A private chat screenshot can do serious damage at work, especially when it is cropped, edited, captioned, or shared to make it look like you said something you did not say. In the Philippines, this situation can raise several legal issues at the same time: libel or cyber libel, privacy violations, unauthorized processing or disclosure of personal data, possible workplace harassment, and a civil claim for damages. The right remedy depends on what was edited, where it was shared, who saw it, whether your name or identity was clear, and how it affected your reputation, job, safety, or mental well-being.

The most important first step is not to fight back online. Preserve the evidence properly, identify who shared the edited screenshot, document the work-related harm, and choose the right forum: HR, the National Privacy Commission, the prosecutor’s office, the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the regular courts.

Why edited private chat screenshots are legally serious in the Philippines

A screenshot is often treated by people as “proof.” But screenshots can be incomplete, misleading, or manipulated. A private message can be:

Cropped to remove context;
Edited to change words, timestamps, names, or sequence;
Captioned with accusations;
Forwarded to co-workers, group chats, supervisors, clients, or social media;
Used in HR proceedings without allowing you to explain;
Combined with your photo, name, position, or company identity to shame you.

Under Philippine law, the problem is not simply that someone took a screenshot. The legal issue is usually the harmful use of the screenshot: spreading a false accusation, exposing private information without lawful basis, humiliating a person, or using private communications to damage someone’s reputation at work.

A single incident may give rise to several remedies. For example, if a co-worker edits a private chat to make it look like you admitted stealing company funds, then posts it in a work group chat, this may involve:

Possible issue	Why it matters
Cyber libel	The edited screenshot was published through a computer system and may damage your reputation.
Civil damages	You may claim compensation for moral injury, humiliation, anxiety, and reputational harm.
Data privacy complaint	Your personal information or private communication may have been processed, disclosed, or shared without lawful basis.
Workplace discipline	The employer may investigate the employee who circulated the edited screenshot.
Unfair HR action	If management acted only on the edited screenshot without due process, the employee affected may have labor remedies.

Is sharing an edited private chat screenshot defamation?

In Philippine law, defamation generally means harming another person’s reputation through false or malicious statements. Defamation may be criminal, civil, or both.

The main criminal forms are:

Libel under Articles 353 and 355 of the Revised Penal Code;
Cyber libel under Section 4(c)(4) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012;
Oral defamation or slander under Article 358 of the Revised Penal Code, if the defamatory statement was spoken.

Article 353 of the Revised Penal Code defines libel as a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or place a person in contempt. Article 355 covers libel committed by writing, printing, lithography, engraving, radio, phonograph, painting, theatrical exhibition, cinematographic exhibition, or similar means. The text of the Revised Penal Code is available through Lawphil’s copy of Act No. 3815.

Cyber libel applies when libel is committed through a computer system or similar digital means under Republic Act No. 10175. This can include posts, group chats, emails, online platforms, messaging apps, shared drives, or other digital channels.

The usual elements of libel or cyber libel

For a libel or cyber libel case, these elements are usually examined:

There is a defamatory imputation. The screenshot or caption accuses you of something damaging, such as cheating, stealing, harassment, dishonesty, immorality, incompetence, corruption, or other conduct that would lower people’s opinion of you.
The imputation is published. “Published” does not always mean posted publicly on Facebook. In libel law, publication generally means the statement was communicated to at least one person other than you.
You are identified or identifiable. Your name does not always need to appear. If co-workers can tell that the screenshot refers to you because of your photo, initials, nickname, position, department, phone number, or surrounding details, identifiability may be present.
There is malice. Malice may be presumed from a defamatory publication, but the facts still matter. Editing a screenshot, removing context, or adding a misleading caption can be strong practical indicators of bad faith.
For cyber libel, a computer system or digital means was used. A work group chat, social media post, email blast, Slack/Teams channel, shared Google Drive folder, or company messaging platform may satisfy the digital publication element.

The Supreme Court in Disini v. Secretary of Justice discussed cyber libel under the Cybercrime Prevention Act and treated the law as applying libel principles to digital publication. The decision is available on Lawphil.

Is it still libel if the screenshot came from a real chat?

Yes, it can still be libel if the screenshot was used in a false or misleading way.

