Document what's leaked and where

    Capture every URL, screenshot and reposting before evidence gets taken down.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated June 2026 · 1 min read

    Leaked content can be removed quickly — sometimes by the platform, sometimes by the perpetrator hiding their tracks. Get evidence first, then act.

    What to capture

      • Screenshots of the content + comments + the account profile
      • Direct URLs to each instance
      • Date and time of capture (most platforms show this)
      • Any threats, demands or context messages

    Stay safe while documenting

    Important

    If the content is intimate / non-consensual, capture only what you need for evidence. Don't redownload more than necessary.

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Identity Recovery

    No image

    Stop the next breach from hurting you

    Set up monitoring and unique credentials so future breaches don't cascade.

    No image

    Document the impersonation before reporting

    Build the evidence pack you'll need for police, banks and credit bureaus.

    No image

    Rotate breached passwords and re-secure those accounts

    Change passwords on every breached service plus anywhere you reused them.