Instructions for recording a demo, assuming you don't know how (I didn't), can be found here:
http://www.spawnpoint.com/asp/tm.asp?m=1354
Don't make it blatently obvious that you're recording a demo. You don't want your hacker leaving before you can get some good proof.