EVIDENCE

Preserve evidence first

Most cases are lost at the evidence stage. This is the first 10 minutes. Work the list before you do anything else.

Before you do anything else

Most child-exploitation cases are lost at the evidence stage — parents act from panic, delete messages, factory reset, let the account auto-delete. This page is for the first 10 minutes. Read fully, then act.

NCMEC — call for guidance, free1-800-843-5678

Preserve in this order

  1. Freeze the device. Set it down. Screen-locked. Not powered off — some devices lose encryption keys on power cycle.
  2. Photograph the screens with a second device. Your phone or a camera. Full-frame photos showing URL bar, username, timestamp, and message content. Backup against the platform deleting content while you work.
  3. Screen-record scrolling. On the primary device, start a screen recording and slowly scroll through conversations. Capture friends list, profile info, message threads. Beats screenshots because it shows continuity.
  4. Screenshot individual key messages after the screen-record is saved. Frame to include username, timestamp, and content. Take more than you think you need.
  5. Save everything to cloud, not just the phone. Email screenshots to yourself. Save to iCloud / Google Drive / Dropbox. Device loss or seizure should not equal evidence loss.
  6. Write a timeline in Notes: when conversations started, when photos sent or received, platform migrations, any real-world meetings proposed or attempted. Exact wording your kid told you. This is the chronology law enforcement works from.
  7. Note the usernames, display names, profile pic, and identifying info about the other party. Stated location, age, school, job. All likely false but all useful.
  8. Preserve platform-specific material:
    • Snapchat: Settings > My Data. Enable screen recording before the app deletes anything. Capture Snap Map, Memories, My Eyes Only if accessible.
    • Discord: Settings > Privacy & Safety > Request All My Data. Note server names, channel names, roles.
    • Instagram / Meta: Settings > Your information and permissions > Download your information.
    • TikTok: Settings > Account > Download your data.
    • Roblox: chat history limited; account data via Settings > Account Info > Request Data. Screenshot friends list and recent experiences first.
    • Character.AI / AI chatbots: export conversation history before canceling. Cancellation may delete logs.
  9. Do not log out. Do not cancel the account. Do not factory reset. Do not let the device update overnight if an update is pending — it may clear data.
  10. Call NCMEC. Ask specifically how to preserve for their review and likely law-enforcement handoff. They will tell you whether to submit screenshots through CyberTipline.org or hold for in-person forensic imaging.

Do not

  • Do not delete messages, photos, the app, or the account until law enforcement has copies.
  • Do not factory reset the device.
  • Do not let the phone run out of battery with the app open and unsaved.
  • Do not edit, crop, annotate, or mark up screenshots before preservation. Keep originals untouched; work from copies.
  • Do not post any evidence to social media "to warn other parents." That can compromise the investigation and may violate distribution laws.
  • Do not use your kid's account to message the other party. Contaminates chain of custody, and impersonation of a minor communicating with an adult has legal risk.

Device preservation for likely law-enforcement seizure

If law enforcement is going to image the device, they'll tell you to power it on, plugged in, in airplane mode, screen off — and to bring it to them physically. Do not wipe, do not upgrade, do not install anything. If multiple devices are involved (phone, tablet, laptop, gaming console, old phone), flag all of them.

If law enforcement is not taking the device, you're preserving for your own records, potential civil action, and platform escalation. Treat the backup cloud folder as the canonical record. Date-stamp it. Don't edit files.

If content is CSAM (images of a minor)

Do not forward, save to personal devices, or move around. The images themselves have legal constraints on possession. NCMEC's CyberTipline is the lawful channel — they have authority and tooling to handle this. Let them guide what you can and cannot retain.

For you

This is tedious work in an emotional moment. Work the list. Evidence survives panic; memory does not. Thirty minutes of methodical preservation is worth more than a week of after-the-fact reconstruction.

Print this page — tape to fridge
In crisis? Call or text 988 · Text HOME to 741741