About SMF Data

Short message format (SMF) data represents relatively brief messages in channels such as texts (SMS), chats, instant messaging, and so on. SMF data can be imported, searched and analyzed, and exported or promoted to a review platform using the same tools applied to standard data.

Importing SMF Data into Reef ECA

A pure SMF data set contains only Cellebrite or Slack data and is imported using the New Data Set for Short Message Format import option. A mixed data set that contains both standard and SMF data, such as one that includes both MS Outlook emails and MS Teams messages, is parsed as such during standard import using the New Data Set option. All SMF data items are described by both SMF-specific metadata fields and standard fields, as noted in the metadata list and below.

RSMF

Relativity Short Message Format (RSMF) is a standardized file format used to bundle SMF data in a review-ready format. Each RSMF file is a ZIP file that contains a JSON manifest file with details about the messages, participants, and conversations, plus any attachments or other files associated with the messages.

By default, Reef ECA imports each RSMF file as a single file and (based on the JSON metadata embedded in the file) associates it with metadata describing its contents, but does not extract the messages from the file as separate items. When the Split Individual RSMF Messages option is selected in the project index settings, however, each RSMF file is split into an RSMF parent file and a series of individual child EML files that were embedded in it.

Once imported, each RSMF file can be exported as a review-ready RSMF file, or (when split) as an RSMF family including the individual embedded EML files and their native attachments.

Slack data is also exported as review-ready RSMF files representing individual messages.

SMF Data Formats

SMF data formats ingested, processed, and exported by Reef ECA are described in the following sections.

Cellebrite

A Cellebrite phone dump is a complete copy of a smartphone's file system or a portion of it, extracted using Cellebrite's forensic tools, and every item within the data is in short message format. Each dump contains a Cellebrite.xml file which provides information about the extracted data in a structured, machine-readable format and is assigned a filetype metadata field value of Cellebrite iPhone Backup. Processing of the XML file yields the following as individual items in the data set, each in its own file, either an EML (.eml) or numbered CSV (.csv) file, depending on the item type:

  • EML file

  • Instant message

  • Chat message

  • Calendar entry

  • File

  • Email

  • CSV file

  • Activity sensor data

  • Call

  • Contact

  • Cookie

  • Device connectivity

  • Installed application

  • Location

  • LogEntry

  • Note

  • Notification

  • Password

  • Searched item

  • Social media

  • User account

  • Voicemail

  • Visited page

  • Web bookmark

  • WirelessNetwork

The contents of each file is described in the smf_datatype metadata field, for example Cellebrite_InstantMessage or Cellebrite_call. You can review the EML and CSV files and their metadata values in the Document Viewer. Applicable metadata fields include both standard fields and SMF-specific fields. For example, an EML file is described by the following standard fields and values, among many others:

  • filetype (email)

  • auxfiletype (eml)

  • msgsource (Cellebrite)

  • msgclass (email)

  • docclass (Message)

In addition it is described by relevant SMF fields, always including smf_datatype but also others that vary depending on the file's contents, for example smf_chatid or smf_source_application. The SMF-specific fields also include export-only fields such as SMF_DeletionDate. Standard fields also include import fields that apply to Cellebrite (for example, isattach) and email-related fields supplying unique values, such as cc_name.

Slack

Slack is a cloud-based team communication platform. Chat data exported from Slack is bundled in a ZIP file that must be extracted before Reef ECA can import the data.

When you import a Slack export, Reef ECA converts data into review-ready messages while preserving key context including:

  • Who sent each message

  • Which channel it belongs to

  • How each message relates to threads and replies

  • Which files or links were shared

The extracted contents of a Slack export are as follows:

  • Top-level, workspace-wide JSON and reference files including:

    • Channels list, for example channels.json -- Each channel represents a single chat conversation.

    • Users list, for example users.json -- Includes all of the participants in all of the included channels.

    • Optional objects such as images and emojis.

  • Channel-level message JSON files, often nested by date, for example channel-name/YYYY-MM-DD.jlaon.

  • Modern/linked attachment artifacts (depending on export type), consisting of URLs referencing files including Slack files, external links, cloud documents, and so on.

Caution: To avoid cross-workspace collisions in channel/user mapping and report generation, Reef ECA can import and process only one Slack export at a time.

