How to document online defamation evidence
How to document online defamation evidence: what to capture, how to preserve it so it holds up, what never to do, and how one file serves every route.
To document online defamation evidence, capture each page as it appears now, with its exact address, the date and time, the poster's identifiers and the way the content spread, then keep those captures unaltered with a log of who made them and when. Do it before you report the content, reply to it or contact anyone, because many posts change or disappear once the poster senses a response.
The same file serves every route: a platform report, a request to a publisher, a legal letter, a court filing. Each takes a different slice, and a screenshot you cannot explain is only a picture.
This guide is information, not legal advice. Rules on what a court accepts differ by country, and your own counsel decides what applies to you.
- Capture first, act second: save the content before you report it, reply to it or contact the poster.
- For each item record the full address, the date and time, the whole page, the poster's identifiers and every place it was copied.
- A screenshot alone is the weakest form. Pair it with an independent archive copy, a saved page file, a hash and a written log.
- Never edit an original, engage the poster, approach a witness yourself or enter an account that is not yours.
- Build one file in layers, then cut from it for each route.
One evidence file serves every route, so build it once
An evidence file is one organized record of the content, its source and its effects, kept so that someone who was not there can see what you saw. Routes arrive in an order you do not control, and a case that starts as a platform report can become a legal letter within weeks. What you did not capture on day one may be gone by day eight.
Keep the file in three layers. The originals are the raw captures, never edited. The working copies are cropped, annotated or redacted versions made for one submission. The log is a dated list of what was captured, how, by whom and where it is stored. You send working copies only.
What to capture for every item: address, time, page, source, poster, spread
Capture seven things for each piece of content, as one set, so they can be matched later.
Related readReputation management report: what to expect| Item | What to record | Why it matters |
|---|---|---|
| Address | The full URL of the exact page or post, not the site home page | Platforms and search engines act on specific addresses |
| Date and time | When you captured it, with time zone, and when it was posted | Shows what was live when, and fixes the first publication |
| Full page | Comments, replies, counters and the surrounding site | Context decides meaning, and a crop invites a challenge |
| Source and metadata | The saved page file, and original image or video files | Lets a specialist check what a screenshot cannot show |
| Poster | Display name, profile address, bio, linked accounts | Identifies who is responsible, or shows you could not |
| Spread | Reposts, quotes, mirrors, search results, who engaged | Every copy is a separate item to act on |
| Your own context | Records and messages that show the statement is false | The file must prove the falsehood, not only the publication |
The address and the date are two different facts
Record two dates: when the content was published and when you captured it. Many platforms show relative times such as "3 days ago", so open the exact timestamp.
The publication date can matter on its own. In England and Wales, section 8 of the Defamation Act 2013 treats a later publication of a substantially similar statement, for the time limit, as accruing on the date of the first publication, unless its manner is materially different. Proof of when something first appeared can therefore bear on how long a claim stays open. Counsel confirms how it applies to you.
Capture the poster as a set of identifiers
Usernames change, so record everything that identifies the account: profile address, display name, any account number visible in the address or page source, bio, picture, linked accounts, creation date if shown, and a view of the poster's other posts about you. Record what you can see. Do not try to unmask an anonymous poster by guesswork or tools you are not entitled to use. Identification is a legal process.
Screenshots, archives and certified captures are not equal
A screenshot proves only what your screen showed. It does not prove the address it came from, the time it was taken or that it was left alone afterward, and anyone can build one in an image editor. Four methods are in common use, and the strongest files stack them.
| Method | What it shows | Main weakness | Cost level |
|---|---|---|---|
| Screenshot or screen recording | What appeared on your device | Easy to alter, no independent time or address | None |
| Saved page or source file | The page text and code as delivered to your browser | Made by you, and some content loads late | None |
| Public web archive | A third-party copy with its own address and capture time | Sees only what an anonymous visitor sees | None to low |
| Certified capture by a service or professional | A capture logged with address, time and hash by someone else | Cost, and weight still depends on the court | Medium to high |
An archive copy is made on a third party's servers, so it supports your account of what was online and when. The Internet Archive's Save Page Now saves a single page with its images and styling and returns a permanent address. Its help page says some sites block crawling and some SSL setups make it fail. Perma.cc takes a similar approach, needs an account, and lets you upload your own image or PDF if its capture fails.
Related readReputation Management RFP and Vendor ScorecardTreat an archive copy as supporting: a court may want someone who can explain how the archive works. Anything behind a login, in a private group or in a closed channel is invisible to a public archive, so for those your own capture is the main evidence and has to be better: a screen recording that opens the page from your own signed-in home screen with the address bar visible, a full scroll of the thread, and a saved page file.
