Evidence Checklist: What to Save Before Reporting
Preserving evidence correctly before and during a report can make a significant difference to any subsequent investigation. Whether you are reporting online grooming, cyberbullying, harmful content, or exploitation, the same core principles apply: capture it, preserve it, and do not destroy it. This universal checklist applies to all online reporting scenarios.
Immediate danger — call 999
If a child is in immediate danger, call 999 first. Collect evidence after the child is safe.
What to report
- •Screenshots of all relevant messages, posts, and profile information
- •URLs and usernames of accounts involved in the harmful behaviour
- •Dates and times of all incidents
- •Any threats, demands, or inappropriate content received
- •Names of witnesses or other affected children
How to report
Taking effective screenshots
When to use
Before reporting to any platform, as platforms may remove content once a report is made
How to contact
On most devices: hold the power and volume-down buttons simultaneously (Android/iPhone), or use the Windows Snipping Tool / Mac Command+Shift+4. Ensure the screenshot includes the account name, timestamp, and full message content.
What to expect
Good screenshots capture: the sender's username, the date and time of the message, and the complete content without cropping. If the content is a video, record your screen playing it.
Preserving URL evidence
When to use
When reporting online content — the URL is often the most important piece of evidence
How to contact
Copy the full URL from the browser address bar (not just the domain). For social media posts, use 'Copy link to post' from the platform's share menu. Paste into a document with the date you saved it.
What to expect
URLs can change or break, so save them immediately. Where possible, use a web archiving tool such as web.archive.org to create a permanent snapshot of the page.
Creating a written evidence log
When to use
Throughout any safeguarding situation — start the log as soon as you become concerned
How to contact
Keep a written record (paper or digital) noting: date and time of each incident, what you observed or were told, any action you took, and the response. Use exact words where possible rather than paraphrasing.
What to expect
A consistent, dated log is powerful evidence in any investigation. Note down your observations as close to the time as possible, while your memory is fresh.
Evidence checklist
Gather this information before or during your report. Do not delay reporting while collecting evidence — but preserve what you can.
- Screenshots of all messages, posts, and content — taken before blocking or reporting
- Full URLs of profile pages and content locations
- Usernames and display names of all relevant accounts
- Dates and times of first and most recent incidents
- Any images, videos, or files received — do not open or share them if potentially illegal
- Written log of your own observations, what the child has said, and steps you have taken
- Platform report reference numbers and dates
What to say
You do not need to use a script, but this template may help if you are nervous about making the call. Adapt it to your circumstances.
"I have preserved the following evidence before making this report: screenshots of [number] messages including profile name and timestamps; the URL [URL]; the username [username]; a written log of events from [date] to [date]. I have not deleted any of the original content. I am happy to share this evidence with the investigating officer or agency."
What happens next
Well-preserved evidence greatly improves the speed and outcome of investigations. CEOP, police, and children's services will ask for evidence as part of their assessment. If you have a written log and screenshots ready, the initial report process will be smoother and more effective.
What not to do
- ✗Do not delete messages, posts, or files even if they are distressing — these are evidence
- ✗Do not forward illegal content (such as CSAM) to others — this is itself an offence; instead, report the URL
- ✗Do not allow the child to use the device until screenshots have been taken
- ✗Do not post screenshots publicly on social media — this can compromise investigations
- ✗Do not assume the platform will preserve the evidence for you after you report it
Frequently asked questions
The content has already been deleted — can anything still be done?
Yes. Police and platforms can often recover deleted content through back-end systems. Your written description of what you saw, combined with any screenshots taken before deletion, is still valuable. Report what you can and explain that the content has been deleted.
Should I show the screenshots to the child?
Generally no — showing a child upsetting screenshots can retraumatise them. The screenshots are for reporting purposes. Keep them secure and share only with the relevant authorities.
Sources and further information
- CEOP — How to Report — NCA / CEOP
- IWF — Reporting Advice — Internet Watch Foundation
This guidance is for informational purposes. It is not a substitute for emergency services or professional safeguarding support. If a child is in immediate danger, call 999 (UK) or 911 (US) now.
Was this page helpful?
Last reviewed: 2026-04-19. This page provides general educational information, not legal or professional safeguarding advice. UK helplines and legislation may change — verify current details with the relevant organisation.