Active Incident? 24/7 Response →
SleuthX

For Attorneys

Slack, Teams and Ephemeral-Messaging Discovery: What's Recoverable

The platforms changed; the duty to preserve did not. What's recoverable from Slack and Teams, and how auto-delete after a duty attached becomes spoliation.

All articles·8 min read·June 23, 2026

The platforms changed; the duty did not

Work moved off email and onto Slack, Teams, and a long tail of messaging apps — some of which are built to make messages disappear. The duty to preserve relevant evidence did not change to keep up. What is recoverable from these platforms, and what happens when it is allowed to vanish, is now a routine discovery fight. This is informational, not legal advice; the recoverability and the risk both depend on the platform, the configuration, and the timing.

What is recoverable from Slack and Teams

Persistent collaboration platforms generally retain messages according to the organization's settings, and that data is discoverable ESI. Whether you can actually get a given thread depends on the retention policy in force, the plan and admin configuration, and whether anyone suspended auto-deletion once a preservation duty attached. The practical move is to identify the platforms and their retention settings early, then preserve before the default policy ages the messages out. The Sedona Conference's Working Group 6 Commentary on Ephemeral Messaging is the leading guidance on how to think about these tools in litigation.

Herzig: auto-delete after the duty attaches

The cautionary holding is Herzig v. Arkansas Foundation for Medical Care. There, the relevant actors switched their communications to an auto-deleting messaging app after the duty to preserve had attached, and the court found that doing so was done in bad faith to keep the messages out of discovery. Read the framing carefully: the court imposed an adverse inference under its inherent authorityon that finding of bad faith — it did not rest the sanction on a Rule 37(e) adverse-inference finding. The distinction matters when you cite it: Herzig is an inherent-authority, bad-faith-spoliation case, not a Rule 37(e) precedent.

Waymo: the recognizable cautionary tale

The episode most people remember is Waymo v. Uber, where evidence emerged that employees used the ephemeral app Wickr for sensitive communications. It is a vivid illustration of how disappearing-message practices draw scrutiny — but treat it as illustrative only. The courtreserved the question of an adverse-inference instruction and let the issue go to the jury rather than issuing a spoliation holding; the case settled. Use Waymo to explain the risk, not as a holding on sanctions.

How sanctions actually arrive

For lost ESI, Rule 37(e) is the usual federal vehicle: it requires that the data should have been preserved, was lost because a party failed to take reasonable steps, and cannot be restored, with the harshest measures reserved for a finding of intent to deprive. Separately, as Herzig shows, a court may reach destruction in bad faith through its inherent authority. Either way, the trigger is the same human failure: letting an auto-delete setting run after the obligation to preserve had already attached.

What this means for your matter

Map the messaging platforms at the first sign of a dispute, get a hold out that names them and their ephemeral features specifically, and turn off auto-deletion for the relevant custodians. The cleanest way to avoid a spoliation argument is to never give the other side the facts that support one — which is also why a defensible e-discovery process for law firms treats ephemeral messaging as a preservation problem to solve on day one.

Sources

  1. Legal Information Institute, Cornell Law School, Federal Rule of Civil Procedure 37 — Failure to Make Disclosures or to Cooperate in Discovery; Sanctions (37(e)). https://www.law.cornell.edu/rules/frcp/rule_37
  2. The Sedona Conference (Working Group 6), Commentary on Ephemeral Messaging (2021). https://www.thesedonaconference.org/publication/Commentary_on_Ephemeral_Messaging
  3. U.S. District Court for the Western District of Arkansas, Herzig v. Arkansas Foundation for Medical Care, Inc., 2019 WL 2870106 (W.D. Ark. 2019). https://www.leagle.com/decision/infdco20190705679
  4. U.S. District Court for the Northern District of California, Waymo LLC v. Uber Technologies, Inc., No. 17-cv-00939 (N.D. Cal. 2017–2018). https://www.casemine.com/judgement/us/5a858705add7b05eb5dc8a88

Related services

Meet Your Practitioner

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 15 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response
Quinnlan Varcoe, Founder & CEO

Ephemeral messaging in discovery: quick answers

Certified Expertise

GIAC · AWS · Splunk · CompTIA

Transparent pricing

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management