Open, and work is coming in · weekdays, 9am–5:30pm Faster by phone: 0800 6890668
PDR Plymouth Data Recovery 0800 6890668 Get a price
PDR / Legal and insurance work / Family and civil matters

Family and civil litigation · digital evidence, Plymouth

Civil and family disputes, Plymouth. A timestamp is merely a claim. It is not fact until it is tested.

Arguments over who altered a document, and at what time. A director unable to gain access to their own company records. Disagreements over finances within divorce proceedings, or probate. A dispute amongst partners where the shared file everybody relies upon has been deleted. A neighbour's surveillance camera that ultimately becomes the only witness anybody has. None of this is criminal work. Therefore the statutory Code written by the Forensic Science Regulator does not govern it. Instead, it is governed by CPR Part 35, and that is the format the report is built to.

The court's needs come before yours Authority confirmed Copied before reading

A quiet word first?
0800 6890668

What a timestamp really shows.

Created, modified and accessedCreated marks when the file lands on a volume. When it is copied, the clock starts over again. Modified shifts when contents change. Accessed can move because something backed up the file or a scanner opened it. All three types of date can be set by hand.
What deleting leavesDeleted files will often remain on the disk until something else wants that space. Database entries within an application behave differently. Some linger in free pages and may be carved back out. Others vanish immediately. We determine which happened rather than assume.
Why a screenshot proves so littleThere is no underlying device to examine beneath a screenshot. There is no record below either. There is nothing to hash. Faking one takes only a minute, and the opponent will point that out. The machine is the actual evidence.
One date settles nothingPlace a timestamp beside everything else the machine holds (event logs, the recently opened files list, backups, sync records) and it will either hold up or fall apart. Making that comparison is the job.

What Part 35 requires of an expert.

Not on this list? Call us →
Which provisionWhat it requiresHow that is met here
CPR 35.3 — where the duty liesExperts are present to assist the court, and under the rule their duty to the court supersedes any obligation they have towards whoever gave the instructions or paid the billIt heads the report, and every conclusion in the report derives from that
CPR 35.4 — the court's permission is neededThe application sets out the field, the issues at hand and an estimated costA written scope with one fixed figure reaches you in time to go into the application
PD35 3.2 and 3.3Nine requirements of content, the range of opinion if applicable, and a statement of truth in the wording the direction lays downAll nine answered, the examiner named among them
35.7 — joint expertsThe court has authority to order both parties' evidence to come from one expertJoint instructions are accepted, and each side receives the same report
CPR 35.6 — questionsOne round of written questions, inside 28 days, to clarifyAnswered in writing, and those answers then become part of the report
Sending it to us: once you have your quote, our intake lab in Bristol takes tracked, insured post, and we pay to send it back to you. If you'd like to talk packing through with an engineer before you post it, give us a call. There's more detail on our contact page.

Each stage, in turn.

Every job written up →
01

A confidential call first, then a written price Free

Call us and tell us as much or as little as you like. The call costs nothing. It needs to establish what the matter is: what happened, which devices and accounts are involved, and what question the evidence has to answer. That defines the scope. One written figure follows from it, and you get that before anything is opened.

Kept in confidenceA single written figureThe question to be answered
02

Copy it before opening it

Nothing gets opened until a full duplicate exists. Not ceremony. Browsing folders moves the very dates a case may turn on, and leaves the opponent asking: who decided what was worth looking at? Here nothing is filtered.

A copy is made firstNothing read before it
03

The copy is worked

The original goes into storage. And stays there. Work happens inside the duplicate: the documents in issue, file system data regarding each of them, deleted material still capable of being carved out, and whatever the machine logged about drives, accounts and syncing. Where two dates conflict, we state which and why.

Documents, and messagesDeleted material recovered
04

Then the writing

It is prepared for the court rather than for you. Qualifications; the material upon which the report rests; the substance of our instructions; who actually carried out the work; the range of opinion, where such exists; and the statement of truth required by PD35. Accreditation is addressed on page one.

