York's economy runs on close-held firms — family businesses trading along the A64, workshops in Layerthorpe, practices inside the walls — and when the relationship at the top breaks, the company's records take the first damage. Confining the work to systems the business itself owns, we date the deletions, rebuild the records and set out who did what, under which login, when.
◇ Method before speed. The free assessment and a written scope come first; forensic fees are settled in full before any examination starts. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Seen from a two-director practice or a family firm anywhere in North Yorkshire, these are the points at which the systems should be frozen.
A partnership dispute is two versions of the same story argued from the same filing system — which is the investigator's advantage. Because the estate — servers, office machines, business mailboxes — is the firm's own property, it can be examined without touching anybody's private kit, and it holds answers neither side can edit after the fact: what was deleted, what was altered, on which dates, under which account. We establish that record and let it speak, whichever partner it favours.
Bookkeeping removed on the way out is seldom gone. From images of the office machines and server we recover erased invoices, statements, contracts and correspondence, and collect the exports and backing files that Sage, Xero and QuickBooks installations leave behind them. Every recovered item carries its deletion date, so the pattern — steady housekeeping or a burst of removals the week the row started — is visible on its face. Where the argument moves to valuation, the recovered set hands cleanly to a forensic accountant.
Whether enquiries and revenue were steered elsewhere usually decides these cases, and company systems remember the steering: enquiry mail forwarded to an outside address, the customer database exported wholesale shortly before the split, quotations reissued under a new letterhead, files leaving on removable media or into a personal cloud account. Anchored to dates, accounts and hardware, that pattern ceases to be one partner's grievance and becomes the firm's own record of itself.
The findings will be read by people who no longer trust each other, so neutrality has to be built in rather than asserted. Originals are imaged behind write-blockers into E01 files and verified by SHA-256; custody is logged at each handover; protected files are opened with Passware only where a lawful right to them exists. We take instruction from one partner, from both jointly, or from the court — and the joint route, where tempers allow it, forecloses any later claim that the evidence belonged to a side.
The method underneath this page is walked through at the forensic recovery hub. Mailbox and cloud evidence has its own page at email & cloud exfiltration, deletion dating at deleted-file forensics, and fees on our prices page.
Servers, workstations and mailboxes usually tell the story between them.
Erased invoices and statements, plus accounting exports and backups.
Sends, deletions and forwards, each carrying its date.
Where fresh work and quotations were being redirected.
Deletion and move operations on shared storage, in dated order.
Removable media and personal cloud accounts receiving firm data.
Edits, deletions and transfers assembled into one timeline.
The free diagnostic that opens every case is completed within 2 working days of arrival; forensic casework itself is not a no fix, no fee service. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Partnership matters proceed on the firm's own systems, ideally under joint or court instruction. Instructions are accepted on three footings only: equipment the company itself owns; the instruction of a solicitor, insurer or court; or devices that are genuinely the client's own — including jointly owned machines in matrimonial matters. We do not hack, we do not intercept live communications, and we do not examine a device the instructing client has no right to examine.
Imaging a server estate takes planning, so talk to us on 0800 689 0668 ahead of unplugging anything. Submissions can be arranged jointly with both camps where that helps, and the kit is signed into custody the moment it reaches our Leeds location.
Is the drive still inside a computer, laptop, MacBook, iMac, CCTV / DVR or server? Take the hard drive or SSD out first and post the bare drive on its own — removing drives from machines isn't a service we offer. Storage that's soldered to a motherboard (Apple Silicon Macs, certain slim laptops) is the one thing we can't work on: if it doesn't come out, it can't come in.
↓ Print the booking-in & shipping form (PDF)
Address the parcel for the attention of Leeds Data Recovery — about 40 minutes from York via the A64 and A1(M), or next working day by tracked post. You'll hear from us the moment it's booked onto the bench.
Not certain what to pack? Ring 0800 689 0668 first, or run the free online diagnostic.
A free assessment and a written scope — joint instructions welcomed.