When you use the New Data Set for Short Message Format option and specify a folder containing extracted Slack data, Slack messages are processed into RSMF (Rich Short Message Format) records so they can be searched, reviewed, and exported consistently alongside other SMF data. Processing involves the following steps:

  1. Process top-level JSON files to build context, including mapping channel IDs and names to canonical channel identifiers and user IDs to display names, handles, email addresses (when available).

  2. Convert channel-level message JSON files to RSMF messages, normalizing timestamps, user names, channel names, event collection IDs, and other pertinent channel-related metadata.

  3. Parse and generate user report and channel report outputs, validating counts, missing users, unknown channels, and attachment/link statistics.

  4. Parse and populate smf_user_name, a structured metadata attribute that stores the display name or unique identifier of the Slack user associated with a specific channel, message, action, or event, enabling attribution, search, filtering, and auditing across Slack data.

  5. Fetch or collect linked files identified by the modernattachmentlinks field, attaching or relating them to the correct parent message/container and establishing the family relationships.

When viewing the Reports tab for a Slack Data Set, you can click the Generate Data Set Report button to download a Microsoft Excel spreadsheet providing a detailed report on all of the channels and users in the top-level channels.json and users.json files as well as some message-level information (such as the number of messages in each channel).

Processed Slack data exported from Reef ECA consists of the channel-level RSMF message files created in step 2 above, with all required metadata.

As noted above, the display name or unique identifier of the Slack user associated with a specific channel, message, action or event is stored in the smf_user_name metadata field, which is used for Slack data sets only. The value of smf_user_name defaults to that of the from_name standard metadata field; if from_name is unavailable, it falls back to the Slack handle, and then to the Slack user ID.

Other applicable metadata fields include both standard fields and SMF-specific fields. For example, a Slack message is described by the following standard fields and values, among many others:

  • msgsource (Slack)

  • msgclass (email)

  • docclass (Message)

  • modernattchmentlinks (links to the message's attachments stored in Microsoft OneDrive and SharePoint as well as Google Drive, Docs, and applications such as Gmail, Calendar, and Workspace.

  • auxparsingstatus (a status provided in the Exception Details report, such as modern_attachment_retrieve_warning, which indicates that a Modern Attachment could not be retrieved during processing)

In addition to smf_user_name, SMF-specific fields describing Slack data (as well as other SMF data) include, among others:

  • smf_channel_name — The unique name of a Slack channel.

  • smf_eventCollectionid — The unique ID of a Slack channel.

  • smf_threadcount — The number of messages in a Slack channel.

The SMF-specific fields also include export-only fields such as SMF_ThreadStartTime.

Microsoft Teams

MS Teams messages and emails are often part of a data set that also includes regular emails. For example, a given PST may includes a mix of MS Teams messages and regular emails. MS Teams data can include Microsoft Copilot messages and emails.

When you perform a regular data set import that includes MS Teams data (using the New Data Set option), the MS Teams data is parsed using both SMF-specific metadata fields and standard fields, since MS Teams messages and emails are treated as SMF. These fields include the following:

  • msoutlookmessageclass — The Microsoft Outlook MAPI message class for a given type of data. Values applicable to MS Teams data include the following:

    • IPM.SkypeTeams.Message-- For this value and its subvalues, the msgclass field contains a value of email.

    • IPM.AppointmentSnapshot.SkypeTeams.Meeting (for meetings)

    • IPM.AppointmentSnapshot.SkypeTeams.Call (for calls)

    • IPM.Note.Microsoft.Conversation (for chats and channels)

    • For Copilot messages within Teams, subvalues include

      • IPM.SkypeTeams.Message.Copilot.Outlook

      • IPM.SkypeTeams.Message.Copilot.Webchat

      • IPM.SkypeTeams.Message.Copilot.Word

  • smf_channel_name — The name of an SMF channel.

  • smf_chatid — The unique value identifying an SMF item.

  • smf_datatype — The data type or format of an MS teams item, such as Teams_Chat or Teams_Meeting.

  • smf_message_body — The body of an MS Teams message (that is, the actual text without any header values).

  • extendedproperties — The value of PidLidRecurring for a recurring MS Teams item.

Microsoft Yammer (Microsoft Viva Engage) communications are often included in Microsoft Purview data collections. Reef ECA treats MS Yammer messages as Short Message Format (SMF) data, so when you import MS Purview data to create a new Data Set, any MS Yammer data present is parsed using SMF-specific metadata fields and standard fields.