The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Preserve the complete record as soon as possible. Keep the original phone, computer, account and message state unchanged; capture the full conversation or post with sender, recipient, handle, timestamps, platform and surrounding context; export the service’s native data when available; and maintain an evidence index, factual timeline and transfer log. Make a protected second copy, share only what is necessary, and ask an employer, lawyer or authorized investigator to issue formal preservation requests for records held by providers.
This guide is U.S.-focused. Rules on recording consent, privacy, filing deadlines, retention and admissibility vary by jurisdiction and by whether you are dealing with an employer, the Equal Employment Opportunity Commission (EEOC), a court or another agency.
As an Amazon Associate I earn from qualifying purchases.
Why preserving the whole record matters
A screenshot can show offensive words, but an investigation may also need the messages before and after them, the account that sent them, the time zone, attached media, links, reactions, edits, deletion notices and the connection to work. The EEOC’s Enforcement Guidance on Harassment in the Workplace recognizes that conduct can occur through work-related communications systems, accounts, devices and platforms. It also treats electronic-platform material and corroborating evidence as potentially relevant.
Free tools Windows power users keep installed
One-click scans. No signup required.
Preservation is different from proving a legal claim. Your task is to keep reliable facts available; an agency, employer, court or lawyer decides whether the conduct meets a legal definition, whether a recording was lawful and whether a filing is timely.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
First response: stabilize the source and protect yourself
Put safety ahead of collection
If the harasser is threatening you, has access to your home or accounts, or you fear immediate harm, move to a safer place and contact emergency or support services. Do not risk confrontation to obtain a device. Use a trusted device for help if the harasser may monitor your phone or accounts.
Stop changing the record
- Do not delete, unsend, edit, crop, annotate or forward the original messages merely to create a cleaner record.
- Do not reset the phone or computer, uninstall the messaging application or sign out of an account if doing so could remove local data.
- Avoid continuing the conversation solely to generate more evidence. If you must communicate for work or safety, preserve that exchange as a new item.
- Note whether the service uses disappearing messages, auto-delete rules or temporary stories. Capture what is available promptly and record the expiration feature.
Keep the device and account available. If a device is employer-owned, do not bypass security controls; ask counsel or an authorized investigator how to proceed.
Capture complete context from each source
Text and messaging applications
- Open the conversation and record the conversation header, contact name, account handle or phone number, platform name and any group membership.
- Capture the message sequence by scrolling methodically. Include enough preceding and following messages to show what prompted the statement and what happened afterward.
- Ensure each image includes visible dates and times when the application displays them. Record the device’s time zone and whether the application shows local time, a server time or only a relative label such as “yesterday.”
- Save attachments separately: photographs, videos, voice notes, documents, reactions, stickers and linked pages. Preserve the original file rather than only a thumbnail.
- Look for an export, download or data-access feature in the application. Keep the downloaded archive in its original form, including its folder structure and file names.
If the application cannot export a conversation, screenshots are still useful as a readable working copy. They are not automatically a complete or authenticated record.
- Save the original message, not just a printed page or a pasted quotation. Preserve the full header when your mail service permits it, including sender and recipient fields, date and time, subject, reply chain and message identifiers.
- Download attachments in their original formats and keep the message-to-attachment relationship clear in your file names or index.
- Capture the mailbox or folder context when relevant: for example, whether the message was in a work account, a personal account used for work, a shared mailbox or a forwarded chain.
- Export the message using the mail service’s native option, such as an original-message or archive download, when available. Do not alter the exported file.
Social-media posts, direct messages and comments
- Capture the profile page or account handle, display name, profile URL as shown by the service, post or message text, visible date and time, and the platform indicator.
- Include replies, quoted posts, reactions, edits, attached media and links that explain the exchange.
- Record whether the material was public, private, limited to followers or posted in a work-related group. Note the group or page name and your relationship to it.
- Use the service’s download or data-access tool when offered. Keep the resulting archive unchanged and identify the account from which it was obtained.
Disappearing or deleted material
Capture disappearing messages, temporary stories and deletion notices immediately. Write down when you saw the material, what the service called the feature, and whether you captured it before or after expiration. Do not claim that a screenshot recreates content you never saw. Ask a lawyer or qualified digital-forensics examiner whether a forensic acquisition is proportionate; do not attempt invasive recovery that could alter the device.
