In family proceedings, deleted material only has value when the device could lawfully be opened and its handling was recorded at the time. For family solicitors working in the city centre, and for their clients throughout Norfolk, we work on devices where the right to do so is clear, and that basis is put in writing before an image is taken.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
The device has to be yours, genuinely shared, or named in an instruction from your solicitor or the court. There is no other option than these three.
Every family instruction starts off with exactly the same question: on what grounds can this device be opened? There are three acceptable answers. It is yours. Or it is genuinely shared property, i.e. the computer in the kitchen or a backup drive you bought together. Or the examination has been directed by a solicitor or by the court. There is nothing else. Guessing your spouse's passcode, or reading emails that are theirs alone, would fall under the Computer Misuse Act 1990, and evidence obtained that way will usually end up being used against whoever collected it. Getting this right takes a few days; getting it wrong costs the case.
Deleting something seldom brings an end to it. Computers, shared drives and the phone backups stored on them can give up conversations, photos with the date they were taken, letters and spreadsheets, and the sign-in and browsing records around the days in question. Everything recovered keeps its clock (created, modified, deleted), so it can be put in order. Where disclosure is the argument, that often reaches statements, transfers, and the bookkeeping behind figures the court has already been given.
Appointments come through solicitors in two forms: as an expert for one party only, or as a single joint expert where both sides agree. When jointly appointed, we image the named device only once, stay within whatever scope the court has allowed, and owe our duty to the court and not to the party paying the invoice. Our findings are set out so that a judge can easily lift them off the page, and the weak points in the evidence get as much attention as the strong ones.
If there is a device you are allowed to open that could matter, doing nothing with it is the most useful thing you can do. Unlocking writes. Recovery apps from the app store write much, much more. The most writing of all comes from a relative having a go, and every single write moves a date that someone may need later. Turn it off, put it out of reach, make a note of where it has been and give us a ring, or have your solicitor make the call. From that call onwards the handling is written down.
See the forensic recovery hub for details of imaging, verification and how we store evidence. Putting a date on a deletion is covered by deleted-file forensics, and storing material securely by legal hold and chain of custody. Our prices are on the prices page.
Recovered only from devices you own, genuinely share, or have been directed to produce.
Chat and text threads restored after deletion, put back in order.
Deleted images that still carry the date they were taken.
Erased correspondence, statements and bookkeeping files.
Sign-in and browsing history through the hours in question.
Financial documents touching the figures each side has filed.
Created, modified and deleted times, anchoring everything to a date.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Family work runs on your own devices, on equipment that is genuinely shared, or with a direction from a solicitor or the court. There are three footings that open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, insurers or the court; or a device that is the client's genuine property, which in a family matter means their own machine or one they own jointly. We don't hack. Live communications are not intercepted. If the client has no right to look inside a device then neither do we.
Before a parcel is made up, entitlement is settled by telephone: please contact us on 0800 689 0668 or have your solicitor make the call. Agreed drives, not the machines, then reach our Cambridge location by tracked, insured post or over the counter. Collection is not offered, and custody is logged from arrival.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Contact us yourself, or through your solicitor, and entitlement is the first thing we will settle.