Active Incident? 24/7 Response →
SleuthX

Read this first

Are you on a device or network the person can see?

  • If they might be able to see this device, use one they can’t access — a friend’s phone, a library or public computer, or a domestic-violence shelter’s safe device. If you continue here, your visit may be visible on a synced iCloud, Google account, or shared family plan.
  • If you think spyware or stalkerware is on this device, removing it can alert the person monitoring you and can destroy evidence. Make a safety plan — ideally with a domestic-violence advocate — before you remove anything, and use a device they can’t access in the meantime.
  • The Quick Exit button(top right) replaces this page with weather.com immediately — but it does noterase this visit from your history, and private/incognito mode doesn’t fully hide it either. To be safe, use a device the person can’t access.
  • If you’re in immediate danger, call 911. If you have a few quiet minutes, keep reading.

National Domestic Violence Hotline: 1-800-799-7233 · text START to 88788 · thehotline.org — 24/7, free, confidential.

988 Suicide & Crisis Lifeline: call or text 988 · 988lifeline.org — free, confidential crisis and emotional support, 24/7.

NNEDV Safety Net: techsafety.org — technology-safety help for survivors.

For Individuals & Families

Gathering Evidence Safely for a Protective Order

Documenting abuse can strengthen a protective-order petition — but only if you do it without escalating danger. How to preserve evidence on a safe device, and what the court actually weighs.

All articles·9 min read·June 29, 2026

Safety comes before evidence

Documenting abuse can strengthen a protective-order petition — but only if gathering it does not put you in more danger. If the other person can see your phone, your accounts, or your location, the act of collecting evidence can itself tip them off. Do this work on a device they cannot access, and read is someone monitoring my phone first if you are not sure your device is private.

Screenshots are a start; raw records are stronger

Take screenshots of threatening messages, missed-call logs, emails, and social-media posts — with dates and the sender visible. They are often enough to open a case. But a screenshot is a picture of evidence, not the evidence itself, and it is easy to question. The original messages, call records, and files — preserved in their native form — carry the context that makes them hard to dispute. Where a case is serious, a forensic examiner can capture those originals so the record stays intact.

What “court-ready” actually means

No one can promise you that a given piece of evidence will be accepted — the court decides what is admissible. What a careful process does is make evidence court-ready: preserved and documented so it is prepared to support admissibility under Federal Rules of Evidence 901 and 902, which govern how evidence is authenticated and identified. The goal is to give the court a clean, well-founded record to weigh — not to claim the outcome in advance.

Preserve, do not delete

Resist the urge to clean up your phone. Deleting the abusive messages after screenshotting them can be treated as spoliation — destruction of evidence — and it throws away the strongest version of your record. Keep originals in place, back them up to a safe device, and let them accumulate. The same caution that applies to stalkerware applies here: do not remove or wipe things that could matter later without advice.

Stay on the right side of the law

Gathering evidence the wrong way can backfire. Recording-consent laws differ by state, and accessing the other person's phone, email, or accounts without authorization can be illegal even when you are the one being harmed. Document your own experience and your own devices; leave anything involving the other person's data to your attorney and a forensic examiner.

Work with an advocate and counsel

A domestic-violence advocate can help you build a safety plan and navigate the petition process, and an attorney can tell you what your jurisdiction needs. If forensic preservation is warranted, domestic-violence digital forensics explains how evidence is captured and documented, and domestic-violence help is the place to start if you are in crisis.

Sources

  1. Legal Information Institute, Cornell Law School, Federal Rule of Evidence 901 — Authenticating or Identifying Evidence. https://www.law.cornell.edu/rules/fre/rule_901
  2. Legal Information Institute, Cornell Law School, Federal Rule of Evidence 902 — Evidence That Is Self-Authenticating. https://www.law.cornell.edu/rules/fre/rule_902
  3. NNEDV Safety Net Project, Location Tracking. https://www.techsafety.org/location-tracking
  4. Coalition Against Stalkerware, Information for survivors. https://stopstalkerware.org/information-for-survivors/

Related services

Meet Your Practitioner

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 15 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response
Quinnlan Varcoe, Founder & CEO

Gathering evidence safely: quick answers

Certified Expertise

GIAC · AWS · Splunk · CompTIA

Transparent pricing

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management