Choose the right preservation method
Use more than one method when practical. A quick readable capture can preserve content that is about to vanish, while a native export can retain information that a screenshot omits.
| Method | What it is good for | Limitations and precautions |
|---|---|---|
| Contextual screenshot | Fast, readable capture of a conversation, profile, timestamp, URL or deletion notice. | Can omit metadata, surrounding messages or original files; do not crop or annotate the original capture. |
| Native export or download | Preserves the service’s own archive and may retain more metadata, attachments and message structure. | Availability and contents differ by service. Keep the archive unchanged and document how it was obtained. |
| Forensic acquisition | Can preserve a device or account in greater technical detail when a dispute warrants it. | Usually requires a qualified examiner or lawyer; necessity and cost depend on the proceeding. Do not improvise tools that could change data. |
| Printed copy or PDF | Easy for a reviewer to read and mark during an interview or meeting. | Use only as a convenience copy. Retain the native file and original screenshots because printouts can omit metadata and attachments. |
The U.S. Department of Justice advises that electronic communications should be preserved in their native electronic format when feasible; if that is not feasible, use and document another preservation method. Treat screenshots and PDFs as working copies, not substitutes for every original.
Build an evidence index and factual timeline
Assign neutral evidence IDs
Give each item a simple identifier such as E-001, E-002 and E-003. Use the same ID in the file name, index, timeline and cover note. Avoid labels that state a conclusion, such as “proof of assault.”
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
For every item, record:
- Evidence ID and a descriptive file name.
- Source platform, account, sender, recipient and any group or page.
- Date, time and time zone as displayed, plus any uncertainty about the device clock.
- File type, size and whether it is a screenshot, native export, attachment or other copy.
- Device used and the export or capture method.
- Name of the person who made the copy and the date and time it was made.
- Where the unchanged original and each working copy are stored.
Write a factual timeline
List events in order and link each event to an evidence ID. Include when the conduct occurred, when you reported it, who received the report, any response, later contact or retaliation concern, and witnesses who may have relevant information. Identify applicable workplace policies or work assignments without speculating about motives. If an entry is based on memory rather than a preserved item, label it as your recollection.
Keep originals, working copies and backups separate
Protect the original
Keep the original export, message file or capture unchanged. Do not redact, resize, convert or add comments to that file. Create a separate working copy for redaction, page numbering or submission. Retain the device or account state that produced the file as far as practical.
Make a controlled second copy
Store a second copy on a dedicated USB flash drive or other protected storage, separate from the everyday device. Restrict access with a strong device password and account security. Keep unrelated personal communications in a separate folder or storage location.
NISTIR 8387 notes that digital files are very easy to change and that maintaining data integrity is critical. NIST recommends more than one copy, secure storage, access controls and integrity checks. A hash can help detect later changes to a file; a lawyer or qualified examiner can advise whether creating and recording hashes is proportionate for your situation.
Use a consistent naming scheme
For example, use E-001_text-export_2026-10-17.zip and E-001_readable-copy.pdf. Do not overwrite the original with a redacted version. Record any conversion, redaction or page ordering in the index.
Log every transfer and control access
A short chain-of-custody-style log makes later questions easier to answer. For each transfer, record:
- Evidence ID and exact file name.
- Date and time, including time zone.
- Who transferred it and who received it.
- Transfer method, such as an encrypted drive or an approved secure-upload portal.
- Purpose of the transfer.
- Whether the recipient returned, copied or retained the file.
Ask HR, an investigator or a lawyer for a secure upload method before sending intimate material. Avoid public posts, ordinary links with broad permissions and unencrypted channels when a safer option is available. Share only what is necessary for the stated purpose. Redact unrelated intimate or private material from a working copy when appropriate, but preserve an unredacted original and record what was redacted and why.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
Workplace investigations generally cannot promise complete confidentiality. Ask who will have access, how the material will be stored, whether it may be shared with the accused or witnesses, and how to submit a safety concern separately.
Recommended Free Tools
Request preservation from employers and providers
Identify likely locations before sending a request
List the people, accounts, devices, date range and systems that may contain evidence. Consider work email, chat and collaboration tools; company phones and laptops; personal devices used for work; social-media accounts; cloud folders; calendars; access logs; and deletion or retention records. Include both the sender’s and recipient’s accounts when known.
