As soon as directors/partners have disagreements, the data is usually the first casualty (ledgers disappear, mailboxes are emptied and clients drift to a new venture). We work on the firm's own systems to determine what was actually occurring, for partnerships across Swansea, Bridgend, Carmarthen and the M4 corridor.
Discreet investigations are conducted, documented and defendable. There is no cost for an initial diagnosis and a written scope is agreed prior to beginning forensic examination, which is payable upfront.
From Llanelli to Bridgend, these are the indicators that you should preserve the systems used by the company before anything else is lost.
Partnership disputes normally don't introduce themselves nicely. Rather, a director quietly forms a new entity as a new company registration is done; enquiries start to go unanswered; and once the financials are finally reviewed, it's clear that there is less in the ledgers than there should be. Since these systems belong to the partnership itself, this is an area we can thoroughly review: examining the drives from company servers, shared storage areas and business computers, and analysing them for deletion, modification or removal, with dates, accounts and device names listed.
Most deleted bookkeeping is never actually erased from a computer system. We use image copies of your company's office machine or server in order to carve out deleted documents such as deleted invoices, deleted account statements, deleted contracts and deleted correspondence from the unallocated space on your company's hard drive. We will also locate and recover the exported data and backed up data from your Sage, Xero and QuickBooks installations. In addition, we will include the date of each time an item was removed or modified. If the case hinges on the figures rather than which specific documents were lost, the information we find can be easily passed on to a forensic accountant who will value the loss.
The central issue typically relates to whether money and customers have been diverted from one entity to another, and the usual indicators are generally found in email/file activity: enquiries routed to private e-mail addresses, customer databases exported in the weeks prior to the separation date, quotes with the same content being issued with a new company name, documents duplicated onto a stick or a personal cloud storage account. All of this can be tied directly to dates and devices, which will show you when the diversion began and what was diverted, thus making the move from suspicion to proof.
In the case of an antagonistic audience (as is inherent with cases involving partnerships), how things are done matters twice over. All images will be captured behind write blockers and then verified via MD5 and SHA-256 hashes; all custody will be logged from start to finish; findings and the technical appendix will be kept separate to allow a mediator/arbitrator/judge to follow them. We have no preference between being instructed by either partner individually, by both partners jointly, or under a court direction. If we encounter any encrypted/password protected materials that stand in the way of reviewing the data, Passware Kit Forensic will open those materials when permitted by law.
Our forensic data recovery hub explains in detail how we image the disks, hash the images to ensure integrity, keep a chain of custody, and then produce a detailed report regarding our findings. As with all forensic data recovery services, payment is required prior to commencement: £800 + VAT for the standard investigation and detailed report, or £400 + VAT for the creation of a forensic binary disk image from which deleted files are extracted, without a report (see the data recovery cost page). Company machines encrypted by BitLocker are decrypted via the recovery key that the business holds, prior to examination.
These are the threads that lead us through the server(s), machine(s) and mailbox(es) in the partnership.
Deleted invoices, statements and any other financial information (e.g. Sage, Xero or QuickBooks data) recovered.
Sent, deleted and forwarded communications that tell the story.
How leads, quotes and account information were being redirected.
List of deletions and moves made across shared storage, including dates.
Company files copied onto USB devices and personal cloud accounts.
In order, a list of all changes (edits, deletions, file transfers).
Our mandate is the equipment owned by the partnership (i.e. servers, office machines and company email accounts) and assets that can genuinely be described as joint business assets. In contrast, an individual partner's own private phone or home computer is clearly excluded from our scope of work and we would never access such items secretly. As one of the first things to go when this type of dispute arises is trust, both parties are often best off going down the path of either joint instructions to us from them together, or a court direction, and it is a route we actively welcome. This way, neither party could claim that our findings were biased or otherwise motivated by their interests alone.
Partnership evidence often means making images of all disks on a server or an office machine. Therefore, it would be wise to call 0800 689 0668 to request a quote prior to unplugging anything from your system. The only items sent to us are the disks and no other part of the equipment (servers/machines). Each disk should be clearly labelled with the bay it was taken from. We will work in conjunction with you on how best to submit the disks, and take joint instruction where that helps. From the arrival of the disks at our secure Bristol location, we will log the chain of custody.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Preserve systems before positions harden: freephone advice, free diagnostics, joint instructions are always welcome.