A company breaking up leaves its own systems as the only participant with nothing to gain from the outcome. The accounting package, the mailboxes, the shared drive and the server logs hold a dated account of what was invoiced, what was taken out, where the enquiries went and which login was in use at the time. Capturing that before it thins, and setting it out so neither side can dismiss it, is the whole of this instruction.
◇ Neutral handling, published figures. £800 + VAT examined and reported; £400 + VAT for the verified image and its extracted material, which is the recorder and encrypted-drive price point. Diagnosis free, scope agreed in writing, joint instructions accepted. Forensic work is outside no fix, no fee. A failed array is from £500 + VAT.
That is what makes these disputes different from an employee matter. Nobody is arguing about who could open the ledger; both parties could, both did, daily, for years. The argument is about what was done to the records and on which day, which turns dating into the entire exercise. Fortunately the systems that matter keep their own accounts and none of them belong to either party. An accounting package writes an audit trail whether or not the visible ledger looks tidy, so an invoice altered or removed after the fact usually shows. A shared drive keeps a change journal. A mail server keeps transport records no mailbox owner can edit.
So the reconstruction runs from as many directions as the business has. Invoices and statements that were deleted often survive in unallocated space. The accounting package keeps backup sets of its own, frequently several generations deep and forgotten by everybody. Year-end exports sent to an accountant tend to be sitting in a sent items folder still. The file server holds shadow copies of itself. Four sources that agree are close to unanswerable; four that disagree are more interesting again, because the disagreement is the finding and the report prints the versions beside one another with their dates rather than picking a favourite.
Diversion cannot be done from one system, which is why it is so often provable. A rule was created to push enquiries onward, and the rule carries the date it was made. The website's form notifications were pointed at a different address, and that is a configuration change with a timestamp. Quotations were drawn up on company hardware for a company that is not this one, and the drafts are still in a temporary folder. A contact database was exported once, in a month when nothing else was exported at all. Domain or hosting records moved, from an identifiable account. Read in date order against the fall in turnover, the sequence tends to speak for itself.
Half these calls come from exactly that position. The starting point is that the systems belong to the company, not to whoever is currently holding the credentials, so an instruction given by the company or by a director acting with its authority is a sound basis to work from. Where the authority to give that instruction is itself in dispute, as it usually is in a two-director company, the practical answers are a protocol settled between the solicitors or a short application to the court, and neither takes as long as people fear. What will not happen is anybody's password being worked around on the strength of one side's account of who is entitled to what.
By this stage both parties distrust everything, frequently for good reason, and an examiner who looks like one side's instrument is of no use to either. So it is handled structurally. Where both solicitors will agree the scope and the questions, the instruction is taken jointly and every finding is released to both firms in the same moment, welcome or not. Where only one side instructs, the report states that on its front page, records the questions it was asked, and gives the range of opinion wherever the material supports more than one reading — which CPR Part 35 requires of an expert regardless of who is paying.
Custody and method are on the forensic practice hub, mailbox and tenancy work at email and cloud exfiltration, access and credentials at insider threat forensics, and dating removals at deleted-file forensics. Where a server or an array has failed rather than been interfered with, that is ordinary server recovery from £500 + VAT.
In a two-director company, or a family firm in any of the market towns, one of these is the point to capture rather than wait and see how it develops.
Every line is dated, tied to a login, and traced to the system it came off, so either party can go and check it for themselves.
Deleted invoices and statements, set beside package backups and old exports.
Mail sent, deleted and redirected, each entry carrying the date it belongs to.
The path enquiries and quotations took instead, and the account behind each.
Every move and removal across the file server, ordered into one dated run.
Removable media and personal cloud accounts that received company files.
Amendments, deletions and transfers in an order either side can test.
£800 + VAT is a system examined and reported on; £400 + VAT is a device imaged, verified and stripped of its deleted material with no findings written. In a company dispute the second figure often does the early work — capturing the accounts machine, the shared drive and the mailboxes before anybody has agreed what is actually being asked — and the examination is commissioned afterwards from the images already held. £400 is not a band peculiar to this work; a CCTV recorder disk and an encrypted volume sit at exactly the same point, which is why the list runs to five prices.
Investigations are one of the four published exclusions from no fix, no fee, with electronic and mechanical failure, chip-level work and DVR jobs. In a dispute where each side expects the answer to favour them, an examiner paid on results would be useless to both, so the fee is fixed before the work starts. Each figure assumes one machine and one question; an estate of servers and workstations is measured in the free diagnostic and quoted in writing. The diagnostic costs nothing and closes two working days after booking in at Oxford. An array that has simply failed is ordinary recovery from £500 + VAT, not investigation time.
Instructions are taken from the company, from a director acting with the company's authority, or jointly from both sides' solicitors — the second and third being the ordinary written-instruction route, with insurers and the court on the same footing. The third route generally, a private client's own hardware, applies to a director's personal machine only where that director is the one asking. What will not happen is anybody's password being worked around on the strength of one side's account of who is entitled to what; where the authority to instruct is itself disputed, the answer is a protocol between the solicitors or a short application to the court. Monitoring software is not supplied, fitted or advised on. Live traffic is not intercepted, which the Investigatory Powers Act 2016 reserves to bodies this is not one of. Phones and tablets are not examined here.
An estate of servers wants a plan rather than a parcel, so call 0800 689 0668 before anything is unplugged and we will settle what gets captured in place and what genuinely has to travel. Where disks do come in, it is members only, each marked with its bay position, and a photograph of the chassis front before anything is pulled. No collection service exists anywhere in this network and there is no Coventry counter: tracked and insured post to Oxford, or over the counter there in office hours.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Backups roll, logs expire and shared drives get tidied by somebody. Ring the freephone and we will scope it with you, jointly if both firms would rather.