
Guides
Document an unauthorized image: a handoff record
Document an unauthorized image with a handoff-ready record for URLs, accounts, timestamps, source, copy history, reports, and safe storage.
Document an unauthorized image with a handoff-ready record that lets a reviewer, lawyer, or trusted helper trace what you found without receiving the image. Use the fields below for the page, source, copy history, and any reports already made.
Mistake: Checking for danger only after contacting the uploader
The most costly error is approaching the uploader before checking for retaliation, doxxing, shared accounts, workplace contact, or physical access. Use a device they cannot monitor, and ask someone trusted for help without sharing the disputed file. If danger is immediate in the United States, call 911; documentation can wait.
Document or wait?
Is there immediate danger?
Call emergency services
Use a safe device
Mistake: Treating every report as the same request
Reports fail when a request omits its target, source, policy basis, or requested outcome. Check the service's current reporting routes, then supply the exact URL, identify the source, describe the issue briefly, and state what action you want the reviewer to take. The record below organizes details for a recipient; it does not replace that service's current submission instructions.
Save the submitted wording as a PDF or screenshot before sending it. Track a social-platform report, host notice route, search delisting request, and legal complaint as separate entries, because sending a request to a social network does not notify the host. Record each destination separately.
For each entry, note its report number, response, appeal status, next review date, and person responsible. Once an item is removed, visit the source address directly: a search delisting does not erase a copy held by the host. Confirm the page itself rather than trusting search results, then add the check to the log.
Maintain the log in restricted storage while the response continues or while legal advice is being sought; there is no universal retention period for every case. Before deleting records connected to a claim, ask an attorney. Secure handling matters even after an individual platform has replied.
If a page disappears before you report it, retain its URL, account details, timestamp, any lawful capture, and the context explaining how you found it. Do not repost the image to create evidence; a written description can still help a reviewer understand the matter.
Mistake: Leaving the image's source and permissions uncertain
A handoff breaks down when the record leaves the image's origin, ownership, or permitted use uncertain. Trace the earliest source you know, distinguish the creator, copyright owner, and depicted person, and check the publication agreement plus approved project uses instead of inferring permission.
Reader / What the record needs to provide
- Platform reviewer
- The exact URL and account identifiers that locate the item
- Copyright route
- The copyrighted work identified, and the material located precisely
- Attorney
- Who collected each item, when, from where, and what changed
- Trusted helper
- A redacted version that does not pass the image along
The U.S. Copyright Office lists parts of an effective DMCA notice, including information reasonably sufficient to locate the material and identify the copyrighted work. That supports recording the address and tracing origin before sending a request; DMCA filing steps belong after those details are assembled.
Trace image source
- Earliest known source
- Creator
- Copyright owner
- Person depicted
- Publication agreement
- Approved uses
- Leave metadata intact
WITNESS material on video evidence and archiving discusses creation metadata, surrounding context, access history, accurate descriptions, and keeping originals distinct from edits. Its recommendations address human-rights documentation, which is broader than an ordinary platform complaint; use the preservation points that fit, and leave the rest.
Mistake: Making another copy just to show what appeared
The risky move is routinely downloading or forwarding the disputed image, which creates another copy that may leak. A highest-resolution file is not generally needed. Describe the content instead; retain one untouched original only when lawful possession is possible, and keep it in a restricted folder.
This advice is for an ordinary unauthorized image or video involving an adult. Intimate content, threats, stalking, domestic abuse, or a child depicted in material require specialist support. Do not download or forward suspected child sexual abuse material; use the platform's child-safety route and report violations to NCMEC.
For an intimate image captured when the depicted person was under 18, NCMEC Take It Down may help participating platforms detect matching material using a hash created on the user's device. Use only a copy already there; never download or send an image just to generate that hash. Intimate-image support can help with specialist concerns.
Mistake: Capturing a page without enough locating details
Page evidence is hard to act on if its address, account, or surrounding context is missing. Before blocking an account or deleting anything, write down the URL, account identifiers, timestamps, and adjacent text; keep an unredacted original capture only where that is lawful.
Capture page details
- Full page URL
- Direct media URL if safe
- Profile URL
- Username and display name
- Account identifier
- Date, time, time zone
- Caption, claims, tags, visibility
The page-detail screenshot checklist describes a useful capture: include the browser address and enough details to locate the item. Do not crop your sole record. Preserve the first capture without alteration, then create a separate redacted copy for email or team discussion.
Do not use public archives such as the Wayback Machine run by Internet Archive for sensitive or intimate material, since the process may expose another copy. Instead, describe the page in writing and note how you found it. That background can let a reviewer understand the record without being sent the image.
Mistake: Altering the original or treating metadata as proof
Altering the only captured original with comments, marks, or redactions blurs the boundary between the source and your later notes. Leave its metadata intact, label each annotated or concealed working copy as edited, and use the working version for arrows, highlights, and explanations.
Metadata by itself proves little: it may be absent, changed, or misunderstood. Preserve the original alongside surrounding context, access history, and corroborating records. A hash can reveal that a particular file has changed, but it cannot prove an image is authentic, was consented to, or belongs to a specific person.
Mistake: Making the handoff depend on your recollection
A handoff becomes unusable when a recipient must rely on your memory to identify a file or explain how it changed. Give every item a label that lets a reviewer, lawyer, or trusted helper follow its origin and revisions without seeing the image or asking you to reconstruct events.
Build handoff record
- Incident number and folder
- One lawful original or capture
- Text record of URLs and accounts
- Original work or release
- Timeline
- Report submissions and receipts
- Responses and appeal messages
For every record item, note its collector, collection time, source, and any later alteration. Identify the untouched master and its restricted storage location; name edited or redacted duplicates and their editor. Someone new to the situation should be able to follow the trail without calling you.
- The exact page URL, platform, and account identifiers
- The timestamps and surrounding text you saw
- The earliest known source and the rights holders you traced
- Which copy is the untouched original, and where it is stored
- Which copies are edited or redacted, and who made them
Handoff-ready record
Copy this template into a restricted document and complete the fields that apply. Describe the image rather than attaching or forwarding it; share a redacted copy when the recipient does not need the unredacted record.
- Case label:
- Prepared by / collector:
- Collection time:
- Recipient / person responsible:
- Brief description of the issue:
- Exact page URL:
- Platform and account identifiers:
- Timestamps shown and surrounding text:
- How the page was found:
- Earliest known source:
- People and rights roles identified:creator, copyright owner, and depicted person, as known
- Permission or agreement checked:
- Evidence item labels and sources:
- Untouched original:label and restricted storage location, if lawfully retained
- Edited or redacted copies:label, editor, and changes made
- Report entry (repeat for each destination):destination, request submitted, report number, response, appeal status, next review date, and person responsible
- Requested action and stated basis:
- Sharing or safety limits for the recipient:







