In family proceedings, deleted material is only worth having if the device could lawfully be opened and the handling was recorded as it happened. For family solicitors in the city centre and the clients they act for around Norfolk, we work on devices where the right to do so is plain, and that basis is put in writing before an image is taken.
◇ Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
The device has to be yours, genuinely shared, or named in an instruction from a solicitor or the court. There is no fourth option.
Every family instruction begins with the same question: on what basis may this device be opened? Three answers work. It is yours. It is genuinely shared property, such as the computer in the kitchen or a backup drive bought between you. Or the examination has been directed, by a solicitor or by the court. Nothing else works. Guessing at a spouse's passcode, or reading mail that is theirs alone, falls foul of the Computer Misuse Act 1990, and evidence gathered that way tends to rebound on whoever gathered it. Getting this right takes a few days; getting it wrong costs the case.
Deleting something rarely finishes it. Computers, shared drives and the phone backups sitting on them give up conversations, pictures still carrying the date they were taken, letters and spreadsheets, and the sign-in and browsing record around the days in question. Everything recovered keeps its clock — made, changed, removed — so it can be put in order. Where disclosure is the argument, that regularly reaches statements, transfers, and the bookkeeping sitting behind figures the court has already been given.
Appointments come through solicitors in two shapes: for one party alone, or as single joint expert once both sides agree. Jointly appointed, we image the named device a single time, keep inside whatever scope the court has permitted, and owe the duty to the court and not to the party settling the invoice. Findings are put down so a judge can lift them off the page, and the soft spots in the evidence get as much room as the strong ones.
If a device you may lawfully open could matter, doing nothing with it is the most useful contribution available. Unlocking writes. Recovery apps off the app store write a great deal more. A relative having a go writes most of all, and each write moves a date somebody may later need. Turn it off, put it out of reach, keep a note of where it has been, and ring us — or have your solicitor do it. From that call onwards the handling is written down.
Imaging, verification and storage are described at the forensic recovery hub. Putting a date on a deletion is covered by deleted-file forensics, and holding material safely by legal hold and chain of custody. Costs sit on the prices page.
Recovered only from devices you own, genuinely share, or have been directed to produce.
Chat and text threads brought back after deletion, kept in order.
Deleted images with the capture date still embedded and readable.
Erased correspondence, statements and bookkeeping files.
Sign-in and browsing records through the hours in question.
Financial documents touching the figures each side has filed.
Made, changed and removed times, anchoring everything to a date.
Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.
Family work runs on your own devices, on property that is genuinely shared, or on a direction from a solicitor or the court. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.
Entitlement is settled by telephone before a parcel is made up: speak to us on 0800 689 0668, or have your solicitor make the call. Agreed devices then reach our Cambridge location by tracked, insured post, or over the counter. Collection is not offered, and custody is logged from arrival.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.
↓ Print the shipping & booking-in form (PDF)
Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.
Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.
Ring us directly, or have your solicitor do it — entitlement is the first thing we settle.