school cyberbullying · K–12 IR — quick-start

checklist

1. confirm the student is safe and not in crisis — if the student has expressed self-harm, call 988 (crisis line) before collecting evidence.
2. do not ask the student to re-open or re-read the harassing content during evidence collection — screenshot for them, not with them present.
3. screenshot every post, message, or video with the platform timestamp, sender handle, and content visible — do not crop.
4. archive post URLs (archive.today, Wayback Machine) before filing abuse reports that may trigger content removal.
5. note the platform, sender account handle, first incident date, escalation pattern, and whether the content is visible to peers or only direct messages.
6. preserve any blocking or reporting actions the student already took — these establish timeline and intent.
7. identify whether the bully's account is known (classmate) or anonymous — platform subpoena requests differ.
8. pull school LMS or district student monitoring system alerts if available — some districts flag keyword hits that predate the first reported incident.
9. document whether the bullying migrated from one platform to another — cross-platform correlation is the hardest evidence to reconstruct later.
10. begin the primary tool path below — cyberbullying evidence package builder.

primary tools

1. 01gaggle student safety alert export forensic analyzerdrop gaggle safety export · severity ladder · harassment/self-harm clusters · runs locally
2. 02bark school edition alert export forensic analyzerdrop bark for schools csv · concern level 1–5 · thread bursts · runs locally
3. 03powerschool sis audit log forensic analyzerdrop powerschool log or incident csv · discipline gaps · harassment clusters · runs locally
4. 04google classroom audit log forensic analyzerdrop google classroom audit via workspace · parse class + post + grade events · runs locally
5. 05case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally

go deeper