When directors or partners fall out, the data is usually the first casualty — ledgers vanish, mailboxes empty, customers drift to a new venture. Working on the firm's own systems, we establish what really happened, for partnerships across Swansea, Bridgend, Carmarthen and the M4 corridor.
Discreet, documented, defensible. A free diagnostic and an agreed written scope come first; forensic work is payable upfront.
From Llanelli to Bridgend, these are the warning signs that the company's systems need preserving before anything else disappears.
A partnership dispute rarely announces itself politely. More often a director quietly registers a new company, enquiries start going unanswered, and when the books are finally checked the ledgers are thinner than they should be. Because the systems belong to the partnership itself, this is territory we can examine properly: company servers, shared drives and business machines, analysed to show what was deleted, changed or taken — with dates, accounts and devices attached.
Erased bookkeeping seldom stays erased. Working from images of the office machine or server, we carve deleted invoices, statements, contracts and correspondence out of unallocated space, retrieve exports and backups from Sage, Xero and QuickBooks installations, and date each deletion or edit. If the dispute turns on the figures rather than the files, the recovered material passes cleanly to a forensic accountant to value the loss.
Whether customers and money were steered away is usually the heart of the matter, and mail and file activity tend to give the game away: enquiries forwarded to private addresses, the customer database exported in the weeks before the split, quotes rebadged under a new name, documents copied out to a stick or a personal cloud account. Anchored to dates and devices, that activity shows when the diversion started and what it carried — the difference between suspecting and proving.
A partnership case has a hostile audience built in, so method matters twice over. Images are taken behind write-blockers and verified by MD5 and SHA-256 hash; custody is logged end to end; findings and technical appendix are separated so a mediator, arbitrator or judge can follow them. We are equally content instructed by one partner, by both jointly, or under a court direction — and where encrypted or password-protected material stands in the way, Passware Kit Forensic opens it where the law allows.
The full process — imaging, hashing, custody and reporting — is explained on our forensic data recovery hub. As with all forensic work, fees are payable upfront: £800 + VAT for the standard investigation and detailed report, or £400 + VAT for a forensic binary image with deleted-file extraction and no report — see the data recovery cost page. Company machines protected by BitLocker are decrypted using the recovery key the business holds before analysis.
Across the partnership's servers, machines and mailboxes, these are the threads we follow.
Deleted invoices, statements and Sage, Xero or QuickBooks data.
Sent, deleted and forwarded correspondence that tells the story.
Where leads, quotes and accounts were redirected.
Deletions and moves across shared storage, with dates.
USB devices and personal cloud accounts receiving company files.
The ordered sequence of edits, deletions and transfers.
Our remit is the equipment the partnership owns — servers, office machines, company mailboxes and genuinely joint business assets. A partner's own private phone or home computer sits outside it, and we will not access one covertly. Because trust is usually the first thing lost in these disputes, joint instruction or a court direction is often the wisest route, and one we actively welcome: it leaves neither side able to call the findings partisan.
Partnership evidence often means imaging a server or office machine in full, so call 0800 689 0668 before anything is unplugged. We will plan the submission, take joint instruction where that helps, and log the chain of custody from arrival at our secure Bristol location.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive — we don't provide an internal drive-removal service. We don't recover storage soldered to a motherboard (e.g. Apple Silicon Macs and some thin laptops) — only drives that can be removed and sent to us.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Bristol Data Recovery and we'll call you as soon as we diagnose your media.
Not sure what to send? Call 0800 689 0668 first or use the free online diagnostic.
Preserve the systems before positions harden — freephone advice, free diagnostic, joint instruction welcome.