Submitting Screenshots and Chat Logs as Evidence in Cyber Harassment Cases

I. Introduction

Cyber harassment is now one of the most common forms of personal, reputational, and psychological abuse in the Philippines. It may occur through social media posts, private messages, group chats, emails, SMS, messaging applications, fake accounts, doxxing, threats, blackmail, repeated insults, malicious accusations, non-consensual sharing of intimate material, impersonation, or coordinated online attacks.

Because cyber harassment often happens through digital platforms, victims commonly rely on screenshots, chat logs, downloaded message histories, URLs, profile links, device records, and account information as evidence. These materials can be powerful, but they must be collected, preserved, authenticated, and presented properly. A screenshot may show what was said, when it was said, by whom it appeared to be said, and how the victim was affected. However, screenshots can also be challenged as incomplete, altered, fabricated, taken out of context, or unauthenticated.

This article discusses how screenshots and chat logs may be used as evidence in Philippine cyber harassment cases, the legal principles that govern them, the practical steps victims should take, and the common mistakes that may weaken digital evidence.

II. Cyber Harassment in the Philippine Legal Setting

There is no single offense called “cyber harassment” that covers every online abusive act. Instead, cyber harassment may fall under several laws depending on the specific conduct.

Possible legal bases include the Cybercrime Prevention Act of 2012, the Revised Penal Code, the Safe Spaces Act, the Anti-Photo and Video Voyeurism Act, the Anti-Violence Against Women and Their Children Act, the Special Protection of Children Against Abuse, Exploitation and Discrimination Act, laws against identity theft or computer-related offenses, and civil law provisions on damages.

Cyber harassment may involve acts such as:

Repeated threatening messages; public humiliation or shaming; online stalking; non-consensual posting of private information; sexual remarks or gender-based online abuse; spreading false accusations; impersonation using fake accounts; threatening to leak private photos or conversations; sending obscene or abusive material; coordinated harassment by multiple accounts; extortion through digital communications; and harassment directed at minors, women, employees, students, public figures, or private individuals.

The correct legal remedy depends on the facts. Some cases are criminal, some are civil, some involve administrative complaints, and some may require immediate protection, takedown requests, school or workplace intervention, or platform reporting.

III. Why Screenshots and Chat Logs Matter

Screenshots and chat logs are often the first evidence available to a victim. They may show the actual offensive words, account names, timestamps, profile photos, message threads, threats, images, attachments, links, group chat participants, or pattern of repeated conduct.

In a cyber harassment case, screenshots and chat logs may help prove:

1. The existence of the communication or post;
2. The content of the abusive message;
3. The identity or apparent identity of the sender;
4. The date, time, and sequence of events;
5. The platform or application used;
6. The public or private nature of the communication;
7. The victim’s reaction or damage suffered;
8. The repeated or continuing nature of the harassment;
9. The presence of threats, sexual content, defamatory statements, coercion, blackmail, or intimidation; and
10. The connection between the online account and the alleged offender.

However, screenshots and chat logs are not automatically accepted simply because they are shown to authorities or attached to a complaint. They must satisfy rules on relevance, admissibility, authentication, and integrity.

IV. Screenshots and Chat Logs as Electronic Evidence

Under Philippine rules on electronic evidence, digital communications and electronic documents may be presented in legal proceedings. Chat logs, emails, text messages, social media posts, screenshots, downloaded data, and other electronic records may be treated as electronic evidence if they are relevant and properly authenticated.

A screenshot is usually a visual capture of what appeared on a device screen at a particular time. A chat log may be a native record from a messaging application, an exported conversation file, a downloaded platform archive, or a printed copy of messages.

The key evidentiary issue is not merely whether the screenshot exists. The key issue is whether the party presenting it can reasonably show that it is genuine, accurate, complete enough for the purpose offered, and connected to the person alleged to have sent or posted the material.

V. Relevance, Materiality, and Competence

Before evidence is admitted, it must generally be relevant and competent.

Evidence is relevant when it has a tendency to prove or disprove a fact in issue. In cyber harassment cases, screenshots and chat logs are relevant when they show the abusive act, the sender, the target, the timing, the repetition, the threat, the sexual or defamatory content, the identity of participants, or the resulting harm.

Evidence is material when it relates to an issue that matters in the case. A private insult may be relevant in one case but immaterial in another if it does not prove the specific legal element being alleged.

