Preserving Evidence After an Online Incident
A practical, step-by-step guide to capturing and saving digital evidence. Acting quickly and methodically can make a significant difference if you need to report to a platform, school, or the police.
Do not delete anything
Your first instinct may be to delete upsetting messages or images from your child's device. Resist this urge. Deleted content is much harder — sometimes impossible — for investigators to recover. Leave everything in place until you have made copies.
Take screenshots immediately
Screenshot every relevant message, image, post, and profile. Capture the full conversation thread, not just the worst parts — context matters. On phones, press the power button and volume down button together (or use the method for your device). On computers, use the Snipping Tool (Windows) or Shift+Command+3 (Mac).
Capture profile information
Screenshot the other person's profile page, including their username, display name, profile picture, and any bio information. If they have a friends list or follower count visible, capture that too. People often change or delete their profiles after an incident, so speed matters.
Record URLs and usernames
Write down the exact web address (URL) of every relevant page, post, or profile. Note the platform name, the other person's username (including any numbers or special characters), and any group or channel names. This information helps investigators find accounts even if the display name changes.
Note dates and times
For every piece of evidence, record the date and time it occurred and the date and time you captured it. If messages show timestamps, ensure these are visible in your screenshots. If events happened across multiple days, create a simple list showing what happened when.
Save evidence in multiple places
Copy your screenshots to at least two locations: for example, email them to yourself and save them to a USB drive or cloud storage. Label files clearly (e.g. 'screenshot-instagram-dm-2026-03-29-1.png'). If the volume of evidence is large, create a dedicated folder.
Do not confront the other person
It is natural to want to message or confront the person involved, but doing so may cause them to delete their account and destroy evidence. It may also compromise a future investigation. Report through official channels instead.
Report to the platform
Use the platform's built-in reporting tools to report the content or account. Most platforms respond faster to reports that include specific details. Note any reference number you receive — you may need it later.
Important Notes
- If the evidence involves sexual images of a child, do not forward these images to anyone except the police or CEOP. Sharing such images, even to show what happened, could inadvertently constitute a criminal offence.
- If your child is in immediate danger, call 999 before gathering evidence.
- You can report online child exploitation to CEOP at ceop.police.uk/ceop-reporting.
- The Revenge Porn Helpline (0345 6000 459) can help with the removal of intimate images shared without consent.
Quick Checklist
- Screenshots of all relevant messages, images, and profiles taken
- URLs and usernames recorded in writing
- Dates and times noted for every piece of evidence
- Evidence saved in at least two separate locations
- Report submitted to the platform with reference number noted
- Original content left in place on the device (not deleted)