Wiltshire runs on family firms and small partnerships — and when the people at the top fall out, the company's data is usually the first thing to suffer. Working only on systems the business itself owns, we establish what was deleted, altered or taken, for firms in Swindon, Devizes, Calne, Cirencester and beyond.
Quiet, methodical, defensible. Nothing starts until the free diagnostic is finished and you have approved a written scope; forensic fees are then settled upfront.
From a two-partner practice in Marlborough to a trade business out at South Marston, these are the moments to freeze the systems before more history disappears.
A partnership rarely splits cleanly. The pattern we meet across Wiltshire is quieter: a new company registered without fanfare, enquiries answered a little more slowly, and books that turn out to be lighter than anyone remembered when the accountant finally checks. Because the servers, workstations and mailboxes belong to the partnership itself, they can be examined properly — and made to say what was removed, what was rewritten, and on which dates, under which login.
Bookkeeping that has been deleted is very seldom beyond reach. From images of the office machines or server we carve out erased invoices, statements, contracts and correspondence, pull exports and backups left behind by Sage, Xero and QuickBooks installations, and attach a date to every deletion or edit. When the argument moves from the files to the figures, the recovered material hands over cleanly to a forensic accountant to put a value on the loss.
Whether the work — and the money behind it — was being steered elsewhere usually sits at the centre of the case, and the systems tend to remember: enquiry mail quietly forwarded to an outside address, customer records pulled into a wholesale export shortly before the break, quotations reissued under a fresh letterhead, files walking out on a stick or into a personal cloud account. Pinned to dates, devices and logins, that pattern stops being an accusation and becomes a record.
A partnership case is argued in front of people who already distrust each other, so the method has to carry the weight. Images are taken behind write-blockers and proven exact by MD5 and SHA-256; custody is logged at every handover; findings sit apart from the technical appendix so a mediator or judge can follow them unaided. We take instruction from one partner, from the two of them together, or from the court — and Passware Kit Forensic deals with any protected file standing in the way, where the law permits.
The end-to-end method — imaging, hashing, custody, reporting — lives on our forensic data recovery hub. Forensic fees are settled upfront — £800 + VAT buys the standard investigation with report, or a forensic binary image plus deleted-file extraction, minus the report, at £400 + VAT — full detail on the data recovery cost page. Company machines under BitLocker are unlocked before analysis using the key held by the firm.
Across the firm's servers, machines and mailboxes, six strands usually tell the story between them.
Erased invoices and statements, plus Sage, Xero and QuickBooks data.
What was sent, deleted or forwarded on, and precisely when.
Where new business, quotes and accounts were being steered.
Deletions and moves across the shared drives, dated and ordered.
Sticks and personal cloud accounts receiving company files.
Edits, deletions and transfers arranged into one timeline.
Our remit stops at the partnership's own property — servers, office computers, business mailboxes and genuinely joint assets. A partner's personal phone or home machine is outside it, and covert access is refused regardless of who asks. Since trust has usually gone by the time we are called, a joint instruction — or one handed down by the court — is often the shrewdest route, and one we welcome: it removes any later claim that the findings belonged to one side.
A partnership case often means imaging a server or several machines, so ring 0800 689 0668 before anything is unplugged or reused. We will plan the submission — jointly with both sides where that helps — and custody is recorded from the moment the equipment reaches our Oxford location.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive — we don't provide an internal drive-removal service. We don't recover storage soldered to a motherboard (e.g. Apple Silicon Macs and some thin laptops) — only drives that can be removed and sent to us.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll call you as soon as we diagnose your media.
Not sure what to send? Call 0800 689 0668 first or use the free online diagnostic.
Freeze the systems before positions harden — freephone first, free diagnostic, joint instruction welcomed.