Preserve — don’t alter. Stop any automatic deletion, log-outs or “clean up.” Turn off auto-delete features and leave the device exactly as it is. Forensic value is lost if files are edited or overwritten. SWGDE – SWGDE+1
Do NOT access someone else’s phone without legal authority. Physically unlocking or spying on another person’s device can be a criminal offence in many countries (including Spain). That can destroy your ability to act as a lawful witness and may expose you to prosecution. If you found evidence on a device that isn’t yours, report it — don’t “investigate” privately. Toscanolex+1
Safety first for the child. If a child is in immediate danger, call emergency services right away (police/ambulance). Don’t try to handle an urgent threat yourself.

What to preserve (how to preserve it well)

Keep the original device powered and in a safe place. If it must be switched off, write down the exact time and who switched it off. Law enforcement prefers originals. SWGDE – SWGDE
Take time-stamped screenshots / photos of messages, profiles, call logs, timestamps, and any media. Photograph the whole screen including the status bar (time, battery) so timestamps are visible. Save the screenshots to an external device or cloud backup without editing. Met Police+1
Export chat logs where possible (WhatsApp/Telegram/Signal allow exports on many platforms). Save the exported file and the original screenshot evidence.
Collect metadata when you can (e.g., filenames, EXIF data for photos/videos). Don’t alter files (don’t crop, compress, re-save). SWGDE – SWGDE
Keep a written record: who found the evidence, when and where, what actions were taken after discovery, and who you told. This supports chain-of-custody later. College Assets

What NOT to do

Don’t hack, spy, or coerce someone to unlock their phone. That can be illegal and will undermine any criminal case. Toscanolex
Don’t share the material widely. Sharing images or videos of minors (especially sexual content) is itself a serious offence and will re-victimise the child. Instead, keep evidence secure and only share with authorities or designated victim-support organizations. Federal Bureau of Investigation
Don’t “clean up” files (delete conversations, edit timestamps, compress videos) — even with good intentions — as this destroys evidentiary value.

Emergency services / local police — if the child is in immediate danger.
National/provincial law-enforcement child-protection units (many countries have dedicated cyber/child-exploitation teams). In the U.S. you can contact the FBI and NCMEC; other countries have equivalents. Federal Bureau of Investigation+1
Platform reporting — report the user/content to the social platform (Instagram, WhatsApp, TikTok, etc.). Platforms have reporting flows for child exploitation and may preserve evidence for investigators. Department of Justice
Child-protection NGOs / helplines — e.g., NSPCC (UK), local child welfare/childline services — they can advise immediate safeguarding and next steps. NSPCC+1
A solicitor / legal adviser — especially if you’re a parent, guardian, or a professional (teacher, social worker) who needs to act while protecting legal rights and data privacy.

Bring originals if possible (phone, SD card). If police advise you not to hand over a device, follow their instructions for evidence transfer. GOV.UK+1
Provide a written statement that documents how you obtained the material and every action you took afterwards (dates/times).
Ask for a case number and a contact officer; request a receipt for any item you hand over.

Best practices for mobile-device evidence collection (forensics guidance). SWGDE – SWGDE
FBI resources for reporting missing children / online exploitation; NCMEC (US) reporting channels. Federal Bureau of Investigation+1
NSPCC guidance on online abuse and how to report / support. NSPCC+1
Legal notes — accessing someone else’s phone can be a crime in Spain and many EU countries; don’t take that risk. Toscanolex+1