Open, and logging new jobs · weekdays, 9am–5:30pm Phone is quicker: 0800 6890668
HDR Hull Data Recovery 0800 6890668 Price it up
HDR / Evidence and legal work / Family and civil disputes

Civil and family litigation · digital evidence in Hull

Family and civil disputes, Hull. A date on a file is not a fact; it is a claim to test.

Contested finances in a divorce. A director locked out of the company's records. A partnership argument where the file everyone relies on has been deleted. A probate dispute. A neighbour's camera that turns out to be the only witness. An argument about who altered a document, and when. None of it is criminal work, so the Forensic Science Regulator's statutory Code does not reach it. CPR Part 35 does, and the report is written to that.

The duty to the court, ahead of yours Authority established Imaged before reading

Ring us, in confidence
0800 6890668

What a date actually proves.

Created, modified, accessedCreated is when the file arrived on that volume — copy it and the clock starts again. Modified moves when the contents change. Accessed can move because a backup ran or a scanner read it. All three can be set by hand.
What a deletion leavesA deleted file often sits on the disk until something else needs the space. Entries inside an application's database are a different problem: some stay in free pages and can be carved out, some go at once. Which of those happened is a question we answer, not assume.
Why a screenshot proves littleThere is nothing behind it to examine — no device it came off, no record underneath, nothing to hash. It takes a minute to fake and the other side will say so. The machine itself is the evidence.
One date is not enoughSet a timestamp against the rest of the machine — the event log, the recent-file list, the backup, the sync record — and it either holds or it does not. That comparison is the work.

What Part 35 asks of an expert.

Not one of these? Ring us →
The provisionWhat the rule asksWhat we do about it
CPR 35.3 — the duty to the courtAn expert is there to help the court, and the rule says that duty overrides any obligation to the person who gave the instructions or pays the billIt goes at the head of the report, and the conclusions follow from it
CPR 35.4 — you need the court's permissionThe application names the field, the issues and a costs estimateYou get a written scope and one fixed figure, in time to put both in the application
PD35 3.2 and 3.3Nine content requirements, the range of opinion where there is one, and a statement of truth in the words the direction setsEvery one answered, including who ran the examination
Joint expert, 35.7The court may direct that one expert gives the evidence for both sidesWe take joint instructions, and both sides get the same report
CPR 35.6 questionsWritten questions, once, within 28 days, to clarifyThey are answered in writing, and the answers then form part of the report itself
Sending it to us: insured, tracked post to the intake lab; the way home is paid at our end. Ring before it goes if you would rather someone checked the packing with you first. It is all written down on the sending page.

The stages, one by one.

The casebook in full →
01

First a confidential call, then a price in writing Free

It begins with a conversation in confidence, and there is no charge for it. Three answers shape the rest: what happened, how far it reaches — the machines, the accounts — and what the evidence has to prove. Between them they fix the scope. The scope fixes the one written price, and you have that before any device is touched.

Held in confidenceOne price, put in writingWhat has to be established
02

Image it before reading it

Nothing is opened until a complete copy exists. That is not ceremony. Looking through folders moves the very dates the case may turn on, and it hands the other side an easy question: who decided what was worth looking at? Nobody filters it here.

A copy comes firstNothing read beforehand
03

Work on the copy

The original is put away and stays put away. On the copy we look at the documents in issue and what the file system says about them, at deleted material that can still be carved out, and at the records the machine keeps of drives, accounts and syncing. Where two dates disagree, we say which and why.

Documents and messagesDeleted material carved
04

Then the report

It is addressed to the court, not to you. Qualifications, the material relied on, the substance of the instructions, who did the work, the range of opinion where one exists, and the statement of truth PD35 requires. Our accreditation position is on page one.

Written to CPR Part 35 and PD35Statement of truth signed
05

Exhibits, logs and every hash

A report nobody can test is worth little. So the bundle carries the working with it: every exhibit, the images it was read from, a log of each handover, the hash of everything, and what was written down at the time. The other side's expert can repeat it and land where we did.

Conclusions, with exhibitsHashes on file, movements loggedOpen to being checked

What we see on the bench

  • Authority is the hard part in family work — a shared home computer, a machine one bought and both used, a company laptop in a director's hands: three different questions.
  • Where authority is not established we decline — that is not a formality. The Computer Misuse Act 1990 puts unauthorised access into the criminal law, and a lab sits inside that as well.
  • This is where cheap providers overclaim — a created date quoted as settled fact, with nothing said about how it was arrived at. Dates are the easiest thing on a disk to move: a copy resets one, a restore resets another, a clock can simply be wrong. Ours are qualified.
  • We do not take handsets — computers, drives, cards and the backups that sit on them, yes. Where a case turns on a phone itself, say so early and we will tell you to instruct elsewhere.

The part solicitors ask about most: CPR 35.10 makes the report state the substance of all material instructions, written or oral, on which it was written — and those instructions are not privileged. The court will not order disclosure of the documents behind them, or allow cross-examination on them, unless it is satisfied the statement is inaccurate or incomplete. Worth knowing before the letter of instruction is drafted. PD35 3.3 then fixes the statement of truth in set words, with a warning about contempt for a false statement made without an honest belief in it.

One case from the casebook.

HU · HUL-2026-0863LOGGED ✓

The document was older than the folder it sat in

A Beverley partnership fell out over a set of accounts. One side produced a document said to predate the split. The file had been created on a machine bought after it, and the internal record agreed with the disk. We reported the date and how we reached it, and said plainly that nothing on the drive showed who typed the thing. The claim settled soon after.

Closed without a hearingTimeline agreed by both sides

Before you box it up.

Do these first

  • Settle who can authorise the work
  • Stop using the machine — every hour it runs alters dates you may need
  • Say in the instruction what is actually in issue
  • Ask early whether the court wants a single joint expert

What not to do

  • Handing over a device you cannot authorise
  • Searching it yourself to see what is there
  • Sending screenshots instead of the machine behind them
  • Tidying up the drive before it is imaged

What we get asked on the phone.

Is this work inside the Regulator's Code?

No. The Forensic Science Regulator's statutory Code governs criminal proceedings in England and Wales, and sets ISO/IEC 17025 as the standard there. A financial remedy application, a boundary claim and a director dispute are none of those. We hold no accreditation in any event, and every report says so on page one.

Can you examine my husband's laptop?

Only where somebody entitled to authorise it has done so. Unauthorised access to a computer is an offence under section 1 of the Computer Misuse Act 1990, and that binds this lab as much as it binds you. A shared machine, one bought by both of you and one that is plainly his are three different answers. Ask your solicitor first.

What does a created date actually prove?

That the file reached that volume at that moment. Not that the words were typed then, and not by whom. Copying resets it. The clock can be put back by hand. Modified and accessed shift for reasons nobody intended. A date earns its weight only when the rest of the machine agrees with it.

Are deleted messages recoverable?

It depends where they were kept. We work on computers and storage media, not on handsets. Where a desktop client, a browser profile or a phone backup sits on a machine we hold, deleted entries can survive in the free space of the database until it is reused. Once that space is written over they are gone.

Image it before either side leans on it.

In a family or civil matter the device is often the one thing both sides will accept, so it is worth capturing cleanly before anyone builds a case on it. Log a job. The first look costs nothing, and what you tell us stays private.

0800 6890668