Many companies in the North East are closely held businesses: engineering suppliers in Tullos, processors in Peterhead and Fraserburgh, two-director consulting practices off Union Street, and family-owned firms throughout Aberdeenshire and Moray. Once the relationship between those running a company breaks down, it is usually the company records that suffer first. All the work remains within the systems the business owns. We date each deletion, build back deleted items and document which login made what changes.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
Regardless of how many directors there may be, these are the times for stopping, taking images, and having an argument about it afterwards.
The fact that a partnership dispute is essentially the two sides' version of the exact same company, argued out of one filing system, makes for a nice case for the examiner. All of this (servers, office machines, business mailboxes) is owned by the company itself. Therefore, everything can be worked from the company's property; none of the parties' personal computers need come near our bench. And it holds the things neither side can go back and amend: deletions, alterations, the dates of each deletion or alteration, and which user account they were made under. We settle that much and leave it standing, whichever side it happens to suit.
Most accounting records that are deleted on the way out of the door are unlikely to be gone forever. Imaged office computers and servers will bring back erased invoices, statements, contracts and letters, along with the export files and working files that Sage, Xero and QuickBooks scatter about whilst these programs are running. Each recovered document has its deletion date associated with it, so the pattern can be seen on the face of it. Routine tidying looks one way. When you see a number of documents being deleted in the same week as the dispute began, it looks entirely different. If the problem lies with valuation, then that data will go straight to a forensic accountant in its original state.
Almost all of the disputes that occur can be traced back to this one single question: was the business diverted elsewhere? Systems have a long memory for that kind of steering. Someone sets up an enquiry email box with a forwarding address to send the emails to a place outside of the company. A client database is exported wholesale approximately two weeks before the company splits. Quotes arrive on letterhead of another company. Documents leave via a thumb drive or go up into someone's personal cloud account. When you fix each of these items to a date, a specific account and a specific machine, then it is no longer just the complaint of one partner. The company itself has documented evidence that says it occurred.
People who no longer trust one another are going to read these findings, so it is most appropriate for neutrality to reside within the methodology and not with the covering letter. The originals will be placed through a write-blocker into an E01 container and then checked using SHA-256. Each handover will include signatures. Files locked with passcode protection will unlock with Passware as long as there is a legitimate right to the content; otherwise they remain locked. Instructions may come from either party, both parties, or from the court. Where tempers allow it, that joint route will preclude anyone from stating later that the work was slanted toward one side. Material processed in such a manner will also sit properly against a specification of documents if recovery is sought.
The method behind this page comes from the forensic recovery hub. Tenancy and mailbox material can be found at this page. Deletion dates can be found at deleted-file forensics. Costs for data recovery can be found on the prices page.
Between servers, office equipment and mailboxes most of the time the evidence has been documented.
Erased invoices and statements, alongside accounting exports and backup copies.
Traffic, deletions and rules, every one of them carrying a date.
Where new enquiries and quotations were being routed instead.
Moves and deletions across shared volumes, put in dated order.
Sticks and personal cloud accounts taking company material out.
Edits, deletions and transfers assembled into a single timeline.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
Partnership work will remain on systems owned by the firm, and works best with either a joint instruction or an order of the court. There are three doors in, and we still haven't found a fourth. Kit the business itself owns. An instruction issued in writing from a solicitor, an insurer or the court. Or a device that actually belongs to the client, which in matrimonial matters would include a shared device held between both parties. No hacking happens at our bench. Never do we intercept live traffic. If the client does not have the right to view a device, we don't either.
A server estate needs planning before you unplug anything, so ring for a quote at 0800 689 0668 first. Both parties can submit together if that is what they would like. We will collect nothing from site. Only the disks come to us, not the servers or machines: they either travel to us tracked and insured, each labelled by its bay, or come across the counter (Monday to Friday, 9am to 5:30pm, no appointment needed), and are recorded into our custody logs when we receive them in Edinburgh.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
No charge diagnostic, written scope of work, joint instructions welcome.