The North East runs on closely held companies. Engineering suppliers at Tullos, processing businesses at Peterhead and Fraserburgh, two-director consultancies off Union Street, family firms the length of Aberdeenshire and Moray. Once the relationship at the top goes, the company records suffer first. The work stays inside systems the business owns. We put dates on the deletions, rebuild what was removed, and record which login did which thing.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Two directors or twenty, these are the moments to stop, take images, and have the argument afterwards.
What a partnership dispute amounts to is two accounts of the same business, argued out of a single filing system. That happens to suit an examiner nicely. The estate is the firm's own: servers, office machines, business mailboxes. It can all be worked without anybody's private equipment coming near this bench. And it holds the things neither camp can go back and amend. Deletions. Alterations. The dates on them. The account each was carried out under. We settle that much and leave it standing, whichever of them it happens to suit.
Accounting records removed on the way out of the door are rarely gone for good. Imaged office machines and servers return erased invoices, statements, contracts and letters, plus the exports and working files that Sage, Xero and QuickBooks scatter about while they run. Every recovered item brings its deletion date along, so the shape of it is visible on the face of it. Routine tidying looks one way. A cluster of deletions in the week the row started looks entirely another. Where valuation becomes the issue, that material passes across to a forensic accountant as it stands.
Nearly all of these disputes come down to one question: was the trade steered somewhere else. Systems have a long memory for steering. An enquiry mailbox set to forward outside the firm. A client database exported wholesale a fortnight ahead of the split. Quotations surfacing on another company's letterhead. Files leaving on a stick, or heading up into somebody's private cloud account. Fix each of those against a date, an account and one particular machine, and it is no longer one partner's grievance. It becomes the company's own record saying it.
People who have stopped trusting each other are going to read these findings, so neutrality belongs in the procedure and not in a covering letter. Originals go by write-blocker into E01 containers and get checked on SHA-256. Every handover is signed for. Locked files come open under Passware where a right to the contents exists, and not otherwise. Instruction can arrive from one partner alone, from the two of them, or from the court. Where tempers stand it, that joint route stops anybody claiming afterwards the work leaned a particular way. Material handled this way also sits properly against a specification of documents when recovery is sought.
Method sitting behind this page belongs to the forensic recovery hub. For tenancy and mailbox material, see the page on it. Putting a date against a deletion is deleted-file forensics. Numbers live on the prices page.
Servers, office machines and mailboxes between them usually have the story already written down.
Erased invoices and statements, alongside accounting exports and backup copies.
Traffic, deletions and rules, every one of them carrying a date.
Where new enquiries and quotations were being routed instead.
Moves and deletions across shared volumes, put in dated order.
Sticks and personal cloud accounts taking company material out.
Edits, deletions and transfers assembled into a single timeline.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
Partnership work stays on systems the firm owns, and sits best on a joint instruction or an order of the court. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
A server estate needs planning before anything is unplugged, so speak to us on 0800 689 0668 first. Where both camps prefer it, submissions can be made jointly. Nothing gets collected from site. Equipment travels tracked and insured, or comes across the counter, and enters the custody log on arrival in Edinburgh.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
Free diagnostic, written scope, and joint instructions taken gladly.