How to collect harassment evidence

Safety comes before a complete record

If there is immediate danger in the United States, call 911. If you are elsewhere, contact the appropriate local emergency service. You do not need to finish a timeline or decide whether a specific law applies before asking for help. The U.S. Department of Justice advises contacting local police to report stalking-related incidents or threats and points readers to victim-support resources. [2]

Think about who can access the device and accounts used for documentation. A shared computer, a monitored account or a cloud folder visible to someone else can make a well-intended record unsafe. If you suspect monitoring, seek assistance from a victim advocate using a safer device before changing settings or moving evidence. Do not confront someone or continue a conversation merely to obtain a stronger screenshot.

Documentation can also be exhausting. PEN America recommends considering help from a trusted person. Agree what that person may access, how they will store the files and what they should do if they see an urgent threat. Use permitted access methods rather than sharing passwords where platform rules prohibit it. Taking breaks is compatible with keeping a useful record. [1]

Decide what you are trying to preserve

Start with the material you can lawfully and safely access: posts, replies, direct messages, emails, voicemails, images and relevant reports to the platform. Preserve the visible account name, handle or identifier, the specific link where available and enough surrounding conversation to explain what happened. A display name alone can change or be copied; do not treat it as verified personal identity.

Include your own relevant replies, even if you wish you had responded differently. PEN America's guidance emphasizes retaining the full relevant exchange instead of only material that puts you in a favorable light. The purpose is an understandable record, not a polished argument. You do not need to have reacted perfectly to deserve support. [1]

Do not seek access to private accounts, bypass restrictions or impersonate someone to collect more. A missing source can be recorded as a gap. If you encounter suspected child sexual abuse material, do not download or redistribute it to build your file; seek reporting guidance from the platform and appropriate authorities. Preservation should not create further harm or unlawful possession.

Capture the source and the context together

Take a readable capture that shows the content and its context, then retain the source link separately. For a long conversation, capture the relevant sequence rather than a fragment that removes the exchange around it. If you make a screen recording, explain what it shows and retain the original recording. Avoid adding overlays or edits to the only copy of the source.

Record both the time shown by the platform and the time you collected the material. If one is relative, such as yesterday or a number of hours ago, write down exactly what appeared and when you observed it. Do not convert a vague display into a precise time without a basis. Include a time-zone label when you know it and mark uncertainty when you do not.

Retain original downloads when you can obtain them lawfully. An email saved with its headers can contain context that a screenshot lacks. Forwarded text or a copied quote is not the same as the original message. Keep attachments linked to their parent message and note anything you could not open. These collection suggestions follow PEN America's emphasis on messages, links, timing and a documentation log. [1]

Create an incident log you can maintain

Use a simple document or spreadsheet if that is what you have. Give each incident a stable identifier and record the date, time, platform, account, source link, brief description and the filenames of supporting material. Add who collected it and when. Keep the entry factual enough that someone unfamiliar with the situation can follow it.

Separate the event from its effect. One field can record what was posted; another can record how it affected your safety, work or daily routine. Use your own words and do not feel obliged to share unnecessary medical or personal details in every report. If the event is part of a longer pattern, link it to the earlier entry rather than duplicating the whole story.

Record platform reports and other handoffs too. Keep confirmation messages, reference numbers and the date of a response or removal if known. A removed post may no longer be reachable, but your log can still explain when it was visible and when you observed its disappearance. Do not imply that deletion proves guilt or that a tool can always recover material that is gone.

Report through the platform without losing your place

Platform reporting and evidence preservation have different purposes. A report asks a service to review a policy violation; your retained record helps you explain what happened later. If it is safe, preserve the relevant material before reporting or blocking because content and access can change. Do not delay a protective step solely to finish collection. Keep a note if the material is no longer available.

YouTube's harassment policy covers conduct including threats and doxxing and directs users to report violating content. For a video, retain the link, channel information and relevant playback position along with enough context to explain it. A platform decision is not a court ruling, and a lack of removal is not proof that the conduct is harmless. [5]

Discord's reporting guidance explains reporting individual messages and profiles. Retain a message link and the relevant server or channel context where you can access it lawfully. It also cautions against misleading or coordinated mass reports. Bluesky's terms direct users to in-app reporting tools or its feedback form. Interface wording changes; follow the current official instructions rather than an old screenshot of a menu. [6] [7]

For X, preserve the specific post or message link and relevant account details, then use the service's current reporting controls. This guide does not reproduce a step-by-step X interface because its official reporting page could not be verified during preparation. Do not give your login credentials to a third-party service solely to submit a report.

Keep originals, working copies and sharing copies separate

An original collection package should remain unedited. Use a working copy for highlights, notes and organization. If a recipient needs redactions, create a separate version and label what was redacted and why without overwriting the original. Avoid renaming or converting files without retaining a mapping to the original item identifier.

Store the archive somewhere you control, with access appropriate to its sensitivity. Consider a protected backup and a safe recovery plan. Encryption can help protect stored files, but does not stop someone who already has access to an unlocked device or a shared account. A backup that silently syncs to an unsafe account may undermine the protection you intended.

Keep a transfer log: who received a copy, what was included, the date and the method. Share the minimum appropriate package for the task, not a public link to the entire archive. If litigation is underway or reasonably anticipated, ask counsel about preservation duties before deleting relevant material, including duplicates or uncomfortable context.

Prepare a handoff that a person can review

Begin with a short summary of the pattern, the most urgent concern and the assistance you are requesting. Follow with a chronological incident list and a source index. Identify the clearest supporting items so a reviewer can inspect them without opening dozens of unrelated files. Keep allegations distinct from established facts and mark uncertain account attribution.

A platform may need a small number of specific links. An employer or advocate may need a summary and selected examples. Counsel or law enforcement may request a different package. Ask about the recipient's preferred method and format before transmitting sensitive files. Preserve what you sent so you can identify the version later.

You can tell a reviewer where the record is incomplete. If a post disappeared before collection, record what you remember as a recollection, not as a recovered quote. If a friend witnessed something, identify it as their observation. Honest limits help a reviewer assess the material and decide what additional information or legal process may be needed.

Understand the limits of evidence software

Pilotlight is local, encrypted casefile and evidence-preservation software that turns online harassment into a timestamped, statute-mapped case file. Its product page describes macOS on Apple Silicon, an encrypted vault and capture from X, Bluesky, YouTube and Discord. It may be worth evaluating when a manual log becomes difficult to maintain, but you do not need it to start documenting or seek help. [8]

Product-described analysis, coordination indicators and legal drafts are not legal findings. Check every material claim against the underlying sources. The local vault claim also needs a separate data-flow check: the application asks for your own model API keys. Confirm external processing and retention before enabling features with sensitive material. A 14-day trial is advertised; the $300/month per-state price refers to a law-firm partner listing, not a verified individual license.

No preservation product guarantees admissibility. Federal Rule of Evidence 901 addresses authentication, and Rule 902 provides procedures for certain certified electronic records or copies. Other rules, including relevance and hearsay, may still matter. Local law differs. This guide is general information, has not been reviewed by an attorney and is not legal advice. Contact a qualified attorney or law enforcement for your situation. [3] [4]