Field guide
Preserving evidence: a guide for families
What to save, what never to save, and how to keep a clean log so police and NCMEC can act on what you found.
What to capture
- Usernames and display names of the account
- Profile links (URLs)
- Phone numbers and email addresses
- Payment handles, wallet addresses, or gift-card details if money was demanded
- The text of messages and threats (screenshot the words)
- Dates and times, and which app or game it happened in
What never to capture or send
Never
- Never open, copy, forward, upload or screenshot sexual images or video of a minor, even to show police. Possessing or sharing them can be a crime.
- Don’t reply to or negotiate with the person.
If an image exists, give the account details to NCMEC or police. They can get the material from the platform lawfully.
Name it, store it, log it
- Make one folder, for example ‘Incident 2026-11-14’, on a device your child cannot lose.
- Name files with date and short label: 2026-11-14_threat-message.png.
- Keep one running log (template below). Add to it every time something happens.
- Keep devices powered and untouched. Do not factory reset, and do not delete the accounts involved.
| Date / time | What happened | Where (app / account) | Saved as | Who I told |
|---|---|---|---|---|
Hand it off
- Report to the NCMEC CyberTipline: report.cybertip.org or 1-800-843-5678.
- Give your log and folder to local police.
- Use Take It Down (takeitdown.ncmec.org) for images of anyone under 18, StopNCII.org for adults.
Awareness Is Prevention is a prevention and education nonprofit, not a crisis line, law firm or law enforcement agency. This is general guidance, not legal or medical advice. In an emergency call 911.
Related
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.