Securing Evidence of Online Hate: Screenshot, URL, Timestamp

Anyone attacked online usually wants one thing: to get rid of the content – report it, block it, delete it. That is understandable. But once a comment has disappeared, it is hard to prove it ever existed. That is why the rule is: secure first, then report. This guide shows you what matters – in general and for the main platforms.

What good evidence has to show

A screenshot alone is quickly made and quickly doubted. For a police station, a law firm or a court to be able to work with it later, the following should be recognisable:

• What was said – the full text, image or video.
• Who said it – the profile name and, if possible, the profile URL. Anyone can change a display name; the address of the profile is more reliable.
• Where it appears – the link to the post or comment.
• When it was published – the date and time of the post and the time you secured it.
• In what context – the post under which the comment appears, and the replies before and after it.

If one of these is missing, the evidence is not worthless. It is just harder to verify.

The basic rules for every platform

Copy the link. Copy the link to the post and to the profile and save it in a note or file – with the date and time you secured it.

Screenshot with context. On a computer, keep the browser's address bar and the clock with the date visible. On a phone, the status bar usually shows only the time, not the date. So note the date separately, or photograph a screen that shows it.

The whole thread, not an excerpt. Don't secure only the worst sentence. Scroll through the thread and take several screenshots that overlap slightly. Anyone who sees only an excerpt can claim the context was different.

Don't edit. Don't crop originals, don't mark anything and don't black anything out. If you want to highlight something, make a copy and edit only the copy.

Keep the originals. Don't delete the original files from your phone or computer, even if you have forwarded them. The originals contain metadata such as the creation date. Messengers and social networks often strip it when files are forwarded.

Screen recording for moving content. Stories, live streams and videos often disappear after a short time. Record them with your device's screen recording, and start the recording at the profile so it is clear who the content comes from.

Involve witnesses. Ask someone you trust to look at the content and briefly write down what they saw and when. A witness can later confirm that your screenshots show the real content.

Keep a log. A simple table is enough: date, platform, profile, link, the content in a few keywords, and the file name of the screenshot. With repeated attacks, only this list shows the pattern.

Instagram

• Post or reel: choose “Copy link” from the three-dot menu.
• Profile: the address is instagram.com/username. Record the username, not just the display name.
• Comments: in the app, comments do not have their own link. So secure the link to the post and take screenshots showing the comment, the profile name and the time stamp. In the browser, the time is often more precise than in the app.
• Stories: they disappear after 24 hours. Secure them immediately with a screenshot or screen recording.
• Direct messages: screenshots of the entire thread, with the profile name at the top of the image. For photos or videos that can only be viewed once, the other person may be notified of a screenshot, or the capture may be blocked.

TikTok

• Video: tap “Share”, then “Copy link”.
• Profile: record tiktok.com/@username.
• Comments: as on Instagram, there is no separate link. Take a screenshot of the comment with the profile name and time stamp, plus the link to the video.
• Lives: they are usually gone once they end. Screen recording during the live is often the only option.

X (formerly Twitter)

• Every post and every reply has its own link: “Share”, then “Copy link”. That is an advantage – use it for every single post.
• Profile: x.com/username. The @ handle can be changed, so secure it early, before the person changes it.
• Open a post on its own and X shows the date and time in full. That section belongs on the screenshot.

Facebook

• Post: clicking the time stamp above the post opens it on its own. The address in the browser bar is the link.
• Comment: in the browser, the time stamp below a comment usually also leads to a link that points directly to the comment.
• Profile: many people have the same name. Secure the profile URL; it contains a unique name or a number.
• Groups: note the group name and whether the group is public or private.

WhatsApp

WhatsApp has no public links. Other things matter here:

• Sender: open the contact info and secure the phone number. A saved contact name says nothing about identity.
• Groups: the group name, the member list and who sent the message.
• Export the chat: via the chat menu you can export the thread as a text file, optionally with media. The file contains the date and time of each message. Take screenshots as well.
• Don't delete the chat and don't reset the phone until the matter is settled.

What “court-proof” really means

There is no formal requirement that automatically makes a screenshot “court-proof”. Courts assess evidence freely (freie Beweiswürdigung). A screenshot can be faked – everyone knows that. The easier it is to trace when, where and how you made it, the more weight it carries. That is exactly what the link, date, original file, log and witness are for.

If a lot is at stake, there are additional routes: professional evidence-preservation services or documentation by a notary. Whether that makes sense in your case is something a law firm can clarify with you.

What you should not do

• Don't spread it. Don't share hate content publicly to draw attention to it. Anyone who spreads criminal content may, in some circumstances, commit an offence themselves.
• No copies of abuse material. For depictions of child sexual abuse there is an exception: no screenshots, no downloads, forward nothing. Note the link and contact the police or a reporting hotline directly.
• Don't reply. A counter-reaction can make the situation worse and will be read later.
• Don't block first. After blocking, you often can no longer see the profile and its content. Secure first, then block.

And then?

Once your evidence is secured, you can report the content to the platform. Our article on the Digital Services Act explains which duties platforms have when you do. Whether the content could be a criminal offence is explained in Cyberbullying and Hate Speech: Definition, Examples and What Counts Legally and in the overview Online Hate: What Is a Criminal Offence?. You can read about how things can continue afterwards in Criminal Complaint or Lawyer? and in our 5 steps for hate comments.

You can also report your case directly via our form. Upload your screenshots and links there. We check the report for completeness and refer it to a partner law firm. The legal assessment comes from the law firm, not from us. The more complete your evidence, the easier the next step.