Evidence is competent when it is not excluded by law or rules. Even relevant screenshots may be challenged if they were illegally obtained, altered, unreliable, privileged, or violative of privacy rights.

VI. Authentication: Proving That the Evidence Is Genuine

Authentication is one of the most important issues for screenshots and chat logs. The court or investigating authority must be given a basis to believe that the digital evidence is what the submitting party claims it is.

A victim or witness may authenticate screenshots by testifying that:

They personally received the messages or saw the posts; the screenshots fairly and accurately show what appeared on their device or account; the screenshots were taken on a particular date or soon after the messages appeared; the account shown belonged to or was used by the alleged offender, based on identifiable details; the conversation was not edited, fabricated, or materially altered; and the printed copies or files submitted are true reproductions of the original digital material.

Authentication may also be supported by:

Profile links, usernames, account IDs, phone numbers, email addresses, timestamps, URLs, metadata, device information, exported platform records, message notifications, corroborating witnesses, admissions by the sender, replies from the account, prior communications, payment or identity records, SIM registration information where lawfully obtained, police or cybercrime unit verification, platform records, or forensic examination.

A screenshot alone may be enough for preliminary assessment, but stronger proof is often needed if the accused denies ownership of the account, claims hacking, alleges fabrication, or argues that the screenshot was edited.

VII. Best Evidence and Original Electronic Records

In traditional evidence law, the “best evidence” rule generally requires the original document when the contents of a document are in issue. For electronic evidence, the concept of an “original” is adapted to the nature of digital records.

A printout or output readable by sight may be treated as an original if it accurately reflects the electronic data. Still, it is better to preserve the actual electronic source whenever possible. A screenshot should not be the only preserved record if the original message thread, account, URL, exported data, or device remains available.

For stronger evidence, the victim should preserve:

The original device where the messages were received; the original account where the messages are accessible; the full conversation thread; exported chat histories where available; URLs of posts or profiles; downloaded copies of images, videos, or attachments; notification emails; backup files; and cloud records.

Deleting the original conversation after taking screenshots may weaken the case because the other side may argue that the evidence can no longer be verified.

VIII. Chain of Custody and Preservation of Digital Evidence

Chain of custody refers to the documented handling of evidence from collection to presentation. It is especially important when evidence may be altered, transferred, copied, or stored digitally.

For ordinary complainants, chain of custody does not always need to be as technical as forensic evidence in complex cybercrime cases, but careful documentation helps. A victim should record:

When the screenshot was taken; who took it; what device was used; where the original message or post was located; whether the post was public or private; whether the account was later deleted, blocked, renamed, or deactivated; where the files were stored; who had access to them; and whether any copies were made.

A simple evidence log can help. For example:

“March 3, 2026, 9:15 p.m. — Screenshot taken by complainant using iPhone 14 from Messenger conversation with account named X. Original conversation still visible in Messenger. Screenshot saved to phone gallery and backed up to Google Drive. No edits made except file renaming.”

The purpose of this documentation is to show that the evidence was preserved in a reliable manner.

IX. How to Properly Take Screenshots for Evidence

When taking screenshots, the goal is to capture not only the offensive content but also the surrounding context that makes the evidence understandable and credible.

A good screenshot should show:

The sender’s account name, username, phone number, or email address; the profile photo or identifying details; the date and time; the full message content; previous and subsequent messages for context; the platform or app interface; the URL if it is a web page; the group chat name and participants if relevant; and any visible reactions, shares, comments, or attachments.

For social media posts, capture:

The full post; the poster’s name and profile link; the date and time posted; comments and replies; number of shares or reactions if relevant; the URL; any tagged persons; and the account profile page showing identifying information.

For private messages, capture:

The conversation header; the message sequence; timestamps; the sender’s profile; the victim’s replies, if necessary for context; attachments; voice notes or files; and the continuity of the thread.

For group chats, capture:

The group name; participant list; relevant messages; timestamps; who sent each message; the role of the harasser; and whether others participated, encouraged, or witnessed the harassment.

Avoid cropping screenshots too tightly. Cropped screenshots may appear suspicious or incomplete. If privacy concerns require redaction, keep an unredacted master copy and submit redacted copies only when appropriate.

