What is digital evidence preservation?
Digital evidence preservation means retaining records of an incident without unnecessarily changing their content or context. Messages, original emails, transaction confirmations, wallet addresses, website URLs, and account records can help an investigator reconstruct events. A screenshot can capture what you saw, but it may omit information available in an original file or export. Preserve originals alongside screenshots wherever possible, and record when and how each item was collected.
Preserve communications and website details
Keep complete conversations rather than selected messages. Export chats using the platform’s available tools, retain original emails with their headers, and note usernames, profile links, telephone numbers, and domains. Capture suspicious website pages with the full URL and the date of capture. Do not revisit links or download attachments solely to collect evidence if doing so could expose you to further harm. Never send passwords, private keys, or wallet seed phrases to an investigator.
Record financial transactions accurately
For bank or card payments, preserve statements, payment references, beneficiary details, and correspondence with the provider. For cryptocurrency, record the network, transaction hash, sending and receiving addresses, amount, and timestamp. An address alone may not identify the correct blockchain. Keep exchange receipts and withdrawal confirmations as well as on-chain references. Contact your bank, payment provider, or exchange promptly through its official channels to report the incident and ask about available protective measures.
Build a timeline and protect your accounts
Create a factual timeline separating what you directly observed from what you suspect. Include dates, time zones, amounts, contact attempts, and changes to account access. Store copies securely and restrict sharing to people who need them. If an account is compromised, prioritise safety: use a trusted device to contact the provider and secure access. If a device may need forensic examination, seek qualified guidance before resetting, reinstalling, or deleting material. Account protection and evidence preservation should be coordinated rather than treated as competing goals.
What can an investigator do with these records?
An investigator can assess the available material, identify gaps, correlate communications with transactions, and organise findings for review. Depending on the incident, blockchain tracing or digital forensic analysis may support that work. Evidence does not automatically establish a person’s identity, prove a legal claim, or ensure that money can be recovered. GC Intel provides evidence-led research and reporting, not legal advice or guaranteed asset recovery; qualified legal counsel and relevant institutions determine their own next steps.