A person may defend themselves by saying, “Totoo naman ang screenshot.” But the legal issue may not be that the chat existed. The issue may be that the screenshot was:

Altered;
Cropped to reverse the meaning;
Presented without the preceding or following messages;
Combined with a false caption;
Attributed to the wrong person;
Shared to people who had no need to see it;
Used to accuse you of misconduct you did not commit.

For example:

Situation	Possible legal view
A co-worker shares a full, accurate screenshot with HR because it relates to a workplace complaint.	May be defensible if done in good faith and through proper channels.
A co-worker edits the screenshot to make it look like you insulted a client, then posts it in the office group chat.	Possible cyber libel and civil damages.
A supervisor forwards private chat screenshots to the whole department to shame you.	Possible privacy violation, civil liability, and labor-related issue.
Someone posts a cropped screenshot on Facebook naming your employer and calling you a thief.	Possible cyber libel and civil damages; also possible HR consequences.

Truth alone is not always a complete answer if the publication was malicious, unnecessary, misleading, or violative of privacy rights. Context matters heavily.

Privacy rights involved in private chat screenshots

Philippine law protects privacy in several ways.

Civil Code privacy and dignity rights

Article 26 of the Civil Code says every person must respect the dignity, personality, privacy, and peace of mind of others. It recognizes civil actions for damages, prevention, and other relief for acts such as prying into privacy, meddling with private life, intriguing to cause alienation from friends, and similar acts. The Civil Code text is available on Lawphil’s copy of Republic Act No. 386.

This is important because some privacy violations may not neatly fit into a criminal offense but may still justify a civil case. For example, humiliating someone at work by spreading private messages may support a civil action even if prosecutors do not pursue a criminal case.

The Supreme Court has recognized that Article 26 covers intentional torts affecting dignity, privacy, and peace of mind. In MVRS Publications, Inc. v. Islamic Da’wah Council of the Philippines, the Court explained that Article 26 may apply even to acts that do not constitute a criminal offense. The decision is available on Lawphil.

Data Privacy Act concerns

Private chats often contain personal information, such as names, photos, phone numbers, workplace details, opinions, relationship information, health details, financial details, or sensitive personal information. The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information in both government and private sector systems. The law is available through the National Privacy Commission’s Data Privacy Act page.

Under the Data Privacy Act, “processing” is broad. It can include collecting, recording, storing, using, sharing, disclosing, or destroying personal data. Forwarding or posting private chat screenshots may therefore be considered processing of personal information.

A privacy complaint may be relevant when:

The screenshot contains your personal data;
It was shared without your consent or another lawful basis;
It was disclosed to people who had no legitimate need to see it;
The disclosure caused harm, humiliation, discrimination, or risk;
The employer failed to secure personal data in company systems;
HR or management circulated the screenshot more widely than necessary.

The National Privacy Commission recognizes a right to file a complaint when personal information has been misused, maliciously disclosed, improperly disposed of, or when data privacy rights are violated. The NPC’s formal complaint procedure is explained on its Filing a Complaint page.

Work-related remedies when private screenshots are spread in the office

Because the incident happened at work, you may have remedies inside the company before or alongside legal action.

Internal HR complaint

An HR complaint may be appropriate when the person who edited or shared the screenshot is:

A co-worker;
A supervisor or manager;
A contractor;
A company officer;
A member of a work group chat;
Someone using company email, company devices, or company platforms.

Your HR complaint should focus on facts, not emotions. Attach the evidence and explain the workplace impact.

A strong HR complaint usually includes:

Date and time you discovered the edited screenshot;
Who sent or posted it;
Where it was posted or circulated;
Who saw it;
Why it is false, edited, misleading, or private;
How it affected your work, reputation, safety, or mental well-being;
What company policies may have been violated;
What immediate protection you need, such as removal, non-retaliation, confidentiality, or separation from the offender.

Employer investigation and due process

If the employer disciplines the person who circulated the edited screenshot, the employer must still observe due process. In Philippine labor practice, this usually means notice, opportunity to explain, hearing or conference when appropriate, and a written decision.

If you are the employee being accused because of the screenshot, you also have rights. Management should not dismiss, suspend, or discipline you based solely on a questionable screenshot without giving you a fair chance to answer.