X. Printing Screenshots and Chat Logs

Screenshots are often submitted as printed attachments to complaints, affidavits, position papers, or court filings. Printed copies should be clear, legible, and organized.

Each page should ideally include:

A page number; exhibit marking; description of what the screenshot shows; date and time captured; source platform; and reference to the relevant paragraph in the affidavit or complaint.

For example:

“Annex A-1: Screenshot of Facebook message from account ‘Juan D.’ to complainant dated 10 January 2026, showing threat to publish private photos.”

Printed screenshots should not be blurry, cut off, or rearranged in a confusing order. If the conversation is long, provide both a full chronological transcript and selected screenshots of key portions. The full record helps avoid accusations of cherry-picking.

XI. Chat Logs, Exports, and Transcripts

Many messaging platforms allow users to export chats or download account data. Exported chat logs may be stronger than individual screenshots because they can show continuity and preserve more information. However, exports can also be challenged if they are editable text files or lack metadata.

A practical approach is to submit both:

1. Screenshots of the most important messages; and
2. A complete or relevant exported chat log showing the broader conversation.

A transcript may also be prepared for readability, especially when messages are long, numerous, or difficult to read in image format. The transcript should be identified as a transcription, not as the original. It should be accompanied by the screenshots or native records from which it was made.

The person who prepared the transcript should be able to attest that it accurately reflects the original messages.

XII. Metadata and Technical Information

Metadata is information about a digital file or communication, such as creation time, modification time, sender information, file type, device data, and other technical details. In cyber harassment cases, metadata can help establish authenticity, timing, and source.

However, ordinary screenshots may contain limited useful metadata, and some apps strip or alter metadata. Therefore, screenshots should not be the only evidence preserved if more complete records are available.

Potentially useful technical details include:

Message IDs; email headers; account IDs; URLs; IP logs where lawfully obtained; device information; file creation dates; original filenames; platform archive data; cloud backup timestamps; and forensic images of devices.

Victims should avoid using editing applications on evidence files. Even innocent editing, such as cropping, highlighting, or converting files, may affect metadata. It is better to preserve the original file and make separate working copies for annotation.

XIII. Notarized Affidavits and Sworn Statements

Screenshots and chat logs are usually submitted together with a complaint-affidavit or sworn statement. The affidavit explains what happened and identifies the attached digital evidence.

The affidavit should state:

The identity of the complainant; the relationship, if any, with the alleged harasser; the platform used; how the complainant received or discovered the messages; when the messages were received or discovered; how the screenshots were taken; that the screenshots are faithful reproductions of what appeared; the effect of the harassment; and the legal relief sought.

A sample paragraph may read:

“Attached as Annex ‘A’ series are screenshots of the messages I received from the account named ________ on ________. I personally took these screenshots from my mobile phone on ________. The screenshots fairly and accurately show the messages as they appeared in my account. The original conversation remains available on my device/account, and I am willing to present the same if required.”

The affidavit should be truthful, specific, and chronological. Exaggeration or omission can damage credibility.

XIV. The Role of Witnesses

Witness testimony may strengthen screenshots and chat logs. Witnesses may include:

The victim who received the messages; a friend or family member who saw the messages on the victim’s phone; a group chat participant; an administrator of a page or group; an IT personnel who preserved the evidence; a law enforcement officer who viewed or documented the post; or a digital forensic examiner.

Witnesses can help prove that the messages existed, were seen by others, caused harm, or came from a particular account.

XV. Identifying the Harasser

One of the hardest issues in cyber harassment cases is proving who controlled the account. The account name shown in a screenshot is not always conclusive. A harasser may use a fake name, dummy account, borrowed phone, spoofed number, or anonymous profile.

Identity may be proven through direct and circumstantial evidence, such as:

The account uses the person’s real name or photo; the account has a long history of interaction with the victim; the account mentions private facts known only to the offender; the writing style matches prior communications; the account is linked to a known phone number or email; the person admitted sending the messages; the account previously used identifiable photos or posts; the person reacted when confronted; the same account contacted mutual friends; or platform or law enforcement records connect the account to the person.

A case should not rely solely on “the profile picture looks like the person” if stronger proof is available.

XVI. Screenshots from Disappearing Messages and Ephemeral Content

Some platforms allow disappearing messages, expiring stories, temporary posts, or view-once media. These are difficult to preserve. Victims should document them promptly, but they should also be aware of platform rules and possible privacy implications.

