Guides / Preserving evidence
Guide
Keep what is useful before cleaning up a device or an account
Deleting, resetting or even some syncing can change the traces available. Before any irreversible action, keep the messages, screenshots, logs, app names, times and references that will let you document what happened.
The natural reflex is often to erase everything and “start again from scratch”. But deleting too quickly can lose items that are useful to your bank, the platform concerned, your insurer, a police report or an intervention report.
Do this right away
Three simple reflexes, before any clean-up or reset.
1. Don’t delete anything. Keep messages, emails, notifications, call logs and transactions as they are, even what makes you uncomfortable.
2. Note the date and time, then capture. Photograph or take a screenshot of the screens concerned, keeping the sender, URL, number or account visible.
3. Keep your devices and storage media. Phone, computer, USB sticks: set them aside, cut the connection if needed, but avoid switching off or resetting on impulse.
Unsure about a step? Request a call back before you act: it’s free and with no commitment, and we will never ask for your codes.
The four steps before remediation
The method stays proportionate to the incident: keep what matters, without unnecessary handling.
These steps follow on from one another. What matters is to separate what is observed from what is assumed: we document observable facts, without turning a slowdown, a screenshot or an unknown app into certainty of a hack. Once the essentials are kept, securing and cleaning up can follow.
Why digital evidence is fragile
A single click, a sync or a reset can change the data available. Hence the value of distinguishing urgent securing from irreversible deletion.
Volatile data
Active sessions, notifications, recent logs and processes can change or disappear over time.
Syncing
Deleting a message or a file can spread to several devices and cloud services at once.
Resetting
A factory reset can erase apps, histories, settings and traces that are useful for the timeline.
Context
An isolated screenshot helps less if it shows neither the date, the sender, the URL nor the account concerned.
What to keep, depending on your situation
An item’s value depends on its context and traceability. The aim is not to collect everything, but to preserve what helps establish the facts.
- Call log
- Texts and notifications
- Apps and permissions
- Linked devices
- Installed software
- Remote access tools
- Security alerts
- Useful files and logs
- Open sessions
- Sign-in history
- Forwarding rules
- Recovery methods
- Exchanges with the bank
- Support tickets
- Police report references
- Timeline of actions
What to avoid
Keeping evidence must stay methodical. Piling up copies, installing several tools or handling originals without traceability can complicate the analysis.
The missteps not to make
Don’t delete useful messages or notifications, even if they are embarrassing.
Don’t reset a device before documenting what was on it.
Don’t change original files unless you have to: work on copies.
Don’t conclude it was a hack without verifiable evidence: a doubt is not proof.
A screenshot can be valuable, especially if it shows the date, the time, the sender or the account concerned. However, it must be placed within a timeline, and it does not always prove the origin of the incident on its own. Should you switch the device off? Not always: if malicious activity is in progress, cut the connection; shutting down abruptly can itself make some items disappear. If a technical analysis, an expert assessment or legal action is being considered, keep the original device and limit handling.
Commitments,
not promises.
This guide helps you act fast. It guarantees no result: no refund, no recovery of funds, no identification of the culprit. We check, secure, document and advise, and we will never ask for your codes, passwords or full card numbers. Your data stays in France.
You don’t have to handle everything alone.
Would you rather we checked with you what to keep, before you clean up? Explain the situation: we assess the urgency, the immediate risks and the first actions you must not miss, without ever asking for your codes.
Preserve first, secure afterwards
Once the useful items are kept, the next steps can be taken more safely. Here are the most useful guides after this one.
The 6 immediate reflexes
The right steps common to almost every incident, to act fast without making things worse.
Open the guide →Dispute a fraudulent transaction
This is where your well-kept evidence pays off: rights, time limits and options for an unauthorised bank transaction.
Open the guide →Filing a police report & reporting
Police report, Perceval, THESEE, Cybermalveillance.gouv.fr: what each official service is for, and in what order to use them.
Open the guide →See also: all guides · your situation