If the employer uses the edited screenshot to terminate you, possible labor issues may include:

Lack of just cause;
Lack of procedural due process;
Reliance on unreliable or unauthenticated digital evidence;
Retaliation;
Constructive dismissal if the situation becomes intolerable and management fails to act.

When DOLE or NLRC may become relevant

The Department of Labor and Employment (DOLE) and the National Labor Relations Commission (NLRC) are not usually the first agencies for defamation itself. They become relevant when the screenshot incident leads to an employment dispute, such as:

Illegal dismissal;
Unpaid wages after termination;
Preventive suspension issues;
Constructive dismissal;
Retaliation after reporting harassment;
Employer’s failure to follow due process;
Workplace conduct that becomes part of a labor case.

For rank-and-file private employees, illegal dismissal and money claims commonly go through mandatory conciliation-mediation under the Single Entry Approach before proceeding to the NLRC.

Step-by-step: What to do if edited private chat screenshots are spread at work

1. Preserve evidence immediately

Do not rely on one screenshot saved in your phone gallery. Digital evidence can disappear quickly.

Preserve:

The edited screenshot as circulated;
The full original chat, including messages before and after the cropped part;
URLs or links, if posted online;
Message IDs or timestamps, if visible;
Names, usernames, phone numbers, email addresses, and profile links;
Screenshots showing who posted, reacted, commented, or forwarded;
The work group chat name or platform;
Any admission by the sender that they edited or forwarded it;
HR emails, memos, notices, or disciplinary documents;
Witness names and short statements.

If possible, use screen recording to show the post inside the app, including profile, date, comments, and navigation from the app to the post. This helps show that the screenshot was not merely fabricated by you.

2. Do not delete the original chat

People often delete the original conversation out of panic or embarrassment. Avoid doing that. The full chat may be your strongest evidence that the circulated version was edited or misleading.

Keep backups in at least two secure locations, such as:

Your phone;
Encrypted cloud storage;
External drive;
Printed copies for initial review;
A secure email sent to yourself.

3. Write a short incident timeline

Make a timeline while the details are fresh.

Include:

Detail	Example
Date discovered	“March 3, 2026, around 9:30 a.m.”
Source	“Posted by X in the Sales Team Viber group.”
Audience	“Approximately 28 co-workers and two supervisors.”
Content	“Edited screenshot made it appear that I admitted falsifying receipts.”
Correction	“The original chat shows I was quoting another person and denying the act.”
Harm	“Supervisor removed me from client account; co-workers stopped communicating with me.”
Evidence	“Screenshots, screen recording, original chat export, witness messages.”

4. Ask for preservation, not public confrontation

If the post is inside a company platform, send a written request to HR or IT asking them to preserve logs and copies. Use calm language.

You may request preservation of:

Chat logs;
Email headers;
File upload records;
Device assignment records;
Access logs;
CCTV if the incident involved office devices;
Internal investigation notes.

Avoid threatening messages like “I will sue everyone.” Those can distract from your complaint. A clear preservation request is more useful.

5. File an HR complaint if the offender is connected to work

An HR complaint can be faster than a criminal case and may stop the spread. Ask HR to:

Require removal of the edited screenshot;
Direct employees not to share it further;
Investigate the source;
Prevent retaliation;
Keep the matter confidential;
Correct any personnel record affected by the false screenshot.

If HR refuses to act because “personal chat lang ’yan,” explain why it is work-related: it was circulated at work, affected your reputation at work, used company tools, involved employees, or caused workplace consequences.

6. Consider a data privacy complaint with the NPC

A complaint with the National Privacy Commission may be appropriate when personal data or private communications were misused or maliciously disclosed.

The NPC generally requires a formal complaint in a specific format, notarization, and submission through the allowed channels stated on the NPC website. Its formal complaint page states that the complaint may be submitted in person, by courier, or by scanned email, subject to NPC rules and fee schedules.

Useful attachments may include:

Notarized complaint-affidavit or verified complaint;
Copies of the edited screenshots;
Copies of the full original chat;
Proof of disclosure;
Names and contact details of persons involved;
Proof of harm;
Prior data subject request, if any;
Company privacy notice or policies, if relevant.

7. For cyber libel, prepare a complaint-affidavit

For criminal cyber libel, the usual route is a complaint-affidavit filed with the city or provincial prosecutor, often with assistance from the PNP Anti-Cybercrime Group or NBI Cybercrime Division.