For disappearing content, record:

The time it was viewed; the sender; the platform; the content; whether any notification was triggered by taking a screenshot; and whether other witnesses saw it.

Where lawful and safe, a victim may use screen recording to preserve disappearing content, but this should be done carefully. Secret recording of private communications may raise separate legal issues depending on the circumstances. Legal advice is especially important where audio, video, intimate content, or private conversations are involved.

XVII. Audio, Video, Voice Notes, and Screen Recordings

Cyber harassment may include voice messages, video calls, livestreams, reels, TikTok videos, Facebook stories, or screen recordings. These forms of evidence should be preserved in their original format when possible.

For voice notes and videos, preserve:

The original file; the platform source; timestamps; sender identity; file metadata if available; a transcript for readability; and screenshots showing where the file appeared in the conversation.

A transcript should not replace the original audio or video. It should only assist the court, prosecutor, investigator, or lawyer in reviewing the material.

XVIII. Privacy, Illegally Obtained Evidence, and Ethical Limits

Victims should collect evidence lawfully. Evidence obtained through hacking, unauthorized access, password theft, account takeover, spyware, or unlawful interception may create legal problems and may expose the collector to liability.

A victim generally has a stronger position when preserving messages sent directly to them, posts publicly visible to them, or conversations in which they are a participant. The situation becomes more legally sensitive when the evidence comes from someone else’s private account, a secretly accessed device, a private group where the victim is not a member, or intercepted communications.

Philippine law protects privacy, correspondence, communication, and personal data. The need to prove harassment does not automatically justify unlawful access or indiscriminate disclosure of private information.

A safe rule is: preserve what you lawfully received or accessed, avoid hacking or deception, keep unredacted evidence confidential, and disclose only what is necessary for the complaint or case.

XIX. Data Privacy Considerations

Screenshots and chat logs often contain personal information, including names, photos, phone numbers, addresses, school or workplace details, private messages, intimate images, medical details, or information about minors.

When submitting evidence, disclose only what is necessary. Redact irrelevant personal information of third parties when appropriate, but keep unredacted originals available for lawful review. If minors are involved, extra care is required.

Evidence should be stored securely. Victims should avoid publicly posting the screenshots as “evidence” unless advised, because doing so may create risks of defamation, privacy violations, retaliation, or further spread of harmful material.

XX. Non-Consensual Intimate Images and Sensitive Material

Cyber harassment sometimes involves threats to post intimate photos, actual posting of intimate images, or blackmail using private videos. These cases require special care.

Victims should preserve evidence without unnecessarily reproducing or distributing the intimate material. When filing complaints, ask how sensitive evidence should be submitted. It may be better to place sensitive files in sealed storage, submit them directly to investigators, or use controlled review procedures.

Do not send intimate evidence casually through group chats, public posts, or unsecured email. The goal is to preserve proof while preventing further harm.

XXI. Cyber Libel and Screenshots

When the harassment involves false and damaging public statements, the issue may include cyber libel. Screenshots can help show the defamatory statement, publication, identity of the poster, and date of posting.

For cyber libel-related evidence, screenshots should capture:

The exact statement; the account that posted it; the date and time; the URL; comments, shares, or public visibility; and identifying details of the account.

Context is critical. A statement may be defended as opinion, fair comment, truth, privileged communication, satire, or lack of identification. Therefore, screenshots should be complete enough to show the full post and surrounding discussion.

XXII. Gender-Based Online Sexual Harassment

The Safe Spaces Act recognizes gender-based sexual harassment, including online conduct in certain circumstances. Evidence may include unwanted sexual remarks, sexist insults, misogynistic attacks, threats, stalking, repeated messages, sexualized comments, or non-consensual sharing of sexual content.

Screenshots should show not only the offensive words but also the pattern, repetition, and gender-based or sexual nature of the conduct. If the harassment occurred in a school, workplace, public platform, or organization, internal complaints may also be available in addition to criminal or civil remedies.

XXIII. Threats, Coercion, and Extortion

If the chat logs contain threats, blackmail, or demands for money, sex, silence, or other acts, preserve the full conversation. Do not delete earlier messages that show how the threat developed.

Important evidence includes:

The demand; the threat; the deadline; payment instructions; account numbers or e-wallet details; phone numbers; usernames; screenshots of calls; proof of money sent, if any; and any admission by the offender.

