In a Scottish family action case, recovered material can only be used where the device was open to us by lawful means and that handling was documented at the time. Our firm acts for family solicitor firms located around Union Street and their clients, on devices where the right to inspect the contents is beyond argument. That right is confirmed in writing prior to taking any images.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
The device in question must be either yours, a device you genuinely share with someone else, or a device named by a solicitor or the courts. There is no fourth way to do this, and we will not create one for you.
Every family instruction begins with a single question. On what grounds are we permitted to access this device? There are just three possible answers. It is yours. It is genuinely jointly owned, a shared computer desktop or external hard drive both of you purchased together. Or the examination has been directed, whether by a solicitor or by the court. Nothing beyond those three answers will do. If you guess at your spouse's password, or if you access their own private correspondence, you fall foul of the Computer Misuse Act 1990, which covers all of the United Kingdom. The material obtained in such a manner will most likely damage whoever collected it. A day or two is required to establish what footing each party has. Get it wrong and you lose the action.
Deletion rarely marks the end. Computers, shared drives and the handset backups stored on them can return conversations, images complete with capture dates, letters and spreadsheets, plus a record of each sign-in and of browsing across the days at issue. In addition to being able to reconstruct what was said, recovered content will still have its clock, allowing a timeline to be established. This carries added importance in Scotland, where financial provision on divorce is governed by the Family Law (Scotland) Act 1985. In determining matrimonial property value as at the relevant date, dated evidence is clearly of greater value than undated evidence.
The instruction from a solicitor comes in one of two ways: either from one party alone or jointly from both. On a joint basis the named device will be imaged once, with the scope remaining exactly where the parties or the court have put it. The duty owed is therefore to the court rather than to whoever pays for the work. In Scotland a skilled witness owes this duty regardless of who instructed him or her. The findings are then written up in such a way that a sheriff can take them straight off the page. All aspects of the evidence, whether weak or strong, are afforded equal room.
Suppose a device you have permission to open could be important. The most valuable thing you can do is to leave it untouched entirely. Once you have unlocked it, you have written to it in some way, and installing a recovery app from the store writes a whole lot more. If you give it to someone else to try their hand at it, you will have written the most of all. Every time something is written to the device, it shifts a date that people may wish to rely on. Shut it down, put it somewhere out of reach, make a note of where it has been; then contact us, or have your solicitor do so. From that first call onwards, everything that happens with regard to how the item is handled will become part of the formal record.
The method through which we obtain images, verify them, and store them is covered at the forensic recovery hub. To learn about how to date deletions, visit deleted-file forensics. Visit legal hold and chain of custody for information regarding keeping items safely after they've been recovered. The costs of our services can be found on the prices page.
We'll only retrieve data from devices that are in your name, from property that is genuinely shared, or from hardware you are directed to produce.
Text and chat threads returned after deletion, held in sequence.
Removed images that still carry a readable capture date.
Erased correspondence, statements and bookkeeping documents.
Sign-in and browsing records right through the hours in question.
Documents bearing on figures already put before the court.
Created, modified and deleted stamps, anchoring everything to a date.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
When family instructions are given to us they can be for use on a device owned by you (the client), on a jointly owned device (a shared device) or as part of directions received via a solicitor or the courts. Those are the three doors in, and to date we have never found a fourth. Kit that the business itself owns. A written instruction issued through a solicitor, an insurance company or from the court. Or a device that genuinely belongs to the client, which in a matrimonial situation would include one the couple own together. We do not hack into anything at our bench. We do not intercept live traffic. If you have provided us with access to a device and you have no legal entitlement to view the contents of it, then neither do we.
Entitlement is settled on the phone prior to a parcel being prepared. Call us on 0800 689 0668 with the details first so we can provide you with a quote, or have your solicitor contact us. Once the device has been agreed, its hard drive (we only need the drive, not the computer) can be posted to Edinburgh, tracked and insured, or handed in over the counter (Monday to Friday, 9am to 5:30pm, no appointment needed). We do not offer a collection service, and custody begins once the item arrives.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Either call us directly to give the instruction yourself, or have your solicitor contact us. Our primary concern when engaging in the process of data recovery is establishing first whether you are entitled to receive the results.