Family Court proceedings are unique in establishing a set of rules governing the use of previously deleted material. In order for deleted material to be used by the courts, the deleted material must have been acquired legally and stored appropriately. We will determine whether you have a legal entitlement to access any devices you wish to examine and provide written confirmation prior to commencing any work. This applies to all clients and family solicitors based within York, including those located in the Minster quarter, through to firms in Selby and Malton.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
The device examined is always your own, genuinely shared, or named in an instruction from a solicitor or court, and no other.
Each family instruction commences with one question: what legal right exists to examine this device? There are three answers which enable us to begin work. The device is yours. The device is genuinely joint property (i.e. the family PC, the shared backup drive etc). A solicitor or the court has instructed the examination of the device. Nothing outside of these answers allows work to begin. To guess another party's passcode or read their personal e-mail is to commit a breach of the Computer Misuse Act 1990, and material so obtained can often cause damage to the party who obtained it. While patience in this regard may cost days, it protects your case for years.
Where the legal footing exists, deletion is rarely the end. From computers, shared drives and the phone backups held on them, we recover message threads, photos with the date they were taken still attached to them, documents and spreadsheets, and browser histories including log-ins around the dates in issue. Each item recovered retains its timestamps (creation, modification, deletion), allowing the items to be placed in chronological order. In disclosure disputes this regularly extends to statements, transfer evidence and business accounting entries relevant to the figures brought before the court.
The majority of forensic instruction originates with solicitors, and both types of appointment are common: instructing on behalf of one side, or as a single joint expert by agreement between the parties. A single joint expert appointment involves imaging the identified device once, limiting the review to the scope permitted by the court, and producing reports for the court rather than for the paying client. The findings are written so a judge can simply adopt them, and the limitations of the evidence receive equal prominence to its merits.
In cases where a device within an individual's right to access might contain information relevant to a case, the best service an individual can provide is to remain inactive regarding the device. Any unlocking of the device creates new data; use of app store recovery software creates even more; family members or other individuals looking at the device create the most, and each of these adds "new" data to the device, re-dating something that may become important to a court. Simply switch it off, place it in a secure location, note where it has been, and then call our freephone number or ask your solicitor to contact us. Handling is documented from that conversation onward.
The process of imaging, verifying and storing devices can be found at the forensic recovery hub; deletion evidence in detail is available on the deleted file forensics page, and preservation practice is under legal hold & chain of custody. Fees are listed on our prices page.
Data from a device you own, one that is genuinely shared, or one a court has directed for examination.
Recovery of deleted chat/text conversation history maintained in chronological order.
Recovered deleted image(s), including associated date/time stamp from original capture.
Letters, statements and accounting records erased, restored.
Browsing and signing into accounts when it counts.
Financial information that may relate to the figures presented before the court.
Timestamps for creating, modifying and deleting, anchoring the account of events.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Family matters can be processed either on your own devices, on devices that are genuinely jointly owned, or as directed by a solicitor or the court. Acceptance of instructions is limited to 3 footings: equipment the company itself owns; the instruction of a solicitor, insurance company or the court; or devices that are genuinely yours, including jointly owned devices in matrimonial matters. We do not "hack", we do not "intercept" live communications, and we do not access any device that the instructing client has no right to examine.
The entitlement and a quotation are established over the phone before you send us anything; contact us on 0800 689 0668, or we would be happy for your solicitor to do so. Once a drive (as opposed to an entire machine) is agreed, it either reaches our Leeds lab tracked next-day, or is hand-delivered to the lab's reception, Monday to Friday, 9am to 5:30pm, with no need for an appointment. Custody of the item is recorded upon arrival.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Contact us directly or via your solicitor; the lawful footing always comes first.