Victims should be careful when responding. Do not escalate, threaten back, or agree to unsafe meetups. Preserve the messages and seek help from appropriate authorities or counsel.

XXIV. Filing a Complaint Using Screenshots and Chat Logs

A victim may bring screenshots and chat logs to law enforcement, prosecutors, barangay authorities where applicable, school or workplace bodies, platform administrators, or private counsel depending on the nature of the case.

A typical evidence packet may include:

A complaint-affidavit; chronological narrative; printed screenshots; digital copies in a USB drive or secure storage; exported chat logs; URLs and account links; profile screenshots; witness affidavits; medical or psychological records if damages are claimed; proof of identity; and a summary index of annexes.

For criminal complaints, the affidavit should connect the evidence to the elements of the alleged offense. For civil or administrative cases, the evidence should connect the conduct to injury, policy violation, damages, or protective relief.

XXV. Organizing Evidence Chronologically

Cyber harassment cases are easier to understand when organized by date and platform.

A useful structure is:

1. Background of the relationship or conflict;
2. First incident;
3. Escalation;
4. Threats or public posts;
5. Victim’s response or attempts to stop the harassment;
6. Continued harassment;
7. Harm suffered;
8. Evidence list;
9. Relief requested.

Each screenshot should be labeled and referenced in the narrative.

Example:

“On 15 February 2026, Respondent sent me a private message threatening to post my private photos unless I replied to him. A screenshot of this message is attached as Annex ‘B-1.’ On the same day, he sent another message containing my home address. This is attached as Annex ‘B-2.’”

This style helps the investigator or court follow the case without guessing.

XXVI. Common Objections to Screenshots and Chat Logs

Screenshots and chat logs may be challenged on several grounds.

1. Fabrication

The other side may claim that the screenshot was fake or edited. To counter this, preserve original files, native chat threads, metadata, exports, and corroborating evidence.

2. Incompleteness

The other side may claim that the screenshot omitted earlier messages or provocation. To counter this, preserve the full conversation and explain any missing portions.

3. Lack of identity

The other side may claim that the account was not theirs. To counter this, gather evidence linking the account to the person.

4. Hacking or unauthorized access

The other side may claim the evidence was unlawfully obtained. To counter this, show that the messages were sent to the victim, publicly visible, or lawfully accessed.

5. Context

The other side may claim the words were jokes, sarcasm, opinion, or taken out of context. To counter this, include surrounding messages, repeated conduct, and evidence of impact.

6. Alteration

The other side may claim the file was modified. To counter this, preserve original files and avoid editing.

7. Hearsay

The other side may argue that the messages are out-of-court statements. The legal treatment depends on the purpose for which the statements are offered. A message may be offered not only to prove the truth of what it says, but to show that it was made, that a threat was communicated, that harassment occurred, or that the victim was placed in fear.

XXVII. The Importance of Context

A single screenshot may not tell the whole story. Context matters. The same words may have different legal implications depending on the surrounding facts.

For example:

“I’ll expose you” may be a serious threat if accompanied by private photos or demands. “You’re a thief” may support a defamation theory if publicly posted as a factual accusation. Repeated “hi” messages may not be harassment alone, but may become relevant if part of stalking after repeated demands to stop. A sexual joke may become actionable when unwelcome, repeated, public, gender-based, or made in a workplace or school setting.

Therefore, evidence should show both the specific offensive content and the broader pattern.

XXVIII. Preservation Before Blocking or Reporting

Victims often want to block or report the harasser immediately. This may be necessary for safety, but evidence should be preserved first when possible.

Before blocking, consider saving:

Screenshots of the profile; screenshots of the conversation; profile URL; username or handle; phone number or email; group chat details; mutual contacts; public posts; and full message history.

After blocking, some platforms may hide or limit access to the conversation. Reporting may also cause content to be removed. Content removal is useful for protection but may make later proof harder if evidence was not preserved.

XXIX. Platform Reports and Takedown Requests

Screenshots and chat logs can support platform reports. Most platforms prohibit threats, harassment, impersonation, hate speech, non-consensual intimate content, and doxxing. A platform report may lead to content removal, account restriction, or preservation of internal records.

However, platform removal does not automatically create a legal case, and legal remedies may still require affidavits and admissible evidence. Save confirmation emails or report numbers from the platform.

