HDR / Evidence and legal work / Family and civil disputes

Civil and family litigation · digital evidence in Hull

Family and civil disputes, Hull. A date on a file is not a fact; it is a claim to test.

Disputes over money during a divorce. A director unable to access the company's data files. Arguments among partners about data files used by all parties involved that have since been deleted. Dispute in a probate case. Camera installed by a neighbour that is now the only piece of evidence. Who made changes to documents and when. All of these cases aren't criminal, therefore the statutory Code developed by the Forensic Science Regulator doesn't apply. However, Part 35 of the Civil Procedure Rules (Part 25 of the Family Procedure Rules in family matters) applies and our reports are prepared according to those standards.

The duty to the court, ahead of yours Authority established Imaged before reading

Ring us, in confidence
0800 6890668

What a date actually proves.

Created, modified, accessed'Created' refers to the date that the file first arrived on the volume; if you copy it then the clock is reset. 'Modified' refers to the date and time that the file's content was changed. 'Accessed' can refer to any access to the file whether it be a backup running, a scanner reading it etc. Any of these can be manually set.

What a deletion leavesDeleted files do not always immediately disappear from the disk; they often remain until another file needs the space. Deleted entries within an application's database are a completely different situation: sometimes they will sit in free pages for a while and can be carved out; sometimes they will instantly be gone. It is our job to find out which type of scenario occurred with regard to each entry.

Why a screenshot proves littleA screenshot does not contain anything further to review: no device for it to come from, no record beneath it, nothing to "hash". Faking it takes less than one minute and the opposing party will tell you that. The machine itself is the evidence.

One date is not enoughCompare the time stamp generated by the machine itself with the remaining components of the machine (event logs, most recently opened file lists, backups, sync records, etc.) and either it confirms or it does not. The comparison is the job.

What Part 35 asks of an expert.

Not one of these? Ring us →

The provision	What the rule asks	What we do about it
CPR 35.3: duty owed to the court	Expert witnesses owe their duty to the court and not to the individual(s) providing them with payment or giving them instructions. As such, this duty takes precedence over any obligations created through contract.	This duty is stated at the beginning of the report and forms the basis of all subsequent conclusions.
CPR 35.4: court permission required	Your application must specify which field(s) you wish to rely upon and the issues involved, and include any relevant estimated costs.	In time to include them in your application, you will receive a written description of scope and one fixed price.
PD35 3.2 and 3.3	Nine areas of required content, the range of opinions where there is one, and a statement of truth in terms set forth by the direction.	Each requirement has been addressed, including who conducted the examination.
Joint expert, 35.7	A court may order one expert to give evidence on behalf of both parties.	We accept joint instruction(s), and both parties receive the same report.
CPR 35.6 questions	One written inquiry per party (within 28 days) to provide clarity	Answers are provided in writing and become part of the final report

Sending it to us: Get a price quotation prior to sending, via telephone or using the form. Send it to the Leeds intake lab by post. Postage should be insured and traceable. Alternatively drop it off there in person, Monday to Friday, 9am to 5:30pm, with no appointment needed. Return postage will be paid by us. Call us prior to sending if you would like us to check the packing with you. All details are contained within the posting page.

The stages, one by one.

The casebook in full →

First a confidential call, then a price in writing Free

This commences with a confidential discussion, and there is no cost involved. These three elements will define the remainder of our work together: What happened? How extensive is this issue (machines, accounts etc.)? And what does the data/evidence need to prove? Together these three factors establish the scope. The scope defines the fixed fee. You have this fixed fee in writing prior to any equipment being examined.

Held in confidenceOne price, put in writingWhat has to be established

Image it before reading it

Documents are not accessed or opened prior to production of a full and complete copy of all data. This is not ceremonial. Reviewing folder structures alters dates that could be critical to your case, and provides your opponent with an opportunity to ask who decided what files were worthy of review. No filtering occurs in our process.

A copy comes firstNothing read beforehand

Work on the copy

The original remains stored away after copying. On the copy, we examine the files involved in this matter, what the file system indicates about those files, deleted information that can potentially be recovered, and details maintained by the device regarding drive usage, user account activity, and synchronisation events. When conflicting dates arise from multiple sources, we identify each and explain why they exist.

Documents and messagesDeleted material carved

Then the report

Our reports are directed to the court; not directly to you. Details regarding qualifications, materials utilised for the analysis, details of instructions received, personnel responsible for conducting the analysis, differences in opinion when present, and the statement of truth required under PD35. Our accreditation status is located on page one of our report.

