Evidence Preservation

What evidence preservation is, who it affects, and what a child should learn — a free entry from the Digital Guardians Threat Dictionary.

Target age range: Pre-Teens, Teens, and Parents (Ages ~10+). The concept of evidence preservation is most relevant once children begin to have independent online interactions – typically around upper elementary or middle school (when texting, social media, and online gaming become common). Younger children (under 10) usually aren’t responsible for preserving evidence themselves; in their cases, parents handle it. However, it’s beneficial for parents of all children, even the very young, to understand this topic, because even a first-grader could face cyberbullying through a school app or an inappropriate message on a shared family device – and the parent would need to preserve evidence. So, the primary audience is parents and caregivers, plus youth in middle school and high school who can grasp and execute these steps. For teens, especially those 13+, we empower them to preserve evidence themselves when necessary (as they value autonomy and may encounter situations without a parent immediately present). Content and examples will be tailored to be age-appropriate: simpler language and more parent-led actions for younger kids, more direct teen-focused advice for older ones.

Learning objective: Understand what qualifies as evidence in a digital context (messages, images, logs, metadata, etc.) and why it’s important.

Threat definition

Evidence Preservation in the digital safety realm means retaining and protecting any digital information that could serve as proof of wrongdoing or could be needed to address an incident. The “threat” here is twofold: (1) that crucial evidence might be lost, deleted, or tampered with, which could let offenders off the hook or make resolution harder; and (2) mishandling evidence could inadvertently violate privacy or alert perpetrators, complicating the situation. For example, if a child is cyberbullied and immediately deletes the messages to try to forget it, the evidence is gone – making it difficult to prove the bullying occurred or to punish the bully. Similarly, if a teen is extorted and out of panic posts the screenshots publicly on social media to “expose” the blackmailer, they might accidentally alert the criminal to destroy other evidence and also further spread the sensitive content. So the “threat” we’re addressing is not a person or virus, but the risk of losing digital proof or mishandling it. Evidence can include text messages, social media posts, chat logs, emails, images, videos, and even things like call logs or screen recordings of live interactions.

THE THREAT IS TWOFOLD

• RISK 1 — LOSING THE PROOF That crucial evidence might be lost, deleted, or tampered with, which could let offenders off the hook or make resolution harder. For example, if a child is cyberbullied and immediately deletes the messages to try to forget it, the evidence is gone – making it difficult to prove the bullying occurred or to punish the bully.
• RISK 2 — MISHANDLING THE PROOF Mishandling evidence could inadvertently violate privacy or alert perpetrators, complicating the situation. For example, if a teen is extorted and out of panic posts the screenshots publicly on social media to “expose” the blackmailer, they might accidentally alert the criminal to destroy other evidence and also further spread the sensitive content.

WHAT COUNTS AS EVIDENCE

• MESSAGES & POSTS Text messages, social media posts, chat logs, and emails.
• MEDIA FILES Images and videos.
• LOGS & LIVE CAPTURES Call logs and screen recordings of live interactions.

This topic teaches families to treat evidence like a delicate but vital piece of the puzzle: handle it carefully, keep it safe from prying eyes (including the perpetrator), and preserve its integrity so that those who need to take action (schools, platform moderators, law enforcement) can do so effectively. In essence, evidence preservation is a defensive practice that ensures the “digital footprints” of bad behavior are not erased. Doing this properly can be the difference between “We’re sorry, we can’t do much without proof” and “We have what we need to act on this.”

The full chapter is in Pillar 4: Identity Attacks, Response, Recovery & Support Systems and the Complete Edition.