Someone Is Stalking You Online Evidence, Safety, And Forensics

National Domestic Violence Hotline. 1-800-799-7233 or text START to 88788. Available 24/7 with confidential support, safety planning, and local referrals.

Stalking Prevention, Awareness, and Resource Center (SPARC). stalkingawareness.org. Extensive self help resources, safety planning templates, and a stalking incident and behavior log (SLII) that helps you document patterns for law enforcement.

Safety Net at National Network to End Domestic Violence. techsafety.org. The most respected resource for technology safety in abuse situations, including stalkerware detection, safe browsing, and device hygiene for survivors.

Local law enforcement. In North Carolina cyberstalking can be charged under state criminal statutes (N.C. Gen. Stat. 14-196.3 among others). The North Carolina State Bureau of Investigation Computer Crimes Unit supports local police on complex cyberstalking cases.

Licensed therapist. Cyberstalking causes real trauma. Organized psychological support is as important as technical response. Referrals available through Psychology Today's therapist directory, your insurance carrier, or the SPARC website.

Unwanted repeated contact across platforms. Calls, texts, emails, social media messages, comments, reviews, or new accounts that are created specifically to reach you after you block them. The hallmark is persistence after you have clearly asked them to stop.

Location tracking. A current or former partner, or someone else with physical access to your devices, may have installed monitoring apps, shared location services, or tracking tags (AirTags, Tile, SmartTags) on your vehicle or belongings.

Impersonation and lookalike accounts. The stalker creates accounts using your name or image to contact your friends and family, post content that harms your reputation, or initiate transactions in your name.

Account intrusion. Access to your email, social media, cloud storage, shared family accounts, or phone carrier account. Often they had the password historically and never lost it.

Doxing and public disclosure. Publishing your address, employer, workplace, children's school, or other identifying details online to encourage third parties to harass you.

Threats of harm. Explicit or implicit threats to you, your family, your pets, or your property. Any credible threat of physical harm needs to go to the police immediately, with the evidence preserved first.

The instinct to argue back or block immediately is natural. Resist both. A blocked contact often creates a new account or finds a new channel, and you have lost the direct evidence trail. A screenshot with the sender's username and timestamp is the gold standard. Video screen recording of the scrolling thread is even better because it captures continuity and timestamps together.

Start a stalking incident log. The SPARC SLII template is free and widely recognized by law enforcement and courts. It captures date, time, platform, exact content, sender identifier, and witness information per incident. Every new incident goes in. Patterns emerge over days and weeks, and that pattern is what makes a stalking case actionable.

Preserve evidence outside the stalker's reach. Export or save screenshots, message threads, call logs, and device notifications to a cloud account the stalker has no access to, or to an external drive kept somewhere safe. Do not rely on your primary email or a shared family account the stalker may touch.

Pull call records. Most mobile carriers let you download call and text metadata for the last several months. For legal proceedings, a carrier subpoena through counsel captures content and handoff records that self service export does not.

Check for location sharing. Review Find My (Apple), Google Location Sharing, Life360, Snap Map, and similar apps. Turn off location sharing with anyone you do not actively trust. Check under Settings, Privacy, for any apps with location permissions you did not knowingly grant.

Scan for tracking tags. iPhones and newer Android phones will alert you to unknown AirTags and SmartTags traveling with you. Check your handbag, backpack, car wheel wells and trunk, and any gifted items. Physically inspecting your vehicle with a flashlight is worth doing if you have reason to suspect.

Alert the two or three people closest to you. Someone at work, someone at home, and one friend or family member should know what is happening and have a plan if contact from the stalker reaches them. That is as much a safety plan as it is a social support plan.

Change every password from a device the stalker has never touched. Use a password manager. Use unique passwords. Turn on multi factor authentication with an authenticator app or hardware security key, not SMS.

Factory reset or forensically examine suspect devices. If there is any chance the stalker had physical access to your phone, laptop, tablet, or a shared smart home device, have Petronella Technology Group examine it for stalkerware, monitoring profiles, or configuration changes before you proceed. In some cases a factory reset is the only safe action. We help you triage.

Detach shared accounts. Family plan subscriptions, Apple Family Sharing, Google Family Link, Amazon Household, Spotify, Netflix, banking joint accounts. Anywhere the stalker has administrative or parental level access, remove yourself and create independent accounts. This is often more important than password changes.

Lock down your phone carrier. Add a carrier PIN or port out PIN. SIM swap attacks are a regular tool in cyberstalking cases because they give the stalker access to SMS recovery codes for every account that has your phone as MFA.

Audit your public exposure. Search for your name, your phone number, your address, and your email on data broker sites. Opt out where possible. Services like DeleteMe and Kanary can automate this.

Update your residential and legal posture. In North Carolina, many counties offer an Address Confidentiality Program for survivors. A protective order can be pursued through the family court. Counsel is the right advisor here. We work alongside your attorney.

We are not a licensed private investigator firm. We do not conduct physical surveillance, process service, or PI style investigative work. If your matter requires a PI, we refer to trusted partners.

We are not law enforcement. We cannot arrest, detain, subpoena, or compel a platform to disclose information on your behalf. What we can do is give your attorney, the police, and the FBI the evidence package and technical analysis they need to act.

We are not licensed therapists or counselors. Cyberstalking causes real psychological harm, and a licensed mental health professional is part of a good response plan. We are glad to help connect you with reputable therapists in the Triangle.

