How to preserve digital evidence and report cybercrime
Your step-by-step guide to protecting evidence and getting help
If you’re experiencing cyberstalking, sextortion, blackmail, intimate image abuse, online harassment, fraud or other types of cybercrime and online harm, one of the most important things you can do right now is preserve evidence.
This helps us support you and gives law enforcement the information they need if you choose to report the crime.
You do not need to save any explicit images — only capture the criminal’s behaviour.
1) Capture the criminal’s behaviour
Capture evidence of:
Threats or blackmail messages
Demands for money or more images
Their profile, username, or account details
Phone numbers and email addresses
Payment instructions or links
When taking screenshots:
Make sure the username, full message and date/time are visible if possible
Avoid cropping
Take multiple screenshots if needed to show context
Consider screenrecording in addition to screenshots, especially when documenting large amounts of material or demonstrating to authorities how you discovered the content.
Preserving your evidence properly
Screenshots and photos can contain more information than what's visible on screen. They store hidden data called "metadata" - details like when the image was created, what device captured it, and sometimes even location information. This metadata can help prove when and how you collected evidence, making it more credible to authorities.
Note: metadata is easily lost or altered if you don't save files correctly or if you edit the file.
How to view Metadata (date/time stamp) in Your Screenshots
-
Right-click on the image file
Select "Properties"
Click the "Details" tab
-
Right-click on the image file and select "Get Info", OR
Open the image in Preview, then go to Tools → Show Inspector
-
Open the Photos app
Find and tap on your screenshot
Swipe up on the image OR tap the (i) info button
You'll see the date, time, and location (if available).
-
Open the Gallery or Photos app
Find and tap on your screenshot
Tap the three dots menu (⋮) in the corner
Tap "Details" or "Info"
You'll see the date, time, file size, and other information.
Additional protection - photograph the screen: After taking the screenshot, also take a photo of your screen using another device's camera (or ask someone else to do it). This photo should show the full screen including any visible time/date. This creates a second independent record that's harder to dispute.
Once you’ve taken the screenshot:
Never edit, crop, or filter it
Keep it in your Photos/Gallery app untouched
The file contains hidden date/time information (metadata).
To share while preserving the date stamp:
Email it as an attachment
OR connect your phone to computer with USB cable and copy it directly
Don't send via WhatsApp, Facebook Messenger, or text - these strip the metadata.
Critical reminders for preserving evidence
Save as PNG files - PNG format preserves all metadata better than JPEG does.
Keep backup copies of your original files in a safe location
Never upload evidence to social media first - Platforms like Facebook, Instagram, and Twitter automatically remove all metadata when you post images, which destroys this valuable information. You should make sure you keep the original file.
Send evidence directly - If you need to share evidence with authorities or support organisations, send the actual files (via email or secure file transfer) rather than posting them publicly
Keep the integrity of the evidence in tact - avoid editing the screenshot by any means. Actions like cropping or adding filters could impact the metadata.
If you have any questions or concerns following these steps, contact us for personalised, step-by-step guidance.
2) Preserve webpages, profiles, and online content
Online content can be edited, hidden, or deleted very quickly. Where possible, preserve it in multiple ways. Alongside screenshots you can also save the webpage itself.
Save page as HTML
Right-click the page → “Save Page As” → choose Webpage, complete
Print to PDF
Use your browser’s print function and save as a PDF
These formats preserve layout, links, and context better than screenshots alone.
If the criminal sent any links, don't click them — just take screenshots. Make sure you are not downloading or opening unsafe files.
3) Note dates and times
Write down when things happened, when you noticed them (if different) and the impact it had on you.
Timing helps us and the police understand the sequence of events.
4) Store everything in one place
Put all screenshots , notes, and links in one secure folder. This could be through:
PIN-protected USB drive
Online evidence storage accounts like Kulpa Cloud
Online drives like Google Drive, Microsoft OneDrive, or Dropbox
Consider adding a second layer of protection for files stored in OneDrive/Dropbox. This can be done in three ways:
Personal Vault (OneDrive feature with additional authentication)
7-Zip password protection (encrypt files before uploading)
VeraCrypt (encrypted container for sensitive files)
Whatever you choose, ensure that you are the only one with access and that it is password protected.
You may wish to encrypt each folder for extra security. If you are not sure how to do this, feel free to reach out to our team.
Important: Avoid deleting the conversation or your account until advised — this can remove important evidence.
If you are experiencing stalking or ongoing abuse, it is also important not to make changes to your accounts or devices unless it is necessary for your immediate safety. Sudden changes (such as locking accounts, deleting profiles, or resetting devices) can sometimes alert a perpetrator, potentially increasing risk or escalation.
If you believe someone may still have access to your accounts and you are unsure what to do safely, seek specialist support before making changes.
5) Stop communication
If safe to do, stop all communication with the individual causing harm toward you. We understand that this can be a difficult step to take, and if you are not sure how to do this, we are here to help.
6) Report to the police
What is happening may be a criminal offence and can be reported to the police at any time, even if you’re unsure if what is happening is illegal.
If you're in the UK:
Call 101 to speak to your local police
Visit your local police website to report online
Call 999 if you feel in immediate danger
If your situation involves fraud or malware you can report to reportfraud.police.uk
The police do not need to see explicit images — only the evidence of threats, usernames, and messages that you've captured.
If you're under 18, or the criminal is using or threatening to use images of someone under 18, you should also report to:
CEOP (Child Exploitation & Online Protection Command)
Childline: 0800 1111
These services specialise in protecting children and young people from online threats.
7) Report the criminal’s account to the platform
Report the account on the platform where the contact happened, such as Instagram, Snapchat, WhatsApp, Facebook, or TikTok.
Within the platform, access the menu (three dots) next to the content or profile, select "Report," and choose the category that matches the situation (scam, harassment, impersonation, or extortion).
This helps remove the criminal’s access and protects other users.
Platform specific reporting links
8) Consider reaching out to an advocacy service
If you feel that your safety is at risk due to the harms you are experiencing, you may want the support of risk-assessing advocacy teams.
There are different types of advocacy teams dependent on the risks you are navigating.
In the UK, national services include:
Remember — you're not alone, and support is available right now. Reach out to The Cyber Helpline for free, expert support from cybersecurity professionals. We'll guide you every step of the way.
Donate
Your generosity makes our free support possible. Please consider giving today.
As a not-for-profit, every donation goes straight toward keeping our service free for individuals who were targeted online — donate now and help us reach more people affected by hacking, scams and online abuse.