York's economy runs on closely held firms: family businesses trading along the A64, workshops in Layerthorpe, practices inside the city walls. When the relationship at the top breaks down, the company's records take the first damage. By limiting our investigation to systems the business itself owns, we date the deletions, rebuild the records, and establish who made what changes, under which login, and when.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
From the perspective of a two-director practice or any family firm anywhere in North Yorkshire, these are the points at which you should freeze the systems.
A partnership dispute is two versions of the same story argued from the same filing system, and that is the investigator's advantage. Because the estate (servers, office machines, business mailboxes) belongs to the firm, it can be examined without touching anybody's private kit, and it holds answers neither side can edit after the fact: what was deleted, what was altered, on which dates and under which account. We establish that record and let it speak, whichever partner it favours.
Most bookkeeping removed on the way out does not actually disappear. Images of the office machines and server show us deleted invoices, statements, contracts and correspondence, and we also collect the exports and backing files that Sage, Xero and QuickBooks leave behind them. Each recovered file carries the date it was deleted, so the pattern is plain to see: either regular housekeeping or a spike of removals during the week the row began. Where the argument moves on to valuation, the recovered data set hands cleanly to a forensic accountant.
Whether enquiries and income were steered elsewhere usually decides these cases, and company systems remember the steering: enquiry email forwarded to an outside address, the customer database exported wholesale shortly before the split, quotes reissued under a new letterhead, files leaving on removable media or going into a personal cloud account. Tied to dates, accounts and hardware, that pattern stops being one partner's grievance and becomes the firm's own record of its history.
Since the results of our analysis will be read by people who no longer trust one another, we need to build in neutrality rather than assert it. Originals are imaged behind write-blockers, saved as E01 files and verified by SHA-256. Custody is logged every time there is a handover. Protected files are opened with Passware only where a lawful right to access them exists. We take instruction from one partner, from both jointly, or from the court, and the joint route, where tempers allow it, rules out any later claim that the evidence belonged to one side.
The method behind this page is walked through at the forensic recovery hub. There are pages for mailbox and cloud evidence at email & cloud exfiltration, deletion dating at deleted-file forensics and fees on our prices page.
Normally servers, workstations and mailboxes provide enough information to determine what happened.
Invoices, accounts statements, accounting exports and backups that have been erased or missing.
Each email sent, deleted or forwarded, with its date.
Where new projects and quotations were being redirected.
The deletion and moving of documents from a shared drive, in chronological date order.
Firm files stored onto removable media or personal cloud accounts.
All file changes (edits), deletions, and transfers are compiled into a single timeline.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
In partnership disputes, the work proceeds on the firm's own systems, ideally under joint or court instruction. We accept instructions on only 3 bases: equipment that is owned by the company; an instruction from a solicitor/insurer/court; or equipment genuinely owned by the client, including jointly owned machines in matrimonial matters. We do not hack, we do not intercept live communications and we do not examine any device which the client has no legal right to examine.
Imaging a large server estate requires considerable forward planning, so please call us on 0800 689 0668 for your quote before disconnecting anything. Each server disk is removed and labelled with the bay it was located in, and drives travel without their machines. Where appropriate, submissions can be made jointly with both parties, and all disks will be formally signed into custody upon arrival at our Leeds laboratory.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Free assessment; written scope statement; joint instructions welcome.