How to document harassment in messages
When harassment happens through messages - text, email, social media DMs, workplace chat - the evidence is right there in the conversation. Unlike verbal harassment, which relies on testimony and memory, message-based harassment produces a timestamped record. But having the evidence and preserving it properly are two different things. Messages can be deleted, accounts can be deactivated, and platforms can change or remove content. Documenting harassment effectively means saving the right things, in the right way, before they disappear.
This is a practical guide to preserving message-based harassment for reporting to HR, police, platforms, or courts.
Save full threads, not just the worst messages
The most common documentation mistake is saving only the most extreme messages. A screenshot of a single threatening message is alarming, but it's also decontextualized. Whoever reviews it - an HR representative, a police officer, a judge - will want to see the full conversation thread.
Full threads show:
- Whether the messages were provoked or unprovoked
- The escalation pattern over time
- Whether you asked the person to stop and they continued
- The frequency and persistence of the behavior
- Context that makes individual messages more or less concerning
A single aggressive message could be explained away by the sender. Twenty messages over two weeks, continuing after a clear request to stop, establishes a pattern that's harder to dismiss.
Save entire conversation threads, including your own responses. If you responded, your responses are part of the record. If you didn't respond and the messages kept coming, that's part of the record too.
How to preserve messages
Different methods of preservation have different strengths. Use more than one when the situation is serious.
Screenshots. The fastest method. Capture the full message, the sender's name or number, the timestamp, and any delivery or read indicators. On phones, scroll through the conversation and take sequential screenshots that overlap slightly, so the full thread is captured without gaps.
Screenshot limitations: they can be claimed as fabricated, they don't capture metadata, and they're hard to organize for long threads. Screenshots are a good first step, not the only step.
Native export tools. Many platforms allow you to export your data or specific conversations. WhatsApp lets you export chat histories. Facebook and Instagram offer data downloads. Email is inherently saved unless deleted. Twitter/X DMs can be requested through a data download. Use these tools to get a platform-authenticated copy of the conversation.
Screen recordings. A screen recording of you scrolling through a conversation thread is harder to claim as fabricated than static screenshots. It shows the messages in context, in the platform's native interface, in real time. Most phones have built-in screen recording. Use it for particularly important threads.
Third-party preservation tools. Services like Hunchly, Page Vault, or even the Wayback Machine (for public posts) create verified, timestamped captures of online content. These are more credible in legal settings because they include metadata that screenshots don't.
Preserving metadata
The content of a message is important. The metadata around it can be equally important. Metadata includes:
- The sender's username, display name, phone number, or email address
- The date and time of each message
- Delivery and read status
- The platform the message was sent on
- Whether the message was part of a group or individual conversation
- Any media attachments (images, voice messages, links)
When taking screenshots, make sure the sender information and timestamp are visible in the frame. When exporting conversations, use the platform's full export feature rather than copying and pasting text, which strips out metadata.
If the sender uses a username rather than a real name, also capture their profile page - it may include a profile picture, bio, linked accounts, or other identifying information that could be useful if the person later claims the account wasn't theirs.
When to screenshot vs. when to export
For immediate preservation - when you're worried content might be deleted soon - take screenshots right away. It takes seconds and captures the content as it appears now.
For thorough documentation - when you're building a record for a formal report or legal matter - follow up with a native export and any additional metadata you can capture. The export provides a more complete, platform-verified record. The screenshots serve as backup.
If the person is likely to delete messages or block you, prioritize speed. Screenshot first, organize later.
Storing records safely
Where you store harassment documentation matters, especially if the person harassing you has access to your devices or accounts.
Cloud storage with strong authentication. A Google Drive, iCloud, or Dropbox folder secured with a password the other person doesn't know and two-factor authentication they can't intercept. If you share a family cloud storage plan, use a separate personal account.
Email to yourself. Forwarding screenshots and exports to a personal email account creates a timestamped backup. Use an email account the other person doesn't know about if safety is a concern.
Physical copies. For particularly important evidence, printing screenshots and storing them somewhere secure provides a backup that survives account compromises and device failures.
A trusted person. Sending copies to a friend, family member, or attorney means the evidence exists in more than one place. If you lose access to your own copies, the backup exists.
Do not store your only copies of harassment evidence on a shared device, a shared cloud account, or a work device if the harassment is work-related and you might lose access to that device.
Reporting and what recipients need
Different recipients have different needs.
HR departments want to see the messages themselves, a summary of the situation, the dates and frequency of the behavior, and whether you've asked the person to stop. A clear timeline with screenshots or exports attached is the standard format.
Police need evidence that a crime has been committed - the threshold varies by jurisdiction and by the nature of the messages. Preserve everything and let them determine what's relevant. Provide organized materials, not a phone unlocked to a random point in a conversation.
Platform reporting typically requires you to report specific messages through the platform's interface. Do this, but don't rely on it as your only form of documentation. Platforms may remove the reported content, which helps stop the behavior but eliminates the evidence. Always preserve your own copies first, then report.
Courts and attorneys need authenticated evidence. Exports and verified captures carry more weight than screenshots. If you anticipate legal proceedings, discuss evidence preservation with an attorney early - before content is deleted or accounts are changed.
The core principle is the same across all recipients: preserve the complete record, organize it chronologically, and present it factually. Let the evidence speak for itself.