Use a factual written request
Send the request to HR, an employer investigator, in-house counsel or your lawyer, depending on the situation. State that you are asking the recipient to preserve potentially relevant records and identify:
- The names, account handles, phone numbers or email addresses involved.
- The date range and time zone.
- The platforms, devices, mailboxes, channels, groups and folders.
- Messages, attachments, edits, reactions, metadata, access records and deletion logs where applicable.
- Any automatic deletion, retention or legal-hold settings that could affect availability.
Keep a copy of the request and its delivery confirmation. Do not overstate what you know; distinguish observed facts from assumptions about where a record is stored.
Understand provider preservation limits
In the United States, a government agency can use the preservation mechanism in 18 U.S.C. § 2703(f) for records held by a provider. The statute describes an initial 90-day preservation period that can be renewed for another 90 days after a governmental request. This is not a universal deadline, a guarantee that content will be produced, or a private self-help request available in every case. A government agency or lawyer must determine whether formal process is available and appropriate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →FTC and DOJ guidance issued in 2024 states that companies and individuals have a legal responsibility to preserve documents when involved in government investigations or litigation. The exact duty depends on the proceeding and jurisdiction; ask counsel or the investigating agency what notice and process are required.
Prepare a package for HR, the EEOC or a lawyer
Organize a submission so a reviewer can understand it without guessing which file supports which event:
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
- Cover note: State who you are, the work relationship, the date range and what you are asking the recipient to do. Keep it factual and concise.
- Timeline: List events chronologically and cite evidence IDs.
- Evidence index: Describe every file, its source, capture or export method, date and storage location.
- Native records: Provide unchanged exports and original attachments through the requested secure method.
- Readable copies: Add screenshots or PDFs in the same order as the timeline, with page numbers or evidence IDs.
- Witness and policy information: Identify people who may have direct knowledge and relevant workplace policies, without asking witnesses to coordinate stories.
- Receipt and retention note: Ask the recipient to confirm receipt and tell you how long the submission will be retained. Keep your own originals and a copy of everything sent.
For an EEOC matter, follow the agency’s current filing and submission instructions for your location. Preserve your own complete package even after uploading or handing it over.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to fix them
Submitting only a cropped screenshot
Problem: The image hides the account, time, preceding messages or the full thread.
Fix: Capture the header and surrounding sequence, save attachments and provide the native export when available.
Editing or annotating the only copy
Problem: A reviewer cannot distinguish the original from later changes.
Fix: Restore the unchanged file if possible, make a separate working copy and document every conversion or redaction.
Relying on a single phone or cloud account
Problem: Loss, lockout, auto-delete or a damaged device can remove the only copy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFix: Create a second protected copy, restrict access and record where each copy is stored.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Forwarding sensitive material through an ordinary link
Problem: A link may be forwarded, indexed or accessed by anyone who obtains it.
Fix: Ask for an approved secure-upload method and verify the recipient before sending.
Continuing contact to obtain more evidence
Problem: It can increase risk, create confusing context or expose you to retaliation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fix: Preserve what exists and seek advice about any necessary communication. Put safety first.
Assuming a screenshot proves authenticity or admissibility
Problem: A screenshot may not establish who controlled the account, whether it was altered or whether it is complete.
Fix: Keep the device and account state, native exports, contextual captures and transfer records. Let the appropriate decision-maker assess authenticity and admissibility.
Privacy, recording and legal limits
Do not secretly record a call, meeting or in-person conversation until you know the recording-consent rule that applies where everyone is located. Laws can differ between states and between civil, criminal and workplace settings. A recording that seems useful can create a separate legal problem if made unlawfully.
Employers, agencies and courts may have different privacy obligations and access rules. Share the minimum necessary material, preserve an unredacted original under controlled access, and ask a lawyer about privileged communications, protective orders and secure storage. Filing deadlines and exhaustion requirements also vary; do not infer a deadline from another state or from a general internet checklist.
Evidence preservation is not a substitute for legal advice. If the conduct is ongoing, you face retaliation, a deadline is near or a device may be remotely wiped, consult a qualified lawyer or the relevant agency promptly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
