How to Preserve Digital Evidence and Report Cybercrime

Your step-by-step guide to protecting evidence and getting help

If you’re experiencing cyberstalking, sextortion, blackmail, intimate image abuse, online harassment, fraud or other types of cybercrime and online harm, one of the most important things you can do right now is preserve evidence.

This helps us support you and gives law enforcement the information they need if you choose to report the crime.

You do not need to save any explicit images — only capture the criminal’s behaviour.

1. Capture the criminal’s behaviour

Capture evidence of:

• Threats or blackmail messages

• Demands for money or more images

• Their profile, username, or account details

• Phone numbers and email addresses

• Payment instructions or links

When taking screenshots:

• Make sure the username, full message and date/time are visible if possible

• Avoid cropping

• Take multiple screenshots if needed to show context

Consider screen recording in addition to screenshots, especially when documenting large amounts of material or demonstrating to authorities how you discovered the content.

Preserving Your Evidence Properly

Screenshots and photos can contain more information than what's visible on screen. They store hidden data called "metadata" - details like when the image was created, what device captured it, and sometimes even location information. This metadata can help prove when and how you collected evidence, making it more credible to authorities.

How to View Metadata (date/time stamp) in Your Screenshots

Once you’ve taken the screenshot:

• Never edit, crop, or filter it

• Keep it in your Photos/Gallery app untouched

The file contains hidden date/time information (metadata).

To share while preserving the date stamp:

• Email it as an attachment

• OR connect your phone to computer with USB cable and copy it directly

Critical Reminders for Preserving Evidence

• Save as PNG files - PNG format preserves all metadata better than JPEG does.

• Keep backup copies of your original files in a safe location

• Never upload evidence to social media first - Platforms like Facebook, Instagram, and Twitter automatically remove all metadata when you post images, which destroys this valuable information. You should make sure you keep the original file.

• Send evidence directly - If you need to share evidence with authorities or support organisations, send the actual files (via email or secure file transfer) rather than posting them publicly

• Keep the integrity of the evidence in tact - avoid editing the screenshot by any means. Actions like cropping or adding filters could impact the metadata. 

2. Preserve webpages, profiles and online content

Online content can be edited, hidden, or deleted very quickly. Where possible, preserve it in multiple ways. Alongside screenshots you can also save the webpage itself.

• Save page as HTML

• Right-click the page → “Save Page As” → choose Webpage, complete

• Print to PDF

• Use your browser’s print function and save as a PDF

These formats preserve layout, links, and context better than screenshots alone.

3. Note dates and times

Write down when things happened, when you noticed them (if different) and the impact it had on you.

Timing helps us and the police understand the sequence of events.

4. Store everything in one secure place

Put all screenshots , notes, and links in one secure folder. This could be through:

• PIN-protected USB drive

• Online evidence storage accounts like Kulpa Cloud

• Online drives like Google Drive, Microsoft OneDrive, or Dropbox

Consider adding a second layer of protection for files stored in OneDrive/Dropbox. This can be done in three ways:

• Personal Vault (OneDrive feature with additional authentication)

• 7-Zip password protection (encrypt files before uploading)

• VeraCrypt (encrypted container for sensitive files)

Whatever you choose, ensure that you are the only one with access and that it is password protected.

You may wish to encrypt each folder for extra security. If you are not sure how to do this, feel free to reach out to our team.

If you are experiencing stalking or ongoing abuse, it is also important not to make changes to your accounts or devices unless it is necessary for your immediate safety. Sudden changes (such as locking accounts, deleting profiles, or resetting devices) can sometimes alert a perpetrator, potentially increasing risk or escalation.

If you believe someone may still have access to your accounts and you are unsure what to do safely, seek specialist support before making changes. 

5. Stop communication

If safe to do, stop all communication with the individual causing harm toward you. We understand that this can be a difficult step to take, and if you are not sure how to do this, we are here to help.

6. Report to the police

What is happening may be a criminal offence and can be reported to the police at any time, even if you’re unsure if what is happening is illegal.

7. Report the criminal’s account to the platform

Report the account on the platform where the contact happened, such as Instagram, Snapchat, WhatsApp, Facebook, or TikTok.

Within the platform, access the menu (three dots) next to the content or profile, select "Report," and choose the category that matches the situation (scam, harassment, impersonation, or extortion).

This helps remove the criminal’s access and protects other users.

Platform-Specific Reporting Links

8. Consider reaching out to an advocacy service

If you feel that your safety is at risk due to the harms you are experiencing, you may want the support of risk-assessing advocacy teams.
There are different types of advocacy teams dependent on the risks you are navigating. 

In the UK, national services include:

About The Cyber Helpline

The Cyber Helpline is a non-profit organisation dedicated to supporting victims of cybercrime. We help you understand what's happened, contain and recover from the cyber attack, and protect yourself in the future so it doesn't happen again. Our mission is to ensure all individuals have immediate, free access to cyber expertise when they need it.