How to capture a page so it holds up
Capture from the most fragile item to the slowest, on a device you control and in your own account only. Set the device clock to automatic, and start the log with the date, time and time zone before you open the page.
Take a full-page screenshot with the address bar and clock visible. Expand every comment and "show more" link, then record a screen video that scrolls top to bottom. Save the page as a file, and the source where you can. Submit the address to a public archive and log the archive address it returns. Download image or video files rather than relying on a screenshot, because the original carries data a screenshot loses.
Repeat for every copy, profile and search result. When a capture fails, log that it failed and why: a logged failure is credible, a silent gap looks like selective collection. Keep annotations, arrows and crops on copies only.
Hashes, timestamps and the log turn captures into evidence
A hash is a fixed-length fingerprint calculated from a file. NIST defines a hash value as the result of applying a hash function to a message. Changing the file by even one character changes the fingerprint. Calculate one for every original with a common algorithm such as SHA-256 when you save it, write it in the log, and anyone can later recalculate it to confirm the file is unchanged.
Related readHow long does reputation management take?In the United States, Federal Rule of Evidence 902(14) covers data copied from an electronic device, storage medium or file if authenticated by a process of digital identification, as shown by a certification of a qualified person. The 2017 committee note says such data is ordinarily authenticated by hash value, and that identical hash values reliably attest that original and copy are exact duplicates. That speaks to the copy matching the file you saved. It does not show that the page ever said what the capture shows, which is a separate question.
Your device clock proves less than a time source you do not control. RFC 3161 defines a Time-Stamp Protocol in which a trusted authority issues a token showing that data existed at or before a particular time. Ask any certified capture service which time source it uses.
A chain of custody is a written record of who held the evidence, what they did with it and when, from capture to use. For a private file, a table with six columns is enough: item number, address, who captured it, date and time, method, and hash. Add a line each time a file is moved or copied. Keep originals read-only with a second copy elsewhere, and work only on copies. If a professional is brought in, ISO/IEC 27037:2012 is an international guideline on identifying, collecting, acquiring and preserving potential digital evidence.
What not to do: alter, engage, approach witnesses, enter accounts
Four habits damage good files, and each is easy to fall into when you are angry.
Altering means more than editing a picture: merging screenshots, renaming files for tidiness or deleting your own related posts all give the other side a reason to doubt the file. In the courts of England and Wales covered by Practice Direction 57AD, a person who knows they are or may become a party has a duty to take reasonable steps to preserve relevant documents, which can include suspending routine deletion. That direction applies to the Business and Property Courts of England and Wales, with listed exclusions, and whether a given defamation claim falls inside it is a question for counsel, not something to assume. A file that omits your own unhelpful messages can lose credibility in any court.
Related readReputation management brief: a template for agenciesA reply to the poster gives them a reason to edit or delete and a fresh statement to quote. Let the chosen route do the talking.
Customers and colleagues who saw the content may become witnesses. Do not ask them to say or write anything in particular. Note who they are and what they told you, with the date, and let counsel decide how to approach them.
Entering accounts or devices that are not yours can be a crime and can taint everything you gathered. In the UK, section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function intending to secure access to any program or data held in any computer, where the access is unauthorized and the person knows it is. Collect what is public or already in your own accounts, and leave the rest to a court process.
Capture how it spread, because every copy is its own problem
A post can become ten pages once it is quoted and mirrored, and each copy needs its own entry. Search for distinctive phrases from the content in quotation marks and for the poster's username, and check the platform's share and quote counts. Capture the search results page too, with the query, the date and your location and language settings.
Note where it first appeared and who amplified it: a news outlet repeating the claim is a different item from a mirror site.
Keep a separate, factual harm record: canceled contracts, withdrawn offers, customer messages that mention the post, each with a date and source.
Related readOnline reputation checklist for individualsAdmissibility differs by country, so label each rule
No single standard decides whether a capture is accepted. These are examples read from primary sources, not a full picture of any country.
United States. Federal Rule of Evidence 902 is described above. Rule 901(a) requires the party offering an item to produce evidence sufficient to support a finding that the item is what they claim it is, and Rule 901(b) lists ways to do so, including a witness with knowledge and the item's own appearance, contents and distinctive characteristics taken with all the circumstances. State courts apply their own rules.
England and Wales. The preservation duty in Practice Direction 57AD runs from the moment a person knows they are or may become a party and lasts until the conclusion of the proceedings, including any appeal. It applies to the Business and Property Courts of England and Wales, not to every UK court. Scotland and Northern Ireland have their own procedure, which this guide has not read, so do not assume the same duty applies there.
