Preserve before you explain
A useful record shows what you received, where it came from and when. Start with material you already possess or are authorised to access. Keep the original email, message thread, document or device available; a pasted quotation alone can lose information that later matters.
If someone is in immediate danger, seek emergency help first. You do not need a completed evidence file before reporting threats to the police. For business cyber incidents, involve the appropriate IT or incident-response contact promptly so preservation can be coordinated with containing the incident.
Keep context alongside the item
For an ordinary message or webpage that you can lawfully view, note the account or page address, displayed date and time, and the date you made your record. Include the surrounding conversation where relevant, rather than selecting only the sentence that supports your concern. Record the displayed time zone if known.
Keep a separate working copy for highlighting or comments. Avoid overwriting the original, renaming everything without a record, or forwarding a long chain as your only retained version. Put observations in a separate note; do not write conclusions into the evidence itself.
Make a simple handover record
An evidence index can be modest: one row for each item, a short neutral description, its source and a note of who currently holds the original. It helps an adviser locate what you mean without opening every file.
- Give items stable references, such as E001 and E002.
- Record any copying, conversion or redaction you make.
- Identify missing attachments or gaps in a message sequence.
- Keep access limited to people who need the material.
Pause before technical work
Do not install recovery software, reset a device or attempt to access another person’s account because it might contain answers. Specialist handling may be needed where deleted data, disputed authenticity or litigation is involved. Avoid uploading case material to public AI or file-conversion services.
Free first step: list your five most relevant items in our evidence-index template. If you cannot preserve an item safely, or need to know what a screenshot can and cannot establish, describe the issue to PDC before sending the files. We can discuss the appropriate next step and transfer method.
Questions you may have
Is a screenshot enough?
It may be useful, but it does not by itself establish authenticity or preserve every part of the original. Retain the underlying message or file where you lawfully can.
Should I send all my files in my first enquiry?
Start with a short description. Agree a suitable transfer method and the necessary material before sending sensitive documents.
Sources & further reading
Check the original sources for their latest information and service terms.