Norfolk operates mainly through close held businesses: farming partnerships throughout most of the county, boat yards and hotels along the Broads, and city based professional practices that can be as small as two directors. Once the relationship at the top breaks down, the company's records typically suffer next. All of the data we work on is stored on systems owned by the business. We will date the removals, put back what was taken out, and show which login did what.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
From a two-director firm or a family business anywhere in Norfolk, these are the moments to stop and take images.
A partnership dispute is basically two versions of the same company, fought out in front of an examiner using the same file system. The estate belongs to the business: all servers, all office equipment and all business mail boxes. This can be worked on without either party having to hand over their own personal kit. These records also can't be revised after the event, and neither side is able to change the dates on them or which account was being used at the time. So we identify what is on the business systems and leave it there for the process to use, whether or not it happens to help one party or the other.
In most cases bookkeeping that is deleted on the way out of the door can still be recovered. Images of your office equipment and servers can restore deleted invoices, statements, contracts and letters, plus the export files and working copies left behind by Sage, Xero and QuickBooks. Each document restored will include the date it was deleted from the system. This will show either that someone was just regularly cleaning up (tidying) the records, or that a number of items were deleted within one week of the argument starting. If the dispute turns to valuation, a forensic accountant can then use this set to help work out the value.
Most of the complaints will be about where trade was diverted, and the systems can show diversion: enquiry email forwarded to an external email address. A customer database exported in one go, two weeks before the split. Quotes turning up from another partner on a new letterhead. Files sent out on a USB stick or to somebody's personal cloud storage. Put each of these to a specific date, account and piece of hardware and it is no longer one partner's complaint but the company's own records.
People who have lost all faith in each other will read these findings, so neutrality has to be shown in the procedure itself and not just mentioned in a covering letter. The originals go through a write-blocker into E01 files and are checked with SHA-256. Custody is signed at every handover. Locked files are only opened with Passware where there is a right to what is inside. Instruction can come from one partner, from both together, or from the court, and where tempers allow the joint route, nobody can claim afterwards that the evidence took a side.
The method behind this page is described at the forensic recovery hub. Tenancy and mailbox material has a page to itself; putting a date on a removal is covered by deleted-file forensics; the figures are on the prices page.
Between the server, the office machines and the mailboxes, the majority of the story is usually in place already.
Erased invoices and statements, with accounting exports and backups.
Sends, deletions and rules, each with the date it happened.
Where new enquiries and quotations were being sent instead.
Removals and moves on shared storage, in date order.
Sticks and private cloud accounts taking company material.
Edits, removals and transfers put into one timeline.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Partnership work stays within the firm's own systems, and is always better suited to a joint or court instruction. There are three ways to open the door, and there is no fourth way: kit owned by the company; a written instruction given by solicitors, insurers or the court; or a client's own device, which in family matters means they own it themselves or jointly with another person. We don't hack into anything and we don't intercept live communications. If the client has no right to look inside a device, neither do we.
Imaging an entire server setup does need some planning first, so call us on 0800 689 0668 before disconnecting any devices. If both parties wish to send their drives in jointly we can arrange this. Send the drives (not the machines) by tracked and insured post, or hand them in yourself at reception; we don't collect. Once received they are placed into secure custody at our Cambridge location.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnostic, a written scope, and joint instructions gladly accepted.