Australia. Section 161 of the Evidence Act 1995 (NSW) presumes that a document purporting to record an electronic communication shows how, by whom, when and where it was sent, unless evidence sufficient to raise doubt about the presumption is adduced. The version read here is the New South Wales Act, the Acts of other Australian jurisdictions differ, and whether a given web post counts as an electronic communication is a question for counsel.
One file, five routes: what each route takes from it
Each route takes a different slice of the file, and the table shows what to cut into the working copies.
Related readWhat to do about negative content about me: triage| Route | What it takes from the file | What it does not need |
|---|---|---|
| Platform report | The exact address, the policy breached, a short factual summary, whatever the form asks for | Hashes and the full log |
| Search engine request | Each specific address and which parts are problematic and why | Anything not tied to an address |
| Publisher or host request | The address, the passage, why it is inaccurate, your proof | Poster identity detail |
| Legal letter or notice | An unaltered capture, its location, the meaning, what is false and why | Harm detail beyond what the notice requires |
| Court | Originals, hashes, log, spread and harm records, your own preserved documents | Nothing: counsel selects |
Google's legal removal help page asks for the specific URLs of the content, not a home page, and for detail on which parts are problematic and why, so each address in your file becomes its own submission item.
For a complaint to a website operator in England and Wales under section 5 of the Defamation Act 2013, the notice must state the complainant's name, set out the statement and why it is defamatory, and say where on the website it appears. The Defamation (Operators of Websites) Regulations 2013 add an email address, the meaning the complainant attributes to the statement, the aspects said to be inaccurate or unsupported opinion, confirmation that the complainant cannot identify the poster, and whether they consent to the operator passing on their name and email address.
In South Australia, section 12A of the Defamation Act 2005 (SA), inserted by the Defamation (Miscellaneous) Amendment Act 2020, requires a concerns notice to give the location of the matter such as a web address, a copy where practicable, the imputations alleged and the serious harm said to result. Other states were not read for this guide, so check the Act in your state.
If the content copies your own photograph or text, a copyright notice may be a different route. In the United States, 17 U.S.C. section 512(c)(3) lists its elements, including identification of the work, information reasonably sufficient to locate the material, contact details and a statement under penalty of perjury that the information is accurate and the sender is authorized. Our remove negative content page covers the removal service.
Related readManage your online reputation yourself: a DIY planA realistic first week: when each piece goes into the file
This is a plan, not a promise: the days are working estimates, and a complex matter usually takes longer.
- Hour oneStart the log, capture the page, comments, profile and posting history, calculate each hash and submit each address to a public archive. Touch nothing else.
- Same daySearch for copies, quotes and mirrors and capture each with the same fields. Capture the search results page for your name.
- Day twoCheck that every original has its hash in the log, store originals in two places and set a read-only copy.
- Day threeGather your own proof of falsity: records, invoices, messages. Note the names of witnesses without contacting them.
- Day fiveWrite the harm record with dates and sources. Re-check every address and log any change.
- Day sevenCut working copies for the chosen route, labeled as copies and redacted where needed, and have counsel review before anything is sent.
Re-check the live pages every few days and log each visit.
The next step is to freeze the file, then choose the route
Do the capture today, even if you do not yet know the route. The route depends on the content, the platform, the law and the outcome you want, and none of that must be settled before the evidence is safe.
Capture the content before you reply or report it, and keep the originals untouched. If you want a second pair of eyes on what you have and which route fits, ask for a private review.
Reputation Partners works from a file built this way.
Questions people ask
Is a screenshot enough to prove defamation?
No. A screenshot shows what appeared on one screen and can be challenged on origin, time and editing. It shows publication, not falsity or harm. Use it as one layer beside an archive copy, a saved page file, a hash and a log, and add your own documents showing the statement is untrue.
What if the post is deleted before I capture it?
Log the gap honestly. Look for an archive copy, a search engine snippet, a repost or a quote that shows the wording, and capture those. Do not rebuild the text from memory and present it as a capture. Ask counsel whether a preservation request to the platform or host is available in your jurisdiction.
Can I record a call or video meeting with the poster?
Rules on recording conversations differ by country and sometimes by state, and some places require everyone on the call to consent. A recording made without proper consent can create a problem of its own. Ask counsel first, and do not start contact with the poster just to produce material.
How long should I keep the file?
Keep the untouched originals until the matter is over, including any appeal, and until your counsel says otherwise. If a dispute goes quiet, keep the file anyway: a post that resurfaces is easier to deal with when the first capture is intact.
