Educational, safety-first guidance for people responding to cyber incidents. This project is independent and is not a law-enforcement agency, law firm, bank, telecom operator, or account-recovery service.
A practical framework for preserving chats, emails, screenshots, media, metadata, transaction records, URLs, and incident timelines.
- Preserve the original device and original files whenever safe and lawful; avoid unnecessary editing or conversion.
- Create verified working copies and record when, how, and by whom each copy was made.
- Capture full context: account identifiers, URLs, dates, times, time zone, surrounding messages, and relevant transaction details.
- Use consistent file names and a read-only evidence index; record cryptographic hashes when appropriate.
- Maintain a chain-of-custody log for every transfer, access, copy, export, or submission.
- Store evidence securely with access limited to people who need it.
- Chats, emails, screenshots, voice notes, call logs, and platform exports
- Original images, videos, documents, and available metadata
- Transaction records, account activity, URLs, timestamps, and time zone
- Incident timeline, evidence index, hash values, storage location, and handler log
- Do not annotate, crop, re-encode, or rename the only original copy.
- Do not open suspicious attachments on the original evidence device.
- Do not place victim information or case evidence in a public repository or issue.
| Date and time | Time zone | Event | Account or URL | Evidence file | Action taken | Reference number |
|---|---|---|---|---|---|---|
| YYYY-MM-DD HH:MM | PKT / UTC+5 | What happened | Identifier | File name | Report or containment step | Ticket / complaint ID |
Keep facts separate from assumptions. Record times exactly as displayed and note the time zone. Preserve original files; use copies for review or redaction.
For cybercrime complaints, use the official NCCIA complaint portal or the current reporting methods listed on the NCCIA website. For immediate physical danger, contact local emergency services. For urgent financial loss, contact the relevant bank, wallet, card issuer, or payment provider first.
This is a public repository. Do not open an issue containing victim names, CNIC or passport numbers, phone numbers, financial details, credentials, private media, chat exports, case files, or other evidence. Use official private reporting channels. Redact examples before sharing them for documentation improvements.
digital evidence preservation · chain of custody template · cybercrime evidence checklist · preserve WhatsApp chats · incident timeline template · metadata preservation
- NIST IR 8387: Digital Evidence Preservation
- NIST definition of chain of custody
- NIST evidence management resources
- NCCIA digital forensics information
Links are provided for convenience and may change. Confirm current contact details on the authority or platform's official website before acting.
Corrections, accessibility improvements, translations, and updates to official links are welcome. Read CONTRIBUTING.md before opening a pull request.
This material is general information, not legal advice, forensic certification, or a guarantee of recovery. Procedures and reporting routes vary by jurisdiction and platform. A qualified lawyer, investigator, incident responder, or relevant authority should review high-risk cases.