How to preserve digital evidence and report cybercrime
Your step-by-step guide to protecting evidence and getting help
If you're experiencing cyberstalking, sextortion, blackmail, intimate image abuse, online harassment, fraud, or another form of cybercrime, preserving evidence can be important.
Good evidence may help support your report and assist investigators if you decide to report the incident.
You do not need to save explicit images. Instead, preserve evidence of the offender's behaviour, threats, and communications.
1) Capture the criminal’s behaviour
Preserve evidence such as:
Threats, intimidation, or blackmail messages
Demands for money, cryptocurrency, gift cards, or additional images
Usernames, profile names, account IDs, or profile links
Phone numbers and email addresses
Payment details or payment requests
URLs or links sent by the offender (do not click them)
When taking screenshots:
Make sure the username is visible.
Include the full conversation where possible.
Capture the date and time if visible.
Avoid cropping screenshots.
Take multiple screenshots if necessary to preserve context.
Consider recording your screen if you need to demonstrate scrolling conversations or large amounts of content.
Preserving your evidence properly
Screenshots and photographs may contain hidden information called metadata, including:
Date and time created
Device information
File details
Sometimes location information
Note: metadata is easily lost or altered if you don't save files correctly or if you edit the file.
How to view Metadata (date/time stamp) in Your Screenshots
-
Right-click on the image file
Select "Properties"
Click the "Details" tab
-
Right-click on the image file and select "Get Info", OR
Open the image in Preview, then go to Tools → Show Inspector
-
Open the Photos app
Find and tap on your screenshot
Swipe up on the image OR tap the (i) info button
You'll see the date, time, and location (if available).
-
Open the Gallery or Photos app
Find and tap on your screenshot
Tap the three dots menu (⋮) in the corner
Tap "Details" or "Info"
You'll see the date, time, file size, and other information.
Additional protection - photograph the screen: After taking the screenshot, also take a photo of your screen using another device's camera (or ask someone else to do it). This photo should show the full screen including any visible time/date. This creates a second independent record that's harder to dispute.
Once you’ve taken the screenshot:
Never edit, crop, or filter it
Keep it in your Photos/Gallery app untouched
The file contains hidden date/time information (metadata).
To share while preserving the date stamp:
Email it as an attachment
OR connect your phone to computer with USB cable and copy it directly
Don't send via WhatsApp, Facebook Messenger, or text - these strip the metadata.
Critical reminders for preserving evidence
Save as PNG files - PNG format preserves all metadata better than JPEG does.
Keep backup copies of your original files in a safe location
Never upload evidence to social media first - Platforms like Facebook, Instagram, and Twitter automatically remove all metadata when you post images, which destroys this valuable information. You should make sure you keep the original file.
Send evidence directly - If you need to share evidence with authorities or support organisations, send the actual files (via email or secure file transfer) rather than posting them publicly
Keep the integrity of the evidence in tact - avoid editing the screenshot by any means. Actions like cropping or adding filters could impact the metadata.
If you have any questions or concerns following these steps, contact us for personalised, step-by-step guidance.
2) Preserve webpages, profiles, and online content
Online content can be edited, hidden, or deleted very quickly. Where possible, preserve it in multiple ways. Alongside screenshots you can also save the webpage itself.
Save page as HTML
Right-click the page → “Save Page As” → choose Webpage, complete
Print to PDF
Use your browser’s print function and save as a PDF
These formats preserve layout, links, and context better than screenshots alone.
If the criminal sent any links, don't click them — just take screenshots. Make sure you are not downloading or opening unsafe files.
3) Note dates and times
Write down when things happened, when you noticed them (if different) and the impact it had on you.
Timing helps us and the police understand the sequence of events.
4) Store everything in one place
Put all screenshots , notes, and links in one secure folder. This could be through:
PIN-protected USB drive
Online evidence storage accounts like Kulpa Cloud
Online drives like Google Drive, Microsoft OneDrive, or Dropbox
Consider adding a second layer of protection for files stored in OneDrive/Dropbox. This can be done in three ways:
Personal Vault (OneDrive feature with additional authentication)
7-Zip password protection (encrypt files before uploading)
VeraCrypt (encrypted container for sensitive files)
Whatever you choose, ensure that you are the only one with access and that it is password protected.
You may wish to encrypt each folder for extra security. If you are not sure how to do this, feel free to reach out to our team.
Important: Avoid deleting the conversation or your account until advised — this can remove important evidence.
If you are experiencing stalking or ongoing abuse, it is also important not to make changes to your accounts or devices unless it is necessary for your immediate safety. Sudden changes (such as locking accounts, deleting profiles, or resetting devices) can sometimes alert a perpetrator, potentially increasing risk or escalation.
If you believe someone may still have access to your accounts and you are unsure what to do safely, seek specialist support before making changes.
5) Stop communication
If safe to do, stop all communication with the individual causing harm toward you. We understand that this can be a difficult step to take, and if you are not sure how to do this, we are here to help.
6) Report to the police
What is happening may be a criminal offence and can be reported to the police at any time, even if you’re unsure if what is happening is illegal.
If you are in South Africa, you can report cybercrime to the South African Police Service (SAPS) at your nearest police station.
Take:
screenshots,
notes,
usernames,
account information,
payment details,
emails,
phone numbers,
web addresses, and
any other evidence you have preserved.
Request a case number and keep it safe.
If you are in immediate danger:
Call 10111, or
Dial 112 from a mobile phone.
7) Report the criminal’s account to the platform
Report the account on the platform where the contact happened, such as Instagram, Snapchat, WhatsApp, Facebook, or TikTok.
Within the platform, access the menu (three dots) next to the content or profile, select "Report," and choose the category that matches the situation (scam, harassment, impersonation, or extortion).
This helps remove the criminal’s access and protects other users.
Platform specific reporting links
Remember — you're not alone, and support is available right now. Reach out to The Cyber Helpline for free, expert support from cybersecurity professionals. We'll guide you every step of the way.
Donate
Your generosity makes our free support possible. Please consider giving today.
As a not-for-profit, every donation goes straight toward keeping our service free for individuals who were targeted online — donate now and help us reach more people affected by hacking, scams and online abuse.