XXX. Digital Forensics

In serious cases, digital forensic assistance may be useful. This is especially true where:

The accused denies sending the messages; the account was deleted; metadata is important; the evidence involves files, malware, hacking, or impersonation; the harassment caused major financial or reputational harm; or the evidence will be heavily contested.

A forensic examiner may help preserve device data, verify timestamps, extract message databases, examine metadata, or prepare a technical report. The examiner may later testify.

Ordinary victims do not always need forensic examination at the beginning, but they should avoid actions that make later forensic work impossible, such as factory-resetting phones, deleting apps, clearing chat histories, or overwriting files.

XXXI. Evidence from Third Parties

Sometimes the victim does not directly receive the harassing post. A friend, coworker, classmate, or group chat member may send screenshots. These can be useful, but they are stronger if the third party also gives a statement.

For example, if a defamatory post was made in a private group where the victim is not a member, the person who saw the post should identify how they accessed it, when they saw it, and whether the screenshot fairly shows what appeared.

Without the third-party witness, the screenshot may be harder to authenticate.

XXXII. Minors and School-Based Cyber Harassment

When minors are involved, additional protections and procedures may apply. Schools may have anti-bullying policies, child protection mechanisms, disciplinary procedures, and reporting obligations. Parents or guardians may need to assist in preserving evidence and filing complaints.

Screenshots should be handled carefully to avoid further circulation of harmful content involving minors. If sexual material involving minors is involved, do not duplicate or distribute it casually. Seek immediate assistance from appropriate authorities or counsel.

XXXIII. Workplace Cyber Harassment

Cyber harassment may also occur in workplace chats, emails, messaging groups, or social media posts involving coworkers, supervisors, clients, or employees.

Evidence may support:

An HR complaint; administrative investigation; sexual harassment complaint; labor dispute; civil claim; criminal complaint; or request for workplace protection.

Preserve company chat records, emails, screenshots, incident reports, witness names, HR correspondence, and proof of the effect on work. Employees should also consider company policies on confidentiality, data privacy, and device use.

XXXIV. Barangay Proceedings and Cyber Harassment

Some disputes may pass through barangay conciliation depending on the parties and the nature of the complaint. However, not all cases are appropriate for barangay settlement, especially where the law provides exceptions, urgent protection is needed, the parties live in different cities or municipalities, serious offenses are involved, or the matter falls under special procedures.

Screenshots may be used during barangay proceedings to explain the dispute, but victims should be careful about confidentiality, especially in cases involving sexual content, minors, or threats.

XXXV. Civil Liability and Damages

Screenshots and chat logs may support claims for damages when cyber harassment causes injury. Potential damages may include moral damages, actual damages, exemplary damages, attorney’s fees, or other relief depending on the facts and legal basis.

Evidence of harm may include:

Medical or psychological records; therapy receipts; lost income; missed work or school; witness statements; reputational harm; business losses; public comments; anxiety or fear; and evidence that the harassment continued despite demands to stop.

Screenshots prove the conduct; additional evidence often proves the damage.

XXXVI. Demand Letters and Cease-and-Desist Letters

Before or alongside formal action, a lawyer may send a demand letter or cease-and-desist letter. Screenshots and chat logs may be attached or described to show the basis of the demand.

A demand letter may ask the harasser to:

Stop contacting the victim; remove posts; preserve evidence; stop sharing private material; issue a correction or apology; pay damages; or refrain from further defamatory or threatening conduct.

However, a demand letter should be carefully drafted. Accusing someone publicly or threatening improper action may create complications.

XXXVII. Settlement and Compromise

Some cyber harassment disputes are resolved through apology, takedown, undertaking, settlement, or mediation. Screenshots and chat logs help establish leverage and document what happened.

A settlement should be written clearly. It may include:

Removal of content; non-contact agreement; confidentiality; non-disparagement; payment; return or deletion of private material; admission or non-admission clauses; consequences for breach; and withdrawal or continuation of complaints where legally allowed.

Not all criminal cases can be freely compromised. Some offenses involve public interest or special legal rules. Legal advice is important before settling.