We are not attorneys. Protective orders, civil actions, family law proceedings, and criminal complaints all run through counsel. A short consultation with a family law or victim rights attorney is often the highest leverage first call you can make alongside us.

Cyberstalking cases can take weeks or months to resolve. Anyone promising a fast, guaranteed fix for an ongoing stalking situation is not being honest with you. What we promise is rigorous evidence work, clear communication, and a relationship with other professionals who round out the response.

Believe them. Cyberstalking often sounds disproportionate from the outside. It is not. Pattern behavior over months is exhausting and frightening in ways that are hard to convey.

Do not push them to confront the stalker. Do not tell them to just block and move on. The right posture is to help them get organized documentation to people who can act on it.

Offer specific, practical help. Sitting with them while they screenshot messages. Watching the kids while they meet with counsel. Riding along to the police station. These are the things that get past overwhelm.

Respect their pace. Survivors of ongoing stalking sometimes decline to pursue every available legal option. Their safety calculus is theirs to make. Your job is to support the decision they reach, not to make it for them.

Former intimate partners. Most cyberstalking cases begin with a current or former partner. The technical advantage is that the stalker has had physical or account access to devices, knows security questions and backup emails, and has insight into routines. Cases that involve a known relationship are often legally stronger because pattern history can be documented through prior communications.

Obsessive fans or acquaintances. Public figures, creators, small business owners, and educators occasionally draw an obsessive individual whose contact pattern escalates from admiration to intrusion. These cases often include boundary tests (escalating requests), reputation attacks when the target does not reciprocate, and impersonation accounts. Platform abuse reporting combined with early legal engagement usually works when the stalker is in the same country.

Hostile coworkers or former employees. Workplace conflicts occasionally move online. These cases can include sock puppet accounts posting negative reviews, fake complaints to licensing boards, or coordinated campaigns within niche professional communities. Employer involvement and employment counsel are usually appropriate alongside the technical work.

Networked harassment. Some cyberstalking is not a single stalker but a coordinated group, particularly in online subcultures that specialize in targeted harassment. These cases can involve hundreds of accounts and require platform trust and safety teams to engage at scale. Evidence preservation in the first days is crucial because the harassment can go viral and much of it can disappear quickly.

Stranger stalking. Rarer but real. A stranger who believes a relationship exists that does not. Usually harder to identify initially because the attribution baseline is narrower. Longer cases where behavioral and linguistic analysis over time narrows the field.

Preservation. Capture the content before it can be altered or deleted. Screenshots are the baseline, but they are not always enough. Platform native exports (available from Facebook, Instagram, Twitter, Google, Apple) capture metadata screenshots do not. Video screen recordings add continuity. For messages on devices you control, device imaging preserves the data exactly as it existed.

Authentication. Establish who sent what, when. Headers for email, platform URLs for social posts, sender identifiers and timestamps for text and chat. Where possible, cryptographic hashes of captured evidence to show it has not been tampered with after capture.

Chain of custody. Document who has handled the evidence, when, and how. For imaged devices, a written custody log. For cloud exports, the download timestamps, account used, and download location. Counsel and the court will care about this if the matter moves to litigation.

Context. One offensive message looks like a moment of bad behavior. Sixty messages over six weeks from four related accounts is a stalking pattern. Chronological logs, pattern analysis, and narrative timelines make evidence tell its full story. SPARC's SLII template is designed exactly for this.

The first interaction with the police usually shapes the whole case. Walk in with an organized binder or a digital package that includes: a one page summary of the pattern, a chronological incident log (with every event timestamped), supporting evidence labeled to match each incident in the log, a summary of platforms involved, and the identifying information of the suspected stalker if known. That package does more than a dozen frustrated phone calls.

Ask specifically for a detective or an investigator who handles cyber cases or domestic violence. Patrol officers are often the first point of contact and they have limited authority to pursue online cases. The North Carolina State Bureau of Investigation Computer Crimes Unit regularly partners with local departments on complex cases.

The FBI IC3 intake at ic3.gov is worth filing in parallel, especially when the stalker operates across state lines or uses financial fraud as part of the harassment. IC3 is an intelligence clearinghouse that can connect your case to larger investigations.

Civil protective orders are a separate track from criminal. Your attorney can petition family court for a domestic violence protective order or a civil stalking order depending on the relationship and jurisdiction. Evidence for those petitions does not need to meet the criminal standard of proof, but it does need to be organized and authenticated. That is where our declarations often play a role.

Many survivors rebuild their digital lives intentionally after a stalking case. That can mean a different phone number, a different email address reserved for sensitive services, compartmentalized social media, a permanent password manager plus hardware keys, and updated privacy defaults across every new account going forward. The goal is not to become paranoid. It is to be thoughtful about which surfaces are public and which are private, and to make the private ones actually private.

Ongoing mental health work matters. The trauma of feeling hunted can cause hypervigilance, sleep disruption, and trust issues that benefit from professional support well after the stalking ends. Therapy that is trauma informed tends to work better than generic counseling. Support groups for stalking survivors exist online and in some larger cities.

If the stalking was connected to an abusive relationship, working with a domestic violence advocate is often more helpful than any single technical fix. Advocates help with safety planning that considers the full picture, from housing to custody to employment.

We believe cyberstalking responses are best done as a team. One forensic firm, one attorney, one therapist, one advocate, and one trusted person in the survivor's life. No one of us covers the whole thing, and that is fine. When the team communicates, outcomes are better.