A single threatening message can be alarming. A repeated pattern of unwanted contact, surveillance, intimidation or abuse can affect where a person goes, how they work and whether they feel safe at home. The best evidence for harassment cases does more than show that something upsetting occurred. It records who was involved, what happened, when it happened, how often it occurred and why the material can be relied on.
For private individuals, employers and legal representatives, the priority is to preserve relevant information early and lawfully. Digital material can be deleted, CCTV footage may be overwritten, memories fade, and an unstructured collection of screenshots can be difficult to use when a complaint must be assessed quickly.
What makes evidence persuasive?
Evidence is strongest when it is relevant, contemporaneous, authentic and independently supported. In practical terms, a clear record made at the time of an incident will generally carry more weight than a recollection written months later. Messages that remain on the original device are more useful than cropped screenshots with no date, sender details or surrounding context.
Harassment allegations also frequently turn on pattern. An isolated unpleasant interaction may require a different response from repeated unwanted contact or conduct that causes fear for a person’s safety. The evidence should therefore show the sequence, frequency and escalation of behaviour, not merely the most serious incident.
It is equally important to preserve material fairly. Context matters. Keep the complete exchange where possible, including messages sent before and after the concerning communication. Do not alter screenshots, annotate original files or engage in further contact solely to obtain more evidence. That can compromise the record and increase risk.
The best evidence for harassment cases
Original communications and complete message records
Text messages, emails, social media direct messages, voicemails and letters are often central evidence. Preserve the originals on the relevant mobile, computer or platform account. Take screenshots that show the sender’s account name or number, date and time, and the full message thread where practical.
Screenshots alone can be challenged or misunderstood. Retain the original device and, where available, download account data or save emails in their native format. Record the relevant profile URL, username, phone number and email address. If a sender changes accounts or numbers, note that connection rather than assuming it will be obvious later.
Do not respond to abusive material unless there is a clear safety, workplace or legal reason to do so. A calm, unambiguous request for contact to stop may be relevant in some circumstances, but personal safety comes first. If contact is threatening or immediate, seek Police assistance.
A contemporaneous incident log
A factual incident log is one of the most effective ways to turn scattered events into a usable chronology. Start it as soon as possible and update it after each occurrence. Record the date, time, location, people present, what was said or done, how you responded, and any evidence created or available.
Keep the language measured. Write, “Received six calls from number ending 1234 between 8.12 pm and 9.04 pm. No voicemail was left,” rather than drawing conclusions about motive. You can separately record the impact on you, such as missed work, changed travel arrangements or concern for your children, but distinguish your observations from facts you can verify.
For a workplace, the log should identify who received the report, what immediate steps were taken, whether a welfare check occurred, and any directions given to the parties. This supports a fair internal process as well as an external complaint if one follows.
Independent witnesses
Independent witnesses can confirm an encounter, identify a person or vehicle, describe the conduct they observed, or verify that a disclosure was made at the time. Their value does not depend on them seeing every event. A colleague who saw a person waiting outside an office, a neighbour who observed repeated visits, or a manager who received an immediate report may each corroborate part of the wider pattern.
Ask witnesses to make their own factual notes promptly. Avoid coaching them or circulating a preferred version of events. Their account should be in their own words and should identify what they personally saw, heard or received. If they hold relevant messages, photographs or access records, they should preserve those originals too.
CCTV, access records and location evidence
Many useful records are held by third parties and can disappear quickly. Retail centres, apartment buildings, workplaces, schools and transport providers may hold CCTV, visitor logs, swipe-card data, vehicle entry records or call records. Footage is commonly retained for a limited period only.
Make a timely written request for relevant material to be preserved. Include the precise date, time range, location and reason for the request. Do not expect a business to release footage directly without considering privacy or legal obligations, but a preservation request may prevent routine deletion while the appropriate process is followed.
Photographs or video taken by a person who lawfully witnessed an event can also assist. Preserve the original file, as metadata may help establish when it was created. Do not put yourself in danger to obtain footage, follow someone, trespass, or attempt to access private systems.
Call logs, online activity and device material
Call logs can establish frequency and timing even where no message was left. Platform notifications, password-reset alerts, attempted logins, unwanted location-sharing requests and repeated account contacts may be relevant in matters involving digital harassment.
Take careful steps to secure your accounts: change passwords, enable multi-factor authentication, review connected devices and preserve evidence before deleting or blocking material where it is safe to do so. Never access another person’s accounts, install monitoring software, guess passwords or intercept private communications. Evidence gathered unlawfully can create serious legal and practical problems.
Where the authenticity or extent of digital activity is disputed, a properly conducted forensic examination may be required. This is particularly relevant for employment disputes, litigation or serious personal safety matters, where the source and integrity of records must be clearly explained.
Evidence that shows impact and risk
The conduct itself is central, but evidence of its impact can assist decision-makers to understand seriousness and urgency. Relevant records may include reports made to an employer, school or security team; medical or counselling records where appropriate; changes to work arrangements; security incident reports; and copies of applications or reports made to Police.
These records should not be treated as a substitute for primary evidence of the conduct. Rather, they can corroborate that concerns were raised at the time and demonstrate the practical effect on the person targeted. Keep disclosures proportionate and protect sensitive health, family and employment information.
Risk can escalate where there are threats, persistent contact after a clear request to stop, unwanted attendance at a home or workplace, monitoring, property damage, domestic violence concerns, access to weapons, or a breach of an existing order or workplace direction. In an immediate emergency, call 111. Do not wait until a file is perfectly organised before seeking help.
Preserve evidence without creating new problems
A disciplined evidence file should separate originals from working copies. Save material in date order, use clear file names, and keep a simple record of where each item came from and when it was obtained. For example: “2026-11-14_2042_SMS_from_021XXXX1234.png”. Store a secure backup and restrict access to people who genuinely need it.
Avoid publishing allegations or evidence on social media. Public posts can escalate behaviour, alert the other person, affect witnesses, and create privacy or defamation risks. The right audience may be Police, an employer, a lawyer, a school, a tenancy provider or another authority, depending on the circumstances.
For organisations, preservation should be prompt and neutral. Retain emails, CCTV, access data and complaint records in line with policy, prevent unnecessary sharing, and ensure any investigation gives all relevant parties a fair opportunity to respond. A rushed process can fail both the person making the complaint and the person accused.
When professional investigation is appropriate
Professional assistance can be valuable when identification is uncertain, conduct occurs across multiple locations, a person’s whereabouts or assets are relevant to lawful proceedings, digital and physical evidence must be coordinated, or a matter requires objective reporting for legal counsel, insurers or an employer.
The scope should be clear from the outset: what question needs answering, what evidence is already available, what lawful enquiries may be undertaken, and how findings will be reported. Discreet, properly documented work is more useful than speculation. The Neill Group can assist with lawful investigation, evidence preservation support and detailed reporting across New Zealand where a matter requires experienced field capability.
The strongest file is not necessarily the largest one. It is the file that gives a decision-maker a clear, accurate and lawful account of what occurred, while protecting the safety and dignity of everyone involved. Begin with the next incident, preserve it carefully, and seek urgent support whenever the risk feels immediate.