Evidence Preservation Instructions

Evidence to Collect and Preserve

When you report a cybercrime, it is important to keep any evidence that supports your complaint. The more evidence you have, the better the chance at solving your case. Keep evidence items in a safe location where they can not be damaged. Keep a back up of digital evidence at all times, so that in case you lose the items you still have it stored somewhere else.

Evidence may include, but is not limited to, the following:

  • Canceled checks
  • Certified or other mail receipts
  • Chatroom or newsgroup text
  • Credit card receipts
  • Envelopes (if you received items per mail)
  • Facsimiles
  • Log files, if available, with IP Address, Port Number, date, time and time zone
  • Social media messages
  • Money order receipts
  • Bitcoin transfer receipts
  • Pamphlets or brochures
  • Phone bills
  • Printed or preferably electronic copies of emails (if printed, include full email header information)
  • Printed or preferably electronic copies of web pages
  • Wire receipts