The Department of Justice’s citizen charter for filing a complaint for preliminary investigation lists documents such as the Investigation Data Form and complaint-affidavit or sworn statement. The DOJ page is available here: Filing of Complaint for Preliminary Investigation.

A complaint-affidavit should clearly state:

Your identity and relationship to the workplace;
The respondent’s identity, if known;
The exact defamatory statement or edited screenshot;
Where it was published or sent;
Who saw it;
Why it is false, edited, malicious, or misleading;
How you are identifiable;
The harm caused;
The evidence attached;
The laws violated.

8. Seek technical preservation if the post may disappear

For cybercrime matters, law enforcement may help preserve or investigate computer data. Under RA 10175, certain computer data may be preserved, and law enforcement authorities may seek court-issued warrants for disclosure of computer data when legally required. The Cybercrime Prevention Act text is available on Lawphil.

In practical terms, act quickly if the content is on platforms where messages can be deleted, edited, or set to disappear.

9. Consider a civil case for damages

A civil action may be appropriate if your main goal is compensation, injunction, correction, or accountability for emotional distress and reputational harm.

Possible Civil Code bases include:

Article 19: Every person must act with justice, give everyone their due, and observe honesty and good faith.
Article 20: A person who willfully or negligently causes damage contrary to law must indemnify the injured person.
Article 21: A person who willfully causes loss or injury in a manner contrary to morals, good customs, or public policy must compensate the injured person.
Article 26: Protection of dignity, privacy, personality, and peace of mind.
Article 2219: Moral damages may be recoverable in proper cases, including libel, slander, and similar situations.

Civil cases can take time and require filing fees, evidence, and court appearances. But they may be useful when the damage is serious and the criminal route is not enough.

Where to report edited private chat screenshots in the Philippines

Situation	Possible forum	Practical notes
Co-worker spread the edited screenshot in a work chat	HR / management / company grievance process	Fastest way to stop workplace circulation and request internal discipline.
Screenshot was posted online or sent through messaging apps	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Useful for technical investigation and cybercrime documentation.
You want to pursue cyber libel	City or Provincial Prosecutor / DOJ prosecution office	Requires sworn complaint-affidavit and supporting evidence.
Personal data or private messages were misused or maliciously disclosed	National Privacy Commission	Formal complaint usually must follow NPC format and notarization rules.
You were dismissed, suspended, or forced to resign because of the screenshot	DOLE / NLRC process	Focus is labor rights, due process, illegal dismissal, money claims, or constructive dismissal.
You want damages, injunction, or civil accountability	Regular courts	Requires civil complaint, filing fees, and court proceedings.
Threats, stalking, coercion, sexual harassment, or gender-based harassment are involved	Police, prosecutor, HR, and possibly specialized remedies	Other laws may apply depending on the facts.

Common legal scenarios

Scenario 1: A co-worker cropped your message to make you look guilty

This is common in office conflicts. A person may remove the part where you denied an accusation or asked a question, then show only a line that looks damaging.

Possible remedies:

HR complaint for misconduct;
Cyber libel complaint if shared digitally and defamatory;
Civil damages if reputational harm occurred;
NPC complaint if private personal data was maliciously disclosed.

Your best evidence is the full original conversation, not only the edited screenshot.

Scenario 2: A supervisor shared your private chat to shame you

A supervisor’s authority makes the situation more serious. Even if the supervisor had a work-related concern, sharing private messages widely may be unnecessary and disproportionate.

Possible issues:

Abuse of authority;
Violation of company confidentiality policies;
Privacy violation;
Civil damages;
Labor retaliation or constructive dismissal if the conduct makes continued work intolerable.

Scenario 3: The screenshot was posted in a company group chat only

A company group chat can still count as publication. Defamation law does not require nationwide publicity. If a defamatory screenshot was shared with co-workers, supervisors, or clients, the publication element may be present.

Scenario 4: The edited screenshot was sent privately to your boss

A one-on-one message to your boss can still be publication because it was communicated to a third person. However, the sender may argue good faith if they made a legitimate workplace report. The case becomes stronger if the screenshot was edited, false, malicious, or sent with reckless disregard of the truth.

