Collecting evidence safely

It’s important to know how to collect evidence safely when you’re experiencing tech-based domestic, family or sexual violence.

Collecting evidence provides proof of what has happened to you. It can include screenshots, recordings and other details about harmful content or behaviour that’s happened online or using digital technology.

Remember that if you’re experiencing abuse, it’s not your fault – you have the right to be believed, and help is available.

On this page:

• Why it’s important to collect evidence
• What evidence to collect
• Ways to collect evidence
• Collecting evidence for criminal charges
• Storing evidence

It’s likely you will need to show some evidence of the abuse you experienced if you decide to report it to the online service or platform, the police or eSafety. It can also be used in court hearings, if you’re seeking a protection order, or for child custody cases.

Even if you don’t feel ready to report it right now, collecting evidence can give you options in the future. It can also help if you think the abuser could delete or remove any evidence you might need later.

Try to record evidence that shows the person responsible for any tech-based abuse.

You should capture details such as:

• the harmful content in messages, comments, images or videos sent to you or shared about you
• the service or platform used to send or share the harmful content
• source information, such as the HTML code and the webpage address or link (URL) where the harmful content appeared
• the usernames of the accounts and URLs of the profiles used to send or share the harmful content
• the dates and times when the harmful content was sent or shared.

You can also collect information that shows:  

• the number of times your abuser has called or messaged you and the profile or number used (even if it’s a private number)
• fake social media accounts created in your name
• tracking or monitoring devices you find in your home or in vehicles
• evidence of monitoring or tracking apps installed on your device/s
• unauthorised logins on your devices or online accounts
• evidence of how children have been used as part of the abuse
• any other information that shows the abuse you are experiencing. 

There are many ways to collect evidence. Some can be safer than others, depending on your situation, so following these tips may help.

You should always use a safe device to collect evidence, especially if you think you may be tracked or monitored. This is a device that allows you to make calls, send messages and go online without the abusive person knowing.

It could be your personal device (if your abuser can’t access the device or any shared accounts you have), the device of a trusted person such as a family member or friend, or a computer at your work or a public library.

Avoid using your safe device to access accounts that are linked or known to the abuser. If you must use a device or account that the abuser might have access to, delete the evidence as soon as you have sent it to a trusted person.

Learn more about using safe devices. 

Take screenshots, photos and recordings

Taking a screenshot or screen recording is one way to save evidence such as abusive text messages, online posts and live text chats, as well as details of the account or profile that was used by the abuser.

Try to save the original evidence, without making any changes to it. For example, avoid highlighting abusive comments within a screenshot or cropping images.

You may need to take multiple screenshots to capture the extent of the abuse. Include the full conversation (rather than the abusive comment on its own), as well as account details, dates and times.

Remember, some apps notify the other person if a screenshot or screen recording is taken, or a file is downloaded or saved. If this is the case, it may be best to take a photo or video of what’s on your screen using another device.

Record the URL and source information

If abusive content is posted of you online, try to capture the URL and the person responsible for the posting, even if the abuser is using a fake account.

The URL is the web address or link where the content is located. You can usually see it in the address bar at the top of the page, if you are using a desktop, laptop or tablet. For example, the URL for this page is esafety.gov.au/key-issues/domestic-family-violence/help-support/collecting-evidence

The URL will help to find the content that has been posted. However, once the content is removed or deleted the URL may no longer be available, which is why taking screenshots or photos is also a good idea.

It can also be helpful to capture source information, such as the HTML (Hypertext Markup Language) code. This will help you to save information in case the content at the URL changes. There are different ways to capture source information – based on the web browser and device you are using. For example, if you’re using Google Chrome on your desktop, you can ‘right click’ on a blank part of the webpage and select ‘view page source’ to display the HTML code. You can then screenshot or copy the information.

Save voice recordings

Try to save or record a copy of any abusive or threatening voice messages. These may be phone voicemails from the abuser, or messages or chats sent using an online platform or service. Some voicemail services only keep saved messages for a few weeks or months, so you may need to download or save them before they are deleted or record the message using a voice recording app or video. It’s a good idea to use another device to record, because the abuser might be notified when you save the message or make a copy.

Take note of repeated behaviours

Tech-based domestic, family and sexual violence can involve repeated and persistent abusive behaviour that is used to control someone. This is known as coercive control. Sometimes it’s the fact that the behaviour is repeated that makes it abusive, because you’re constantly worried about what the person will do next. You should take a note of each incident, no matter how small it is or how many incidents happen, as this can help to show how the impact has grown over time.

Screenshots or photos can also be used to build evidence – for example, to show how often you receive texts or have missed calls from the abusive person’s phone number (even if the number is blocked).

An incident of abuse may appear harmless to someone who doesn’t know the background and context, so it’s helpful to explain in your notes why it’s a problem. For example, if an abuser sent their partner a flame emoji, it might not be obvious to another person that it was a threat – unless they knew the abuser had a history of harming or threatening their partner with fire or burning.

Your notes might also include:

• any threats the abuser makes in person, such as saying they are watching you and can track your every move
• what is said or a description of what is shown in the evidence you collected
• how the evidence is abusive or related to other incidents
• the date and time of the abuse
• times when your device or online access was controlled or limited.

Record the information in a way that works for you. This can include written notes or voice recordings.

Search your details online

If you think personally identifiable information may have been published about you as part of the abuse, you can search your name and details online to check. Make a record of any evidence that you find.

For example, you could use an online search engine like Google to check if your abuser has intentionally shared your private address, personal phone number or any pictures identifying you or where you live without your consent – this is known as ‘doxing’. Find out more about what you can report to eSafety and what to know first, if you find abusive content targeting you online.

You can check reverse phone lookup websites to see if your phone number has been shared online and whether any other real or fake details about you have been included.

You can also try a reverse image search which lets you upload your image to find out if it’s been posted or shared on the internet.

Another way of finding out if your private information has been shared is to create a Google Alert to link you to anything that is posted online about you (or people with your name). The alerts may come at unexpected times, and they might not always relate to you, especially if you have a common name. So it’s good to be prepared for those alerts, to make sure they don’t become triggering or retraumatising.

Download chat logs or account activity

Some online platforms and services allow you to access your information or content and save it. Check if you can download your account activity or request chat logs or transaction logs (records of when messages were delivered). Some phone providers can also give you call logs or text transcripts.

This can help you to document unwanted contact or harassment, including the number of times someone messages or calls (even if the calls are missed or from an unknown number or an unfamiliar name).

If you are experiencing financial abuse, or abusive messages are sent to you via online banking transactions, you can collect your bank statements as evidence. You could also check your credit rating to see if any lines of credit have been taken out in your name and report to your bank if you see suspicious activity.

Note any monitoring or stalking

Tracking devices, spyware, surveillance systems and other ‘smart’ or assistive technologies can be used to monitor and cyberstalk you.

Look for patterns to help identify what sort of device or technology is being used and make notes about when and how it seems to be happening. These are some things to think about:

• If you suspect you are being followed, try to think where it’s happening. For example, is it happening when you’re in your car or wherever you take your phone or bag?
• If you suspect you are being watched, try to think where it’s happening. For example, is it in one particular room in your home where there may be a hidden camera?
• If you share the care of a child, could the abusive person have planted a tracking device in their bag or toy or added a spying app to their phone?
• If you share the care of pets or animals, could the abusive person have planted a tracking device on the pet’s collar or be monitoring you through the pet’s microchip?

Take photos of any tracking devices you find in your home, car or belongings – this is useful if you think it’s safest to leave them in place, so the abuser doesn’t know you have found them.

You can also use these tips:

• If you get an alert on your phone about an unknown device that is travelling with you, take a screenshot or photo of the notice.
• If you find a tracking device (such as an AirTag) on or in your car, on equipment like a pram or sewn into clothing, it may be best to take a photo and leave it in place, then report it to the police when it’s safe to do so. Removing it may alert the abuser.
• If you think spyware has been installed on your device, it may be best to take a photo using a safe device – don’t take a screenshot, because the spyware could detect this. You should speak with the police or seek legal advice before removing it. There are people who can help when you are being tracked. A domestic, family and sexual violence support service can usually advise how to get help.
• If you suspect a home surveillance system or any smart home technologies or assistive technologies may have been accessed or had the settings changed by your abuser, contact the manufacturer or an expert to check. If changes have been made, take a photo of the changed settings. Only reset the systems when it’s safe to do so, or after you’ve spoken with police.

There are steps you can take to make sure evidence is stored securely.

Keep records of who has access to any physical documents or storage devices (such as phones, tablets, computers, USBs and external drives) as well as who has access to any cloud storage services you use (such as Google Drive, OneDrive, iCloud and Dropbox). Make sure any devices and cloud storage services being used to store evidence are secure. Always use protections, like multi-factor authentication, to keep your evidence safe when using cloud storage services.

Some cloud storage services will only keep content for a certain length of time and might delete your information without warning if you don’t access it very often. Check their terms of service before uploading. If you decide to take legal action, you may need to show that the evidence has not been changed or manipulated in any way.

Set up a special folder on a safe device or secure online account and store the evidence there. Choose a name for it that the abuser won’t recognise. You may consider making multiple copies and storing them separately in case the evidence is found by your abuser and deleted. After you have saved any photos or videos into the folder you can clear them from your camera roll and any other devices where they are synced, so others don’t see them. This also means you won’t keep coming across them, which can be upsetting.

There are apps available to help you to collect evidence of abuse. Some are similar to a diary, where you can note incidents and your thoughts about them, keep photos of injuries and property damage, and store screenshots of emails and messages. Make sure the app is passphrase protected and in a folder that’s also passphrase protected, if possible. The passphrase should be strong and complex – consider using a password manager (see our advice on setting strong passphrases or passwords). It also helps to sit the app in a folder with a name that the abuser is unlikely to look in, if they happen to get access to your devices or accounts.