A stalking case can turn on details that seem minor at the time: a vehicle appearing outside a workplace for six minutes, a message sent after a blocked number was used, a package left where it could not have arrived by accident. Knowing how to document stalking evidence creates a factual record that law enforcement, counsel, security professionals, and a court can assess without relying solely on memory.
The objective is not to investigate the person yourself or prove every motive. It is to preserve what occurred, when it occurred, who observed it, and how it affected your safety. A calm, contemporaneous record is generally more credible and more useful than a large collection of unorganized screenshots gathered weeks later.
If there is an immediate threat, unwanted physical contact, forced entry, a weapon, or a person waiting near you, call 911 or local emergency services. Documentation matters, but it must never take priority over getting to a safe location.
Start a Stalking Incident Log Immediately
Maintain one central incident log in a format you can access securely. A simple document, notebook kept in a safe place, or secure digital file can work. What matters is consistency. Make an entry as soon as practical after each incident, while the sequence, language used, and surrounding circumstances are still clear.
For every entry, record the date, exact or approximate time, location, and a factual description of what happened. Identify the person involved if known, but do not speculate. Write, “A dark SUV with partial plate 7KM was parked across from the office from approximately 8:10 to 8:25 a.m.,” rather than, “He was surveilling me.” The first statement can be verified. The second may be true, but it is a conclusion that investigators must establish from the pattern and supporting evidence.
Include the names and contact information of witnesses, any report number issued by police, and the evidence associated with that event. Note the impact as well: missed work, a changed route, a security alert, anxiety requiring medical care, or a canceled trip. In many cases, the pattern of conduct and its effect on the target are as significant as any single contact.
Preserve the Original Record
Do not edit an old entry to make it read better. If you remember something later, create a new, dated note stating what was added and why. This protects the integrity of the record. A clean chronology helps demonstrate that information was recorded in real time rather than reconstructed to fit a later narrative.
For high-risk individuals or corporate executives, an assistant, chief of staff, security lead, or trusted family member may maintain a parallel operational log. The affected person should still preserve their own firsthand account where possible. Separate accounts can corroborate timing and response actions.
Preserve Digital Evidence Without Altering It
Digital contact is often central to stalking matters. Save texts, emails, social media messages, voicemails, call logs, direct messages, account notices, and posts that reference you, your family, your workplace, or your movements.
Take screenshots that show the full context: sender identifier, date and time, message content, and the relevant platform. One cropped image of a threatening sentence may be less useful than a sequence showing repeated contact after a request to stop. If the platform allows an export or download of account data, preserve that material as well.
Keep original files whenever possible. Forwarding an email can alter some metadata, and reposting content can remove context. Save a copy to a secure location, then retain the original device and account in their existing state. Record the device used, account name, and date the material was preserved.
Do not delete messages, even if they are distressing. If repeated viewing is harmful, ask a trusted person, attorney, or security professional to help preserve and organize the material. Also avoid responding merely to create more evidence. A response can escalate the situation, muddy a no-contact boundary, or be selectively presented by the other party. Whether to send one clear written request for no further contact depends on the circumstances and should be considered with legal or law enforcement guidance.
Photograph Physical Evidence and the Scene
Physical evidence can include letters, gifts, damaged property, unwanted items left at a residence or office, handwritten notes, or signs that someone has been present near a protected location. Photograph items where they were found before moving them, if it is safe to do so. Take both wide shots that establish the setting and closer images that capture detail.
Use ordinary photos and video in a lawful manner. Do not trespass, enter the suspected person’s property, confront them, follow them, or attempt to place a tracking device on a vehicle or person. Those actions can create legal exposure and significantly increase danger.
Handle physical material as little as possible. Place letters, notes, and packaging in separate clean envelopes or bags, label them with the date, time, location, and person who found them, and store them securely. If law enforcement takes possession, record the officer’s name, agency, date, and any property or case number.
Security camera footage requires special attention because many systems overwrite recordings quickly. Preserve relevant footage as soon as possible, including several minutes before and after the incident. If a neighboring business, building manager, parking facility, or hotel may have footage, make a prompt written request for preservation through the appropriate channel. An attorney or investigator may be able to assist, but access rules vary.
Build a Timeline That Shows the Pattern
Stalking rarely appears persuasive when reviewed as isolated events. A timeline shows escalation, repetition, proximity, and the connection between online conduct, physical appearances, third-party contact, and attempted access to personal or professional spaces.
Arrange incidents in chronological order. Include dates when the person was told not to contact you, dates of police reports, changes in workplace or residential security, and any protective order terms. Cross-reference each incident to the corresponding screenshot, photo, voicemail, report, or witness statement.
A useful timeline also distinguishes known facts from concerns requiring further assessment. For example, “Vehicle observed near residence on three dates” is a fact if documented. “Vehicle is linked to the suspect” should be marked as unconfirmed unless law enforcement or a qualified investigator has established that connection. This discipline gives the record greater credibility.
Report Through the Right Channels
Report criminal conduct, threats, violations of protective orders, or repeated unwanted contact to local law enforcement. Ask for an incident or case number every time you make a report, even if an officer cannot take immediate action. Repeated reports may establish the pattern needed for a stronger intervention.
Your options may also include a protective order, workplace reporting, school or university security, property management, corporate security, human resources, or counsel. The appropriate route depends on the relationship, jurisdiction, threat level, and whether the conduct crosses state or national borders.
For executives, public figures, and clients with elevated exposure, documentation should be integrated into a broader threat-management plan. That may include residential and travel security measures, protective intelligence review, staff notification protocols, legal coordination, and discreet monitoring of relevant threats. Evidence gathering alone cannot solve a protection problem if predictable access points remain open.
Protect the Evidence, and Protect Yourself
Use strong passwords and multi-factor authentication for email, cloud storage, social media, and mobile accounts. Review location-sharing settings, shared family accounts, vehicle apps, smart-home access, and connected devices. A former partner, employee, or associate may retain access through legitimate credentials rather than sophisticated technical means.
Tell a limited circle of trusted people what is happening and establish a check-in plan. Provide workplace or building security with a photograph and clear instructions if appropriate. Avoid posting real-time locations, travel details, or routine changes online. If you believe a device or account has been compromised, preserve what you can before resetting or replacing it, then seek qualified technical and legal advice.
The strongest record is factual, timely, complete, and safely preserved. It gives decision-makers something far more durable than a vague account of fear: a disciplined account of conduct, escalation, and risk. Keep documenting, keep the record secure, and let trained professionals handle the work that should never rest on your shoulders alone.
