The Investigator's Handbook: A Free Guide to Getting Evidence from Platforms, Banks and Providers

Getting evidence about an online crime depends on knowing which request to send, to whom, and in what order. Most investigators learn it case by case, from a different company page each time. The Investigator’s Handbook puts it in one place: a free, source-checked guide for police, prosecutors’ staff, fraud and financial-crime analysts, private investigators and journalists. It comes as a global edition and as editions for sixteen countries.

What it is

The handbook is a practical reference for the first question in any online case: how do we get the data before it disappears, and who has to give it to us? It covers preservation requests, legal process and emergency disclosure; the platforms investigators meet most often; internet and telecom providers; banks, wallets and payment apps; cryptocurrency exchanges; cross-border routes such as mutual legal assistance; and how to handle digital evidence so that it can be trusted later.

Every contact and portal it names was read on its official page on 18 October 2026, and each links the page it came from. The handbook is free. You sign up with your name, work email, organisation and country, and we email a personal download link.

What is inside

• First 24 hours: a two-page checklist, also available as an open web page.
• How data requests work: the three kinds of request (preservation, records through legal process, emergency disclosure), content versus non-content data, and timelines. In the United States, for example, a government request can ask a provider to preserve records for 90 days, extendable once for a further 90 (18 U.S.C. 2703(f)).
• The seven big platforms: Google, Meta, WhatsApp, Apple, Snapchat, Microsoft and TikTok, with their portals, sign-in problems and what each can provide.
• The online-services directory: how to read the entry for any of 116 services, built on our online-services directory.
• Country routes, providers and money: treaty routes for 21 countries, internet and telecom registers, and how banks and wallets freeze and recover funds.
• Cryptocurrency, evidence handling and templates: exchanges, preservation versus freeze versus production, hashing and chain of custody, and ready-to-adapt letters and checklists, plus a service quick reference and an A to Z glossary.

Country editions

A country edition adds five chapters on one country’s own legal process, providers, banks and national reporting, cross-border routes and templates, and then includes the whole global reference. There are editions for: India, United Kingdom, Australia, Singapore, United States, Pakistan, Kenya, Canada, Bangladesh, Nigeria, United Arab Emirates, Philippines, South Africa, Sri Lanka, Malaysia, Hong Kong.

Choose your country on the sign-up page and the matching edition is selected for you. Each edition has its own page with a chapter-by-chapter summary.

How it was checked

AI tools helped research and draft the text. Every factual claim was then rechecked by an independent reviewer against its primary source: the text of the law, the regulator’s or company’s own page, or the official treaty list. The reviews changed a lot. They corrected between a handful and over a hundred statements per edition, and each chapter ends with the sources it relies on. Where a source could not be read, the point was left out or labelled as secondary instead of guessed.

What it does not do

• It is not legal advice. It describes processes as official sources describe them. Your prosecutor, legal adviser or court decides what applies to your case.
• It does not suggest unofficial routes. No contacting a company outside its published channels, no bypassing legal process, no pretexting.
• Contacts change. Confirm every portal and address on its official page before you serve process.
• It is not an official publication. Ministry of Cyber Affairs is an independent news and information website, not a government body, police force, court, bank or recovery service.

FAQ

Who can download it?

Anyone who signs up. It is written for investigators, but journalists and researchers use it too.

Is there an AI assistant for it?

Yes. The assistant on this site answers investigator questions from the handbook and links what it used. Open the chat and choose “For investigators”.

I only want a taste first.

Read the First 24 Hours checklist on the web, or download the free sample from the same page.

I found a mistake.

Tell us through the contact page. We correct errors and record them on our corrections page.

Sources

1. The Investigator’s Handbook, Ministry of Cyber Affairs, edition of October 2026.
2. 18 U.S.C. 2703, Legal Information Institute, Cornell Law School.
3. Convention on Cybercrime (ETS 185), Council of Europe Treaty Office.

If you have been targeted by a scam or cybercrime rather than investigating one, see our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.