What should I ask a witness to preserve?¶

Ask a witness to preserve the original device, account, message or file through which they observed the relevant material.

Avoid this assumption: A witness can simply forward, copy or summarise what they saw without affecting the evidence. Forwarding may remove metadata, change timestamps, alter message state or lose the original account context.

Record the service, account, username, phone number, email address, profile link, date, time and device involved.

Ask the witness not to delete messages, emails, files, call records, notifications, voicemails, screenshots or relevant applications.

Ask them to retain the device in its current state where practicable.

If they have already taken screenshots, preserve them, but record when and how they were created.

Do not instruct the witness to open attachments, click links, revisit profiles, contact the suspect or continue investigating.

Where content is disappearing, remotely controlled or likely to be deleted, obtain specialist or provider-preservation support quickly.

Ask the witness to record what they remember seeing, what actions they took and whether anyone else had access to the device or account.

Use an approved method for receiving copies rather than ordinary messaging where evidence sensitivity or volume makes that unsuitable.

Preserve the witness’s own account separately from technical material. Their recollection may explain what was visible before the content changed.

Do not assume a forwarded copy is identical to the original.

Operational takeaway¶

Ask the witness to retain original devices, accounts and content, avoid further interaction and document every action already taken before material is supplied.