Evidence Without Context Is Weaker Evidence
A screenshot proves content existed. A timeline proves how it unfolded — when you found it, who else saw it, what happened as a result, and how the situation developed over days, weeks, or months. In my experience as an expert witness, cases with a clear, contemporaneous timeline are consistently stronger than cases where someone tries to reconstruct events from memory months later.
Building the Journal
For each entry: the date and time, what you found or what happened, where (which platform, which URL), who else was involved or aware, and any related evidence you captured that day. Include indirect effects too — a canceled meeting, a customer who mentioned seeing something online, a strange comment from a colleague — even if you're not certain at the time that it's connected. Patterns often only become clear in hindsight.
Write Entries as Things Happen, Not Later
A timeline written in the moment, dated as events occur, carries more weight than one reconstructed after the fact. It doesn't need to be formal — a simple dated document or notes app works — but it does need to be consistent and started as early as possible.