Written to CPR Part 35 and PD35Statement of truth signed

Exhibits, logs and every hash

Reports that cannot be tested will be worth little. Therefore, the bundle includes all of the work: exhibits, images, logs of handovers, hashes of everything and notes taken at the time. A third party (the opposing side's expert) can simply repeat our process and reach the same point we reached.

Conclusions, with exhibitsHashes on file, movements loggedOpen to being checked

What we see on the bench

Authority is difficult to establish in family matters: a shared home computer, a computer purchased by one individual but used by both individuals, or a corporate laptop assigned to a director represent three distinct inquiries.
When authority has not been demonstrated, we decline to participate. Establishing authority is not merely procedural. The Computer Misuse Act 1990 places unauthorised access to computing systems into the realm of criminal law. A laboratory also operates under such regulations.
Cheap providers overclaim: A "created" date is stated as fact without reference to methodology employed to derive such date. Dates are easily moved; copying creates new dates, restoring a backup creates new dates, and a clock can simply be wrong. All dates provided by our team are subject to qualification.
We do not accept handset devices; computers, drives, cards and backups associated therewith, yes. If your case revolves around the phone itself, please advise us promptly and we will direct you to retain an expert outside of our field of expertise.

Most often asked about by solicitors: CPR 35.10 requires the report to detail the essence of all material instructions given (either orally or in writing), on which it was created, and these instructions are non-privileged. The court cannot require disclosure of the documentation that prompted these instructions, nor permit cross examination thereof, unless it concludes there are reasonable grounds to consider the statement either incomplete or inaccurate. Solicitors need to appreciate this prior to drafting the letter of instruction. PD35 3.3 subsequently formalises the wording of the statement of truth with a stern warning regarding contempt for a false statement made whilst having no genuine belief in its veracity.

One case from the casebook.

HU · HUL-2026-0863LOGGED ✓

The document was older than the folder it sat in

A partner dispute occurred at a Beverley firm regarding the preparation of the firm's accounts. One side provided documentation that purportedly existed prior to the dispute. The documentation originated from a new computer purchased after the time the documents claimed to have been prepared, and the internal record agreed with the disk; our review revealed no evidence that indicated who wrote the document(s). Our report simply stated what date we believed the files to have been written based upon our analysis, and why we concluded that date. The parties resolved their claims shortly thereafter.

Closed without a hearingChronological record agreed by both sides

Before you box it up.

Do these first

Determine who can authorise the work required.
Do not use the machine further; you alter dates on the disk each time it is used.
State clearly in your instruction letter what issues are involved in the case.
Inquire early in the process whether the court wants both sides to use a single joint expert.

What not to do

You should never hand over a device you cannot authorise.
You should never search the device yourself to determine what is there.
Never send screenshots instead of sending in the actual device for inspection.
Never clean or otherwise modify your disk before turning it over for imaging

What we get asked on the phone.

Is this work inside the Regulator's Code?

No. The statutory Code issued by the Forensic Science Regulator governs criminal matters in England and Wales, and it states that criminal matters shall comply with ISO/IEC 17025. This does not apply to financial remedy applications; disputes regarding boundaries; and/or disputes regarding directors. In any case, we do not possess any form of accreditation; therefore each report will clearly indicate that on page one.

Can you examine my husband's laptop?

Only when someone entitled to authorise it has done so. Accessing another person's computer without authority constitutes an offence under s.1 of the Computer Misuse Act 1990 and applies equally to this laboratory as it would apply to you. A shared machine, one purchased by both parties, and one that is clearly owned by him alone: these constitute three entirely different responses. Consult your solicitor first.

What does a created date actually prove?

That the file had reached that volume at that time. Not who wrote the words in question, nor when they were written. Copying the data resets the clock. The clock can be reset manually. Modified and accessed shift for reasons neither intended nor contemplated. A date carries weight only when all other parts of the machine concur with that date.

Are deleted messages recoverable?

This depends upon where they are stored. This laboratory deals with computers and storage media, not handsets. When a desktop client, browser profile, or phone backup exists on a machine that we possess, deleted entries can remain within the database free space until such time as that space is re-allocated. At that point the entries are erased from existence.

What people read after this.

Forensic recovery → Reports for the court → Deleted by mistake → Forensics and evidence →

Image it before either side leans on it.

As a rule of thumb, in family or civil cases the device(s) are usually one of the few things that both parties agree upon, therefore it is worth taking a clean image of the device(s) prior to either party building their case around them. Log a job. Our first look costs nothing, and what you tell us will remain private.

0800 6890668

Price it up How to post it to us

Devices and media we work on

Sorted by fault

Forensic and CCTV evidence

What to expect