capabilities and retention behavior depend on the workspace plan and configuration.
  • Decide how channels, direct messages, threads, edits, and shared files will be scoped and rendered.

Render it so it is usable — and agree on format early

Even a perfect collection fails if the output is unintelligible. Threaded conversations, reactions, edits, and links need to be rendered in a form that is both faithful to the original and usable by reviewers and the receiving party. This is exactly why production format for modern sources belongs on the Rule 26(f) agenda: agreeing up front on how chat data will be produced avoids expensive re-productions and motion practice later.

Scope with proportionality in mind

The sheer volume of collaboration data makes proportionality essential. Not every channel and every reaction is relevant, and Rule 26(b)(1) supports scoping collection to what the case actually needs. The goal is a targeted, defensible collection — narrow enough to be proportional, complete enough that nothing material is missed, and documented enough that the methodology itself withstands scrutiny.

If your current collection procedures were written for an email world, they are almost certainly out of date for the platforms your organization runs today. A source-by-source review of how you would actually collect each one is the fastest way to find the gaps before a matter does.