Scenario 5: The screenshot contains sexual, romantic, medical, or family information

This may strengthen the privacy aspect. If the content includes sensitive personal information, sexual content, health information, family matters, or intimate details, the Data Privacy Act, Civil Code privacy rights, Safe Spaces Act, or other laws may become relevant depending on the facts.

Scenario 6: The person who shared it says, “I only forwarded it”

Forwarding can still create liability. In Disini, the Supreme Court distinguished some forms of online participation, but a person who deliberately republishes defamatory content may still face risk depending on their role, intent, and the act done. In workplace reality, “forward lang ako” is not always a safe defense, especially if the person added captions, tagged others, encouraged ridicule, or knew the screenshot was manipulated.

Required documents and evidence checklist

Document or evidence	Why it matters
Government ID	Usually required for complaints, affidavits, and notarization.
Full original chat	Shows context and whether the circulated version was edited.
Edited screenshot as circulated	Shows the defamatory or privacy-violating material.
Screenshots of where it was posted	Shows publication, audience, date, and platform.
Screen recording	Helps prove the post existed inside the actual app or platform.
URLs, usernames, profile links	Useful for cybercrime investigation.
Witness statements	Helps prove who saw it and how it spread.
HR records or work emails	Shows workplace impact.
Medical or counseling records, if any	May support claims of anxiety, distress, or harm.
Loss documents	Shows lost clients, lost job opportunity, suspension, demotion, or income loss.
Company policies	Helps show violation of confidentiality, harassment, IT, social media, or code of conduct rules.
Notarized complaint-affidavit	Usually needed for prosecutor, NPC, and formal proceedings.

Timelines and prescription periods

Deadlines matter. Do not wait too long.

Remedy	Practical timing concern
HR complaint	File as soon as possible, ideally within days, while logs and witnesses are available.
Cybercrime preservation	Act quickly before posts, logs, and accounts disappear.
Criminal libel	Traditional libel has short prescription rules under the Revised Penal Code.
Cyber libel	The Supreme Court in Causing v. People discussed the prescriptive period for cyber libel and held that it prescribes in one year from discovery by the offended party, authorities, or their agents. The 2023 decision is available on Lawphil.
NPC complaint	File promptly; delay can make evidence preservation and causation harder.
Labor case	Labor deadlines vary by claim, but illegal dismissal cases generally have a four-year prescriptive period. Earlier action is still better.
Civil damages	Prescription depends on the cause of action; delay can affect evidence and strategy.

The practical bottleneck is often not the law itself. It is proof. Posts are deleted, phones are replaced, employees resign, group chats are renamed, and witnesses become reluctant. Preserve evidence early.

If you are a foreigner affected by edited screenshots at work in the Philippines

Foreigners working in or dealing with a Philippine workplace may generally use Philippine remedies when the harmful act occurred in the Philippines, involved persons in the Philippines, or affected a Philippine workplace.

Practical points for foreigners:

If you are in the Philippines, you can usually execute affidavits before a Philippine notary.
If you are abroad, Philippine authorities may require documents notarized abroad and authenticated through apostille, depending on where the document was executed.
If you authorize someone in the Philippines to file or follow up, a Special Power of Attorney may be needed.
If messages or evidence are in another language, certified or competent translations may be needed.
If the respondent is abroad, service, identification, and enforcement may be more difficult.
If the platform data is held by a foreign company, law enforcement access may require additional procedures and may take time.

Foreigners should also consider immigration or employment consequences if the edited screenshot is being used to threaten visa status, work permit status, or professional reputation.

What not to do

Avoid these common mistakes:

Do not retaliate by posting your own accusations online. You may create a separate libel or privacy issue.
Do not edit your own screenshots. Even “highlighting” or cropping can be attacked later. Keep originals.
Do not delete the original chat. It may be your best defense.
Do not threaten witnesses. Ask them calmly to preserve what they saw.
Do not rely on verbal HR promises. Send written follow-ups.
Do not assume a group chat is “private” for legal purposes. If others saw the defamatory content, publication may be present.
Do not wait until the post disappears. Preserve immediately.
Do not exaggerate facts in your affidavit. Inconsistencies can weaken your case.
Do not ignore company proceedings. If you receive a notice to explain, answer within the deadline and attach the full context.

