01
Evidence guide
Organise scattered records into a clear incident file.
Preserve original files, time and source before making working copies and an incident timeline. Do not crop, combine or overwrite originals simply to make them look clearer.
Core evidence checklist
Check the records you already have to see what still needs organising. Checkmarks are for this page session only.
02
Payments and funds
03
Platforms and accounts
04
Digital assets
05
Pages and files
06
Timeline and loss
Recommended organisation order
Filename example
2026-08-31_1430_platform-chat_counterparty_original-export.pdfDescribe time, source and content. Never put passwords, identity numbers or full card numbers in filenames.
- 01
Preserve originals
Keep the original device and files. Create a read-only backup and do not mark, crop or rename originals.
- 02
Create working copies
Name copies by date and type, recording source, export method and storage location.
- 03
Build a timeline
Match each date, person, platform, action and amount to an evidence filename.
- 04
Check how the records will be used
Independently verify contact details before sharing records with a bank, platform or local reporting channel, and confirm which documents are needed.
Do not do this
- Delete inconvenient or apparently irrelevant messages
- Keep only cropped screenshots
- Combine screenshots from different times
- Confront the counterparty and reveal a report
- Send sensitive keys to recovery contacts
04
Next Steps After Organising Evidence
Put messages, payment records and events in date order. Contact our team to discuss funds-flow clues and further tracing.