If you believe that you are the target of harmful or criminal behaviour online then it is vitally important that you collect evidence of the incident as soon as possible after you discover it. While it may seem like deleting the content is the quickest solution, by doing this you may take away any opportunity to have action carried out by the content host or a law enforcement agency.

So before you hit the delete key we have listed below a couple of simple steps that you should take.

Record the URL (or address) of any web page that is involved.

Each page on the internet has a unique address that allows it to be discovered on the internet. This is the address that you see at the top of the webpage you are on. It often starts with the letters http or https. Write down or copy the whole of the address. This means not just the first bit with the www at the start of it but the whole length of the address, even if it looks like a random jumble of letters and numbers.

Lets say for example you are using a website called “funnysocialmediasite.com” and you find something upsetting at a page with this address;


It is not enough to record that the page was at “www.funnysocialmediasite.com” you must record the entire address. Right down to the end (…fgtyukl).

Copy the text and the headers of any emails that are involved

When you open an email, you generally are shown only the address details and the content of the message.  There is more information associated with emails that may be useful as evidence.

You should copy the contents of the message first and store it in a file with the date and time it was received. You should then grab the “headers” from the message. These are the instructions that are sent along with emails to identify where they have come from and who they are intended for. Headers can be shown in different ways depending on how you access your emails.

Below are some instructions produced by the Department of Internal Affairs on how to capture the headers for different email systems. If yours in not shown below, or you have any questions about this, contact NetSafe for more advice.

  • Gmail
  • Outlook
  • Yahoo Mail
  • Take a “screenshot” of the content

    A picture of the content can prove to be extremely helpful if at some point the content is removed by the person that posted it. If you have a copy of it, with the address it was found at, and the date and time the copy was taken. Even if it can’t be seen “today”, it is good evidence of its existence.

    The exception to this is if you think the content may be “objectionable”. If you think this is the case, DO NOT copy the content. Contact Netsafe or the Department of Internal affairs immediately.

    iOS (iPhones, iPads, iPods)

    Press the power button on the top right corner of your device and at the same time, press the home button. The screen should flash, and if you have sound enabled you will hear a camera shutter sound. You should then find the picture with the rest of your images in the Photos App on your device.


    If you are running a newer version of Android you should try either;

    • Pressing the Down Volume Key and the Power key at the same time OR
    • Sliding the side of your hand across the screen from left to right

    Your image will then be saved into your photo gallery.

    If you are running an older version of Android (Before 2.3) you will need to install a screen shot app from the Play Store.

    OSX (Apple Computers)

    Press CMD, Shift and 3 at the same time. This will take a shot of your entire screen and save it to your desktop


    Press the Print Screen Button on your keyboard. This may be labelled as PrtScn, or Prtn Scrn or Print Scn, and is most often found at the top right of your keyboard. This will copy your entire screen to your clipboard. You will then need to “paste” (Ctrl + V) the image into a document to save it for future reference.