Built to CPR Part 35 and PD35A statement of truth signed
05

Every exhibit, hash and log

Anything the other side can't check is something to argue over. So we put together a bundle that can be checked: exhibit references, the images each finding was read from, every handover with its date, hash values, and the notes made during the examination. Their own examiner can repeat the work and reach the same result.

Findings, and the exhibits behind themHashes kept, each move recordedAnyone can retrace it

What the work keeps showing

  • Authority is the difficult part of family work: a PC used by you and your partner both; a PC purchased by one partner but used by both; a company laptop being held by a director. Three different questions.
  • No established authority, no job, and that is not a formality. Unauthorised access falls under the Computer Misuse Act 1990 in the criminal law, and a lab falls under that law as well.
  • Low-cost providers overstep themselves here: a created date presented as proven fact, and no mention of how it was arrived at. Nothing on a disk moves as easily as a date (a copy resets one, a restore resets another), and a clock may simply have been wrong. Ours are qualified.
  • Phones are not taken here: but computers, drives, cards and the backups sitting on them are. If the case turns on the phone itself, say so early and you'll be told to instruct elsewhere.

What solicitors usually want to know: CPR 35.10 requires the report to contain the substance of all material instructions it was written on (spoken or written down), and nothing in those is privileged. Documents behind those instructions won't be disclosed, nor will there be cross-examination on them, unless a court is satisfied that what the report states about them is wrong or has gaps. Useful to know while drafting the instruction letter. Then PD35 3.3 sets the statement of truth in fixed wording, with a warning that making a false one, without an honest belief in its truth, is a contempt of court.

A job out of the casebook.

PL · PLY-2026-0863FILED ✓

The file predated the machine it was made on

A Tavistock partnership dissolved over its accounts. One side produced a document they claimed dated from before the split. The document was created on a computer purchased after the split, and the document's own internal record matched what the hard drive showed. We reported the date, how we determined it, and simply stated that no part of the hard drive established who typed the document. The claim settled shortly thereafter.

Finalised with no hearingTimed sequence both parties agreeing

Before you seal the box.

Get these done

  • Establish who can authorise it
  • Do not continue to run the machine: each hour of running shifts dates you may need
  • Clearly identify in your instruction what is actually in dispute
  • Determine as early as possible whether the court would prefer a single joint expert

What to avoid

  • Handing us a device you have no authority over
  • Going through it yourself for a look
  • Sending screenshots rather than the machine they came off
  • Tidying the drive before anyone images it

The questions callers ask most.

Does the Regulator's Code cover this?

No. Criminal proceedings in England and Wales are what the Forensic Science Regulator's statutory Code pertains to, and ISO/IEC 17025 is the standard it applies. A boundary claim, a financial remedy application, a disagreement among directors: none of these are criminal proceedings. In any case, no accreditation is held here, and page one of every report says so.

Can you look at my partner's laptop?

Only when someone with the right to authorise it has done so. Unauthorised entry into a computer is a crime (section 1 of the Computer Misuse Act 1990), and this bench is subject to the same provision as you. A machine you share, one bought jointly by the two of you, and one plainly theirs give three different answers. Seek advice from your solicitor first.

So what does a created date prove?

That the file was placed on that volume at that moment. It does not show when the words were written or who wrote them. A copy resets it; somebody can manually wind clocks back. Modified and accessed can change for reasons unrelated to anyone's intent. A date means little without the agreement of all other data on the machine.

Can deleted messages be got back?

The answer depends upon where they resided. Computers and storage media are what this bench handles, not handsets. When a desktop email client, a web browser profile or a backup of a mobile phone exists on the machine we hold, deleted records may linger in the database's free pages until something reuses them. Once that space is overwritten, they are gone.

Pages people open after this.

The forensic work → Expert witness reports → Files sent to the bin → Evidence and reports →

Before positions harden, get the facts imaged.

In family or civil matters the device is frequently the one thing both parties accept, so image it cleanly before anyone leans on it. Begin here. The first look is free, and what you tell us goes no further.

0800 6890668

Get a price Sending it in to us