AI-generated conceptual illustration. No real case material is shown.
An incident log puts repeated unwanted contact into a dated, factual sequence. Record what happened, when and where it happened, how you know, and which files or witnesses may support the entry. Keep what you observed separate from what you suspect. The goal is to give an investigator a clear starting point, not to prove a conclusion yourself.
Safety comes before documentation. If you are in immediate danger, call 911. If someone may monitor your device or accounts, consider a safer device and speak with a victim advocate before creating or storing a log. The Safety Net Project’s documentation guide explains why collecting information can sometimes increase risk.
What belongs in a stalking or harassment incident log?
Use one entry for each incident. A useful entry answers these questions:
- When did it happen? Record the date, time and time zone. If the time is approximate, say so. Keep the incident time separate from the time you wrote the note.
- Where or through what channel? Note the location, phone number, account handle or platform involved, as applicable.
- What happened? Describe the words, actions or contact as specifically as you can. Use quotation marks only for words you can quote accurately.
- How do you know? Identify whether you saw it yourself, received it directly or heard about it from someone else.
- What supports the entry? List the relevant message, voicemail, photograph or other file, plus any witness and report reference you already have.
- What was the impact? Note any fear, disruption or change to your routine in a separate field, rather than mixing it into the description of events.
SPARC offers a documentation-log template if starting with a blank page feels difficult. You do not need a complicated spreadsheet. Consistent entries are more useful than elaborate formatting.
How do you separate an observation from a suspicion?
Write what you can describe first, then label the unanswered question. A familiar-looking car does not establish who was driving. A displayed account name does not, by itself, establish who sent a message.
For example, a fictional entry might read:
“Monday, about 6:20 p.m., outside the grocery store: I saw a dark sedan parked across from the entrance. I could not see the driver or read the plate. I wrote this note at 7:05 p.m. No photograph.”
That is different from writing, “The same person followed me again.” If you believe it was the same car you saw earlier, add that belief separately and explain the detail you recognized. Do not fill a missing plate, identity or exact time with a guess.
The investigator can then distinguish a reported observation from a lead that still needs checking. Uncertainty belongs in the record; it is not a defect to hide.
How should the log connect to messages and other files?
Give each entry a simple reference, such as Incident 01, and use that reference to point to its supporting files. Keep the original files unchanged. Put any highlighted or annotated version in a separate working copy.
A log entry should explain the connection, not just say “see screenshot.” Note which message or file relates to the event and what context it adds. Keep unrelated events in separate entries, even if they involve the same account or location.
For online material, our guide to preserving social media evidence covers capture and context in more detail. Here, the priority is the sequence across incidents: what occurred first, what changed, and which parts remain unconfirmed.
Do not reply to provoke another message, approach someone, or follow a vehicle to complete the log. A gap in the record is not a reason to put yourself at risk.
What should you ask a private investigator to review?
Bring the timeline and a short list of unanswered questions. For example: Are several entries connected by a detail that can be checked? Is there a witness who may be able to clarify an event? Do two dates conflict? What additional information would be useful, and can it be obtained safely and within the agreed scope?
Before transferring sensitive material, ask how the investigator wants to receive it, who will have access, and what the proposed review will include. Agree on the investigative question, methods and reporting expectations before work starts. A log does not guarantee that an investigator can identify a person or connect separate events.
Crossroads Investigations can discuss the material you have and the question you want answered. Review our private investigation services before the conversation, and ask which work fits your circumstances.
What if you need help before the log is complete?
Do not wait for a perfect timeline to seek help. A private investigator is not an emergency response service. The Office for Victims of Crime’s stalking resources point to victim-support options, and SPARC’s help page recommends working with a local victim-service provider on safety planning.
Start with what you already know, mark what you do not know, and keep personal safety ahead of a complete file.
