workplace harassment / hostile workplace — quick-start

checklist

1. confirm the person reporting is safe — do not ask them to re-read harassing messages while you collect evidence.
2. place a legal hold or retention lock on the relevant slack workspace and teams tenant before anyone edits or deletes threads.
3. export the full slack workspace export (json + attachments) for every channel and dm in scope — do this before retention purges messages.
4. export teams chat and channel history from the microsoft 365 compliance center — include private chats if your policy permits.
5. save suspicious email threads as .eml files — do not forward (forwarding rewrites headers and breaks threading).
6. preserve any ethics hotline, HR acuity, or internal complaint portal export — submission timestamps and confirmation numbers matter.
7. document every edit or delete event you can see — note who had admin rights to remove messages in slack or teams.
8. collect neutral writing samples from the accused only if authorship is disputed — do not confront anyone before preservation is complete.
9. record the UTC date and time you first learned of each incident — memory fades and platforms purge logs.
10. begin the primary tool path below — slack and teams export analyzers, email thread reconstructor, ethics hotline export analyzer, and writing sample authorship comparator.

primary tools

1. 01slack export analyzerdrop a Slack workspace export ZIP · browse channels · users · messages · DMs · file sharing activity · timeline · export CSV · runs locally
2. 02slack export forensic analyzerdrop slack workspace export zip or individual channel json files · parse all messages files and users · reconstruct conversation threads · surface file sharing deleted message indicators and user activity patterns · runs locally
3. 03microsoft teams export forensic analyzerdrop teams export zip or eDiscovery teams json export · parse messages channels and user activity · reconstruct conversation threads and meeting records · surface file sharing deleted messages and guest access events · runs locally
4. 04slack desktop forensicsdrop slack app data files · parse conversations · channels · users · files · leveldb cache · sqlite databases · runs locally
5. 05microsoft teams forensicsdrop teams app data files · parse messages · channels · users · calls · leveldb sqlite · runs locally
6. 06email thread reconstructordrop multiple .eml files · Message-ID References In-Reply-To tree · missing parent flags · flat timeline · CSV export · runs locally
7. 07email thread reconstructordrop multiple eml files or mbox · reconstruct conversation threads using message-id in-reply-to and references headers · visualize reply chains · surface missing messages in threads and identify thread hijacking · runs locally
8. 08natural language writing sample authorship comparatordrop multiple text files or paste writing samples · compute 40 plus stylometric features · sentence length distribution · vocabulary richness · function word frequencies · punctuation patterns · produce similarity score with confidence intervals between samples · runs locally

go deeper