Evidence Preservation Basics
The fundamental principles of preserving digital evidence when an incident is reported.
The golden rules of digital evidence
When a device shows evidence of an online safety concern, follow these rules: do not switch the device off, do not close the app or browser, do not delete anything, and do not hand the device to anyone who is not authorised. Take photographs of the screen using a separate device. If the content is at risk of disappearing (such as a temporary message), prioritise capturing it with photos or screenshots before anything else.
Key takeaway
Do not switch off, close, or delete anything — photograph the screen immediately using a separate device.
Screenshots and photographs
Screenshots taken on the device itself are useful but can be questioned as evidence because the device could have been manipulated. Photographs of the screen taken with a separate device provide an additional layer of verification. Capture the full screen including the URL bar, timestamps, usernames, and any visible context. Take multiple photos to ensure clarity.
Key takeaway
Photograph the screen with a separate device as well as taking screenshots — this provides stronger evidence than screenshots alone.