XXXVIII. What Not to Do

Victims should avoid the following:

Do not edit original screenshots. Do not delete the original conversation. Do not rely only on cropped images. Do not publicly post all evidence out of anger. Do not hack the harasser’s account. Do not impersonate someone to obtain more evidence. Do not threaten the harasser with unlawful retaliation. Do not send sensitive images to friends “for proof.” Do not reset or replace the device without backup. Do not ignore timestamps, URLs, and profile links. Do not submit disorganized screenshots without explanation. Do not exaggerate facts in affidavits. Do not assume a fake account is legally proven without supporting identity evidence.

XXXIX. Practical Evidence Checklist

A strong cyber harassment evidence packet should include:

1. Full screenshots of offensive messages or posts;
2. Screenshots showing account name, username, URL, phone number, or email;
3. Profile page screenshots;
4. Full conversation context;
5. Exported chat logs where available;
6. URLs of posts, profiles, comments, and pages;
7. Date and time of capture;
8. Original device and account preserved;
9. Backup copies stored securely;
10. Evidence log;
11. Witness statements;
12. Platform report confirmations;
13. Proof of identity link between account and alleged harasser;
14. Proof of harm or damages;
15. Complaint-affidavit explaining the evidence; and
16. Unredacted master copy plus redacted copies where needed.

XL. Sample Evidence Log

Item	Date Captured	Source	Description	Storage Location	Notes
Annex A-1	10 Jan 2026	Messenger	Threatening message from account “_____”	Phone gallery / USB	Original thread still available
Annex A-2	10 Jan 2026	Facebook profile	Profile page of account “_____”	Phone gallery / USB	Shows username and profile photo
Annex B-1	12 Jan 2026	Public Facebook post	Post accusing complainant of theft	PDF printout / URL saved	Public post, 47 reactions
Annex C-1	13 Jan 2026	Messenger export	Full chat history	Secure drive	Exported without edits

XLI. Sample Affidavit Language for Screenshots

“I personally received the messages shown in Annexes ‘A’ to ‘A-5’ through my Facebook Messenger account. I took the screenshots using my mobile phone on 15 March 2026. The screenshots fairly and accurately show the messages as they appeared on my account. I have not edited or altered the screenshots. The original conversation remains accessible in my Messenger account, and I am willing to present my device and account for verification if required.”

XLII. Sample Affidavit Language for Public Posts

“On 20 March 2026, I saw a public Facebook post made by the account named ________ containing statements accusing me of ________. I took screenshots of the post, including the account name, profile photo, date of posting, comments, and URL. Copies are attached as Annexes ‘B’ to ‘B-4.’ The screenshots accurately reflect what I saw online at the time.”

XLIII. Sample Affidavit Language for Chat Exports

“I exported the chat history from my account on 21 March 2026 using the platform’s export function. The exported file is saved in its original form in my secure drive and copied to the USB submitted with this complaint. The export corresponds to the conversation shown in the screenshots attached as Annexes ‘C’ to ‘C-10.’”

XLIV. Presenting Evidence in Court or Before Prosecutors

When presenting screenshots and chat logs, the submitting party should be ready to explain:

What the evidence is; where it came from; who captured it; when it was captured; how it was preserved; why it is relevant; how it identifies the offender; whether the original remains available; and whether the copies are accurate.

The evidence should not be dumped without explanation. A clear narrative, exhibit list, and witness testimony make the evidence more persuasive.

XLV. The Limits of Screenshots

Screenshots are useful but limited. They show what appeared on a screen, not always the full technical truth. They may not prove who controlled an account, whether a message was sent from a particular device, whether a post was later edited, or whether timestamps were affected by time zones or settings.

Therefore, screenshots should be treated as part of the evidence, not necessarily the whole case. The strongest cases combine screenshots with native records, witness testimony, platform data, admissions, forensic evidence, and proof of harm.

XLVI. Conclusion

Screenshots and chat logs are central evidence in Philippine cyber harassment cases. They can document threats, abuse, sexual harassment, defamation, stalking, impersonation, blackmail, and other online misconduct. But their value depends on proper collection, preservation, authentication, and presentation.

Victims should act quickly but carefully. They should capture full context, preserve original records, avoid editing files, document the chain of custody, protect sensitive personal data, and submit evidence through affidavits and organized annexes. They should also avoid unlawful evidence-gathering methods such as hacking, unauthorized access, or public exposure of private material.

In cyber harassment cases, digital evidence tells the story. The more complete, authentic, and well-organized that story is, the stronger the complaint or claim becomes.