Open, and looking at it costs nothing · 9am–5:30pm, Mon to Fri Ring instead, it is quicker: 0115 8220606
NDR Nottingham Data Recovery 0115 8220606 Get my quote
NDR / Claims, court and footage / Divorce and civil disputes

Divorce, probate and civil litigation · digital evidence, Nottingham

Digital evidence in divorce, Nottingham. A timestamp is a claim; only the rest of the machine can settle it.

Civil is not criminal, and on this bench that distinction counts. A document altered, and an argument about when. A director shut out of the records his own company keeps. Divorce money at issue; a probate dispute; a partnership row resting on a single deleted file; and a camera next door that turns out to be the only witness. The detection and investigation of crime, as well as criminal proceedings within England and Wales, is the entire domain of the Forensic Science Regulator's statutory Code, so none of the matters on this page fall into it or need accreditation. The rules that do apply are CPR Part 35 and PD35, and the reports are built to those rules. Scoping is free, followed by one figure in writing before any chargeable work starts, from £800 + VAT.

The court is owed more than the client Permission settled at the outset Copied before a folder is opened

An engineer will talk it through with you, in confidence
0115 8220606

What a timestamp actually proves.

The three dates a file carriesThe date a file was created is when it landed on this volume, and copying it elsewhere resets that date. Changing the contents is what moves modified. Accessed can move for dull reasons (a backup ran, or a scanner passed over the file). Each of the three can also be set by hand.
What a deletion actually leavesDeleted files generally remain in place until the disk needs the space, but entries stored within an application's database are treated differently: some sit on in free pages that carving may still reach; others disappear the moment they are deleted. Which it is gets established, rather than assumed.
A screenshot is worth very littleThere is no device behind a screenshot, no underlying record, nothing to hash. A convincing fake takes a minute to make, and the other side will make that point for you. Evidence is the machine itself.
A single date decides nothing on its ownSet the timestamp against everything else on the machine (event logs, recent files, backups made, sync history) and it will either hold or it will not. That comparison is the job.

Part 35, rule by rule, and how each one is met.

Something else? Say what it does →
Which ruleWhat it asks forHow it is met here
CPR 35.3 — the overriding dutyAn expert serves the court, and the rule places that obligation above any owed to a paying clientThat obligation is stated in the opening paragraph of the report, and every finding below answers to it
CPR 35.4 — permission to rely on itThe application must describe the area of expertise involved, the issues it will address, and the estimated costA written description of the scope and a firm price reach you early enough to go into that application
PD35, paragraphs 3.2 and 3.3Nine things that must appear in the report, whatever the range of opinion among experts, and a statement of truth worded exactly as the direction sets outAll nine items, and the examiner is named
CPR 35.7 — one expert for both sidesThe court can direct that evidence be given by one expert jointly instructed by both sidesJoint instructions taken, and both sides receive an identical report
CPR 35.6 — questions in writingOne round of written questions for clarification, within 28 daysAnswers to those questions are given in writing and become part of the report itself
Getting it here: first of all you need to get a quote, either by phone (0115 8220606) or through the online form. Once you have your quote, send it to our intake lab by tracked, insured post: Manchester Data Recovery, Peter House, Oxford Street, Manchester M1 5AN. Alternatively, you can drop it in there Monday to Friday, 9am to 5:30pm, without booking an appointment. Postage to return your data once recovered is paid for by us. If you are unsure what should go in the box and what should stay at home, contact us before sealing it and one of our engineers will walk you through exactly what needs to be sent and what can be left behind. All other details on packing and postage can be found in our packing and postage guide.

The order we work in.

More jobs like this one →
01

Tell us what has happened, in confidence — a written figure follows Free

Forensic costs start at £800 + VAT depending on the scope of the job, as identified on your first call to us: what time frame and specific dates are in dispute? What equipment or accounts are involved? What evidence is needed? Your first call to us is free. Nothing is charged until you have our quote in writing.

The first call stays confidentialOne figure, fixed and written downThe questions the evidence has to answer
02

A copy first, then the reading

Ceremony has nothing to do with it: the full copy exists before even a single folder is opened. Open a folder, and dates a case may turn on can move. In addition, you give the opposing side a simple opportunity to strike: who selected the folders worth looking at? There are no selections here. There is no filtering.

Copy first, then anything elseNo folder opened first
03

The original stays sealed; the copy is worked

The original goes into access-controlled storage, and it does not come back out. Everything happens on the image. The documents in issue. What the file system holds on each of them. Deleted data still open to carving. Anything the machine recorded about drives plugged in, accounts used and data synced. If two dates are inconsistent, the report states which one it relies on and why.

