[email protected] +374 55 22 88 11
Cyberchat

Collecting evidence during cyber incidents

July 21, 2025

When facing online threats or digital attacks, responding correctly and documenting what happened is essential — both for your personal safety and for legal protection. CyberChat provides practical guides to help you record and preserve evidence in such situations.

Why is it important to document digital attacks?

The process of documenting digital attacks involves collecting and preserving information about what happened, when, and how. This can help to:

  • analyze the situation to understand the scope and impact of the attack,
  • have evidence for legal, technical, or other actions,
  • receive support from CyberChat specialists in technical, legal, and psychological matters, or from relevant organizations.

How to document digital attacks and what to do:

  1. Describe the incident by noting the time, what happened, and who was involved. Try to gather any information that could help identify the attackers.
  2. Collect evidence — screenshots, emails, messages, videos, photos, voice messages, etc.
  3. Store the data in a secure location, such as cloud storage or an external drive. For safety, it’s recommended to keep two copies in different places.
  4. Consult professionals — if needed, reach out to CyberChat to receive appropriate support.

General Tips:

  • Don’t wait — start documenting as soon as possible.
  • Stay calm — even in stressful situations.
  • Follow safety guidelines to protect yourself and your data.

—–

Go to the “What to do if…?” section of our website, find the description that matches your current situation, and explore the technical, psychological, and legal solutions.

If you’re having difficulty or facing obstacles, reach out to us — our specialists are here to support you.

——

This blog has been funded by UK International Development from the UK government and developed with the support of UNICEF. However, the views expressed in this blog belong to CyberChat’s authors and do not necessarily reflect the UK government’s official policies or the positions of the implementing organizations.