Family firms and small partnerships keep Wiltshire going, and when the people running them fall out, the company's data tends to be the first casualty. We work only on systems the business itself owns, and we establish what was deleted, changed or taken, for firms in Swindon, Devizes, Calne, Cirencester and further afield.
Quiet, methodical, defensible. Nothing starts until the free diagnostic is finished and you have approved a written scope; forensic fees are then paid upfront once you accept the fixed quote.
Whether it's a two-partner practice in Marlborough or a trade business out at South Marston, these are the moments when the systems should be frozen before any more history disappears.
A partnership rarely breaks up cleanly. The pattern we see across Wiltshire is quieter: a new company registered without fanfare, enquiries answered a little more slowly, and books that turn out lighter than anyone remembered when the accountant finally checks. Because the servers, workstations and mailboxes belong to the partnership itself, they can be examined properly, and made to show what was removed, what was rewritten, and on which dates and under which login.
Deleted bookkeeping is very rarely beyond reach. From images of the office machines or server we can recover erased invoices, statements, contracts and correspondence, pull out exports and backups left behind by Sage, Xero and QuickBooks installations, and put a date on every deletion or edit. When the dispute moves from the files to the figures, the recovered material can be handed over cleanly to a forensic accountant to put a value on the loss.
Whether the work, and the money behind it, was being diverted elsewhere is usually the core of the case, and the systems tend to remember: enquiry emails quietly forwarded to an outside address, customer records pulled out in a wholesale export shortly before the split, quotes reissued on a new letterhead, and files leaving on a memory stick or going into a personal cloud account. Once it's tied to dates, devices and logins, that pattern stops being an accusation and becomes a documented record.
A partnership case is argued in front of people who already distrust each other, so the method has to carry the weight. Images are taken behind write-blockers and proven exact with MD5 and SHA-256 hashes, custody is logged at every handover, and the findings are kept separate from the technical appendix so a mediator or judge can follow them without help. We take instruction from one partner, from both together, or from the court, and where the law permits, Passware Kit Forensic deals with any protected file standing in the way.
The end-to-end process (imaging, hashing, custody and reporting) is set out on our forensic data recovery hub. Forensic fees are paid upfront once you accept the fixed quote: £800 + VAT for the standard investigation with report, or £400 + VAT for a forensic binary image plus deleted-file extraction without the report. Full details are on the data recovery cost page. Company machines protected by BitLocker are unlocked before analysis using the key held by the firm.
Across the firm's servers, machines and mailboxes, six threads usually tell the story between them.
Deleted invoices and statements, along with Sage, Xero and QuickBooks data.
What was sent, deleted or forwarded on, and exactly when.
Which way new business, quotes and accounts were being steered.
Deletions and moves across the shared drives, dated and put in order.
Memory sticks and personal cloud accounts that received company files.
Edits, deletions and transfers arranged into a single timeline.
We don't go beyond the partnership's own property: servers, office computers, business mailboxes and genuinely joint assets. A partner's personal phone or home computer is outside our remit, and covert access is refused no matter who asks. Because trust has usually gone by the time we're called, a joint instruction (or one handed down by the court) is often the wisest route, and one we welcome, as it removes any later claim that the findings belonged to one side.
A partnership case often involves imaging the drives from a server or several machines, so ring 0800 689 0668 for a quote before anything is unplugged or reused. We'll plan the submission, jointly with both sides where that helps, and you send the drives rather than the machines, with any server disks taken out and labelled by bay. Custody is recorded from the moment the drives reach our Oxford lab.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Freeze the systems before positions harden: call our freephone number first, get the free diagnostic, and know that joint instructions are welcome.