Files, mail and messagesDeleted content carved back
04

Then the report is drafted for the court

Under PD35 a report is addressed directly to the court, not to the person who paid for it, and it is written in that voice. Qualifications first. Then the material relied on, the substance of our instructions, who carried out the work, and any range of opinion. Finally the statement of truth, worded as PD35 directs. Accreditation has already been dealt with, on page one.

Drawn up under CPR Part 35 and PD35Signed statement of truth attached
05

The bundle, the hashes and the handover log

If you give another party a result they can't verify themselves, then you have given them grounds for argument. So the bundle contains all the information: exhibit numbers, hash values, dated handovers (signed at both ends), the image each conclusion came from, and the notes taken while working at the bench. Run it again and you get the same answer.

Each finding traced to its exhibitHashes recorded, and every move loggedRepeatable, step by step

What turns up on recorder disks

  • Family work turns on authority: the shared computer at home, the machine bought by one party but used by both, the company laptop kept by a director. Three sets of facts, and three different answers.
  • Without authority there is no job, and this is not simply a matter of completing forms. Unauthorised access is an offence under section 1 of the Computer Misuse Act 1990, and laboratories are subject to it like anyone else.
  • Cheap providers overreach here: a created date presented as settled fact, with silence about how it was reached. No value on a disk moves more easily. Copying the file resets it; a restore resets it again; and the clock may never have been right in the first place. Ours come with the qualification attached.
  • No handsets on this bench: computers yes, drives yes, cards yes, a phone backup made to a machine yes. If the handset itself is the evidence, tell us on the first call and we will point you elsewhere.

What solicitors ask about most: under CPR 35.10 the substance of every material instruction, oral or written, must appear in the report, and privilege cannot protect it. The rule then provides a safeguard: unless the court is satisfied that the statement of instructions is incomplete or inaccurate, no disclosure of the underlying documents, and no cross-examination on them, will be permitted. That is important to know while your letter is still in draft. Lastly, PD35 3.3 fixes the wording of the statement of truth, and it carries a warning: signing one without an honest belief that it is true is contempt.

One of these, from start to finish.

NG · NTG-2026-2013ON THE LOG ✓

The document predated the computer it sat on

A significant issue arose over accounts in a Newark-on-Trent partnership, where one party produced a document dated before the two of them split. The machine used to create it was bought later, and the file's internal record said the same thing the hard drive did. Our report showed the date, explained how that date was arrived at, and included a clear caveat: nothing on the drive showed who had been sitting at the keyboard. Settlement quickly followed.

Concluded before it reached a hearingThe run of events accepted on both sides

What helps, and what does damage.

Worth doing first

  • Establish who can lawfully authorise the examination
  • Stop using the machine: each hour of use moves dates you may need
  • State in the instruction what is genuinely in dispute
  • Ask early on whether one joint expert would suit the court better

What makes it harder

  • Handing over a device nobody has authorised you to have examined
  • Looking through it yourself first
  • Sending screenshots when the machine itself is what counts
  • Tidying up the drive before anybody images it

What gets asked before posting.

Does the statutory Code reach civil work?

No, and that is what is important here. The statutory Code administered by the Regulator relates solely to one thing: the criminal justice system of England and Wales, specifically the detection and investigation of crime, and criminal proceedings, where ISO/IEC 17025 is the standard it names. Boundary claims are not criminal proceedings. Nor is an application for financial remedy, nor are disputes among directors. In any event we hold no accreditation for anything of any kind, and each report clearly says so on its first page.

Whose laptop am I allowed to send?

Only with authorisation from whoever is entitled to give it. Section 1 of the Computer Misuse Act 1990 makes it an offence to get into a computer you have no authority to access, and laboratories are bound by it in exactly the way you are. A shared machine, a jointly bought machine, or plainly someone else's machine: three sets of facts and three different answers. Ask your solicitor first.

How much weight does a created date carry?

That the file ended up on that volume at that particular time, and that is all it says. Nothing about when the words were written. Nothing about who typed them. The value resets when a file is copied. Clocks can be turned back by hand. Modified shifts, accessed shifts, and often nobody meant either to happen. A date is merely an assertion until the rest of the machine supports it.

Do deleted messages ever come back?

Where the data was stored decides it. Storage media and computers are taken here; handsets are not. A deleted entry may survive in the free pages of a database (a browser profile, a desktop mail client, a phone backup written to a machine) for as long as no other data has overwritten that space. Once something else has been placed on top of it, all trace of it disappears.

Start here if the same thing is happening to yours.

How a forensic job runs → What the report contains → What survives a deletion → Jobs that end up in court →

Power the recorder down before the loop reaches your clip.

Remove power from the DVR before you do anything else: as long as it is powered, it keeps writing, and the oldest footage goes first. Then get a quote and post the disk in. The first look is free. CCTV and DVR work is £400 + VAT, quoted in writing before any work starts, and anything recovered from the disk goes no further than our bench.

0115 8220606

Get my quote Posting it to Manchester