How to write a strong complaint narrative

Whether you file with HR, the prosecutor, the NPC, or a court, your story should be clear and evidence-based.

A strong narrative follows this structure:

Who you are State your job, department, relationship to the respondent, and why the workplace context matters.
What happened Describe the original private chat and the edited version.
How it was edited or misleading Identify specific changes: missing messages, altered words, removed timestamps, false caption, changed sender name, misleading sequence.
Where it was shared Name the platform, group chat, email list, social media page, or office channel.
Who saw it Identify co-workers, supervisors, clients, HR officers, or outsiders if known.
Why it harmed you Explain reputational damage, work consequences, anxiety, humiliation, lost opportunities, or disciplinary action.
What evidence proves it Attach the original chat, edited screenshot, screen recordings, witness statements, and work records.

Frequently Asked Questions

Can I sue someone for posting edited screenshots of my private messages in the Philippines?

Yes, depending on the facts. If the edited screenshots falsely damage your reputation and were shared with others, you may consider cyber libel, civil damages, and workplace remedies. If personal data or private information was disclosed without lawful basis, a data privacy complaint may also be relevant.

Is a private work group chat considered publication for cyber libel?

It can be. Publication generally means the defamatory matter was communicated to someone other than the person defamed. A work group chat with co-workers, supervisors, or clients may satisfy this requirement even if the post was not public on Facebook.

What if the screenshot is real but cropped?

A cropped screenshot can still be defamatory or misleading if it removes context and creates a false impression. The full original chat is crucial. Courts and investigators will look at the meaning conveyed to the people who saw the circulated version.

Can HR discipline an employee for sharing private chat screenshots?

Yes, if the act violates company policy, confidentiality rules, anti-harassment rules, data privacy obligations, or standards of workplace conduct. However, the employer must still observe due process before imposing discipline.

Can I file a complaint with the National Privacy Commission?

Yes, if the incident involves misuse, malicious disclosure, or improper processing of your personal information. The NPC requires a formal complaint format and usually notarized documents. Its procedure is explained on the NPC’s Filing a Complaint page.

Should I go to the barangay first for cyber libel?

Barangay conciliation may apply to some disputes between individuals in the same city or municipality, but criminal offenses with penalties exceeding one year imprisonment or fines above the Katarungang Pambarangay threshold are generally outside barangay conciliation. Cyber libel complaints are usually handled through law enforcement and the prosecutor’s office, not resolved solely at the barangay.

Can I file cyber libel if the person only sent the screenshot to one supervisor?

Possibly. Sending a defamatory statement to one third person may still be publication. The sender may claim good faith or privileged communication if it was a legitimate report to management, but that defense becomes weaker if the screenshot was edited, false, malicious, or unnecessary.

What if I do not know who edited the screenshot?

Preserve all versions and identify the earliest source you can find. Ask HR or IT to preserve logs if company systems were used. For online or messaging-app incidents, the PNP Anti-Cybercrime Group or NBI Cybercrime Division may assist with technical investigation, although identifying anonymous accounts can take time and may require platform cooperation.

Can I demand that the post be deleted?

Yes, you can request removal through HR, the platform, the group admin, or a formal demand. However, preserve evidence before deletion. If the post is removed before you capture proof, your case may become harder to prove.

What damages can I claim?

Depending on the case, you may claim moral damages for mental anguish, social humiliation, wounded feelings, and besmirched reputation; actual damages for proven financial loss; exemplary damages in proper cases; attorney’s fees when legally justified; and other relief such as injunction or correction. The exact relief depends on the forum and evidence.

Key Takeaways

Edited private chat screenshots at work can create liability for cyber libel, privacy violations, civil damages, and workplace misconduct.
A screenshot does not become harmless just because part of it came from a real chat. Cropping, editing, false captions, and misleading context matter.
Preserve the edited screenshot, the full original conversation, proof of publication, witness details, and work-related harm.
HR may address the workplace misconduct, but cyber libel and privacy complaints may require separate legal steps.
The National Privacy Commission may be relevant when private messages or personal data were misused or maliciously disclosed.
Cyber libel generally requires a defamatory imputation, publication, identification, malice, and use of digital means.
Act quickly because posts, logs, accounts, and witnesses can disappear.
The strongest cases are built on calm documentation, complete context, and properly preserved digital evidence.