Open, and work is coming in · weekdays, 9am–5:30pm