Norfolk runs on close-held firms: farm partnerships in the middle of the county, boatyards and hotels around the Broads, two-director practices in the city. When the relationship at the top gives way, the company's records are usually first to suffer. The work stays on systems the business owns. We put dates against the removals, rebuild what was taken out, and record who did what under which login.
◇ Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
From a two-director firm or a family business anywhere in Norfolk, these are the moments to stop and take images.
A partnership dispute is two versions of one company argued out of a single filing system, which happens to suit an examiner. The estate belongs to the firm: servers, office machines, business mailboxes. It can be worked without anyone's private kit coming near the bench, and it holds the things neither side is able to go back and revise — removals, alterations, the dates they carry, the account each was made under. We establish that much and leave it standing, whichever partner it happens to help.
Bookkeeping taken out on the way through the door is seldom truly gone. Images of the office machines and the server give back erased invoices, statements, contracts and letters, along with the exports and working copies that Sage, Xero and QuickBooks leave lying about as they run. Every recovered item comes with the date it was removed, so the pattern shows on the face of it: routine tidying, or a run of deletions in the week the argument started. When the dispute turns to valuation, that set passes straight across to a forensic accountant.
Most of these disputes come down to whether trade was steered somewhere else, and the systems remember steering. Enquiry mail passed on to an outside address. A customer database exported in one go a fortnight before the split. Quotations reappearing under a different letterhead. Files going out on a stick, or up into somebody's private storage. Fix each of those to a date, an account and a piece of hardware, and it stops being one partner's grievance and starts being the company's own record.
People who no longer trust one another will read these findings, so neutrality has to live in the procedure rather than in a covering letter. Originals go through write-blockers into E01 files and are checked by SHA-256. Custody is signed at each handover. Locked files are opened with Passware only where the right to their contents exists. Instruction can come from one partner, from both together, or from the court — and where tempers allow the joint route, nobody can afterwards claim the evidence had a side.
The method sitting under this page is described at the forensic recovery hub. Tenancy and mailbox material has a page to itself; putting a date on a removal belongs to deleted-file forensics; the figures live on the prices page.
Between the server, the office machines and the mailboxes, the story is generally sitting there already.
Erased invoices and statements, with accounting exports and backups.
Sends, deletions and rules, each carrying the date it happened.
Where fresh enquiries and quotations were being sent instead.
Removals and moves on shared storage, in dated order.
Sticks and private cloud accounts taking company material.
Edits, removals and transfers assembled into one timeline.
Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.
Partnership work stays on the firm's own systems, and sits best under a joint or court instruction. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.
Imaging a server estate wants a little planning, so speak to us on 0800 689 0668 before anything is unplugged. Submissions can be arranged jointly where both camps would rather. Kit comes by tracked, insured post or over the counter, and is signed into custody as it reaches our Cambridge location.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.
↓ Print the shipping & booking-in form (PDF)
Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.
Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.
Free diagnostic, a scope in writing, and joint instructions taken gladly.