NDR / Claims, court and footage / Divorce and civil disputes

Divorce, probate and civil litigation · digital evidence, Nottingham

Digital evidence in divorce, Nottingham. A timestamp is a claim; only the rest of the machine can settle it.

Civil is not criminal, and on this bench that distinction pays. A document altered, and an argument about when. A director shut out of the records his own company keeps. Money in dispute on a divorce; a probate dispute; a partnership row resting on one deleted file; a camera next door that proves to be the only witness there is. The criminal justice system in England and Wales, the detection and investigation of crime as well as criminal proceedings, is the whole territory of the Forensic Science Regulator's statutory Code, so nothing on this page falls under it and nothing on this page needs accreditation. The rules that do bite are CPR Part 35 and PD35, and the report is built to them. Scoping is free, then one figure in writing before anything chargeable begins — from £800 + VAT.

The court is owed more than the client Permission settled at the outset Copied before a folder is opened

An engineer will talk it through, in confidence
0115 8220606

What a timestamp actually proves.

The three dates a file carriesCreated is the moment a file landed on this volume — and copying it somewhere else restarts that clock. Contents changing is what moves modified. Accessed can move for dull reasons: a backup ran, or a scanner passed over the file. Every one of the three can also be set by hand.

What a deletion actually leavesUntil the disk needs that space, a deleted file generally stays exactly where it was. Entries held inside an application's database are a different matter — some sit on in free pages that carving can still reach, and some vanish the moment they are removed. We establish which, rather than assuming.

A screenshot is worth very littleA screenshot has no device behind it, no underlying record, nothing to hash. One that looks convincing takes a minute to make, and the point will be made for you by the other side. What counts as evidence is the machine itself.

A single date decides nothing on its ownSet the timestamp beside everything else on the machine — event logs, recent files, backup records, sync history — and it will either hold or it will not. That comparison is the job.

Part 35, rule by rule, and how each one is met.

Something else? Say what it does →

Which rule	What it asks for	How it is met here
CPR 35.3 — the overriding duty	An expert assists the court — and the rule places that duty above whatever is owed to a paying client	It heads the report, and every conclusion beneath answers to it
CPR 35.4 — permission to rely on it	The application must set out the expertise involved, the issues it will cover, and what it is estimated to cost	A written scope and a fixed figure reach you early enough to go into that application
PD35, paragraphs 3.2 and 3.3	Nine content requirements, whatever range of opinion exists, and a statement of truth worded exactly as the direction sets out	Every one of the nine, and the examiner is named
CPR 35.7 — one expert for both sides	The court may direct that evidence come from one expert whom both parties instruct	Joint instructions taken, and each side gets the identical report
CPR 35.6 — questions in writing	One round of written questions for clarification, inside 28 days	The answers go back in writing, and become part of the report itself

Getting it here: tracked, insured post to the intake lab, and the return leg is at our cost. Unsure what belongs in the box? Ring before it is taped up, and an engineer will run through what to include and what to keep at home. The rest of it is set out on the packing and postage guide.

The order we work in.

More jobs like this one →

Tell us what has happened, in confidence — a written figure follows Free

Forensic instructions begin at £800 + VAT, and where yours sits depends on scope — which is exactly what the first call settles: the events and dates at issue, the machines and accounts involved, and what precisely has to be proved. That call is free, and nothing chargeable starts before the figure is with you in writing.

The first call stays confidentialOne figure, fixed and written downThe questions the evidence has to answer

A copy first, then the reading

Ceremony has nothing to do with it: the full copy exists before a folder is opened. Open one and the dates a case may turn on move. Worse, you hand the other side a question with an easy sting in it — who chose the folders worth looking at? Here, nothing gets chosen. Nothing gets filtered.

Copy first, then anything elseNo folder opened first

The original stays sealed; the copy is worked

Access-controlled storage takes the original, and it does not come back out. Everything happens on the image. Whichever documents are in issue. What the file system holds on each of them. Deleted material still open to carving. Whatever the machine logged about drives plugged in, accounts used, syncing done. Where two dates disagree, the report says which one it prefers, and why.

Files, mail and messagesDeleted content carved back

Then the report is drafted for the court

Under PD35 a report is addressed to the court rather than to whoever paid for it, so that is the voice it is written in. Qualifications first. Then the material relied on, our instructions in substance, who carried out the work, and any range of opinion there is. Last comes the statement of truth, worded as PD35 directs. Accreditation has already been dealt with, on page one.

Drawn up under CPR Part 35 and PD35Signed statement of truth attached

The bundle, the hashes and the handover log

Give the other side a finding they cannot check for themselves and you have given them an argument. So the bundle carries all of it: exhibit numbers, hashes, dated handovers signed at both ends, which image every conclusion came off, and the notes typed at the bench as the job ran. Run the same steps again and the answer is the same.

Each finding traced to its exhibitHashes recorded, and every move loggedRepeatable, step by step

What turns up on recorder disks

Family work turns on authority — the home computer you both use, the machine one of you paid for and both of you used, the company laptop a director still has. Three sets of facts, three different answers.
Without authority there is no job — and this is not a form-filling point. Unauthorised access is an offence under section 1, Computer Misuse Act 1990, and laboratories are not exempt from it.
Cheap providers overreach here — a created date passed off as settled fact, with silence about how it was reached. No value on a disk moves more easily. One copy resets it; a restore resets another; and the clock itself may never have been right. Ours come with the qualification attached.
No handsets on this bench — computers yes, drives and cards yes, a phone backup written to a machine yes. Where the handset itself is the case, tell us on the first call and you will be pointed elsewhere.

What solicitors ask about most: the substance of every material instruction, oral or written, has to appear in the report under CPR 35.10, and privilege does not protect it. What the rule then adds is the safeguard: neither disclosure of the underlying documents nor cross-examination upon them will be permitted unless the court is satisfied the statement of instructions is incomplete or inaccurate. That is worth knowing while your letter is still a draft. The wording of the statement of truth is then fixed by PD35 3.3, which carries a warning — signing one without honest belief is contempt.

One of these, from start to finish.

NG · NTG-2026-2013ON THE LOG ✓

The document predated the computer it sat on

Accounts were the trouble in a Newark-on-Trent partnership, where one side produced a document dated before the two of them parted. The machine that had created it was bought later, and the file's own internal record said the same thing the disk did. Our report set out the date, then the route by which we had reached it, then a plain caveat: nothing on that drive identified who had sat at the keyboard. Settlement followed shortly.

Concluded before it reached a hearingThe run of events accepted on both sides

What helps, and what does damage.

Worth doing first

Establish who can lawfully authorise the examination
Stop using the machine — each hour of use moves dates you may need
State in the instruction what is genuinely in dispute
Ask early if a single joint expert might suit the court better

What makes it harder

Handing over a device nobody has authorised you to have examined
Looking through it yourself first
Sending screenshots when the machine itself is what counts
Tidying up the drive before anybody images it

What gets asked before posting.

Does the statutory Code reach civil work?

No, and that is the point worth taking in. The statutory Code administered by the Regulator is tied to one thing: the criminal justice system in England and Wales — the detection and investigation of crime, and criminal proceedings — where ISO/IEC 17025 is the standard it names. A boundary claim is not a criminal proceeding. Neither is an application for financial remedy, nor a row among directors. In any event we hold no accreditation for any matter of any kind, and each report says so on its first page.

Whose laptop am I allowed to send?

Only with a yes from whoever is entitled to give one. The Computer Misuse Act 1990 makes it an offence at section 1 to get into a machine you have no right to, and a laboratory is bound by that in exactly the way you are. Shared machine, jointly bought machine, plainly their machine: three sets of facts and three different answers. Ask your solicitor first.

How much weight does a created date carry?

That the file landed on that volume at that point — nothing else. It says nothing about when the words were written, and nothing about who wrote them. The value resets when a file is copied. Clocks can be turned back by hand. Modified shifts, accessed shifts, and often nobody meant either to. Until the rest of the machine supports it, a date is an assertion.

Do deleted messages ever come back?

Where they were stored decides it. Storage media and computers are taken here; handsets are not. Deleted entries can survive among the free pages of a database — a browser profile, a desktop mail client, a phone backup written to a machine — for as long as that space stays unclaimed. Once something else has been written over it, nothing returns.

Start here if the same thing is happening to yours.

How a forensic job runs → What the report contains → What survives a deletion → Jobs that end up in court →

Power the recorder down before the loop reaches your clip.

Cut the power to the DVR before anything else — while it runs it keeps writing, and the oldest footage goes first. Then post it in. The first look is free, CCTV and DVR work is £400 + VAT quoted in writing before anything starts, and what is on that disk goes no further than the bench.

0115 8220606

Get my quote Posting it to Manchester

Disks, cards and whole machines

Start with what it is doing

Footage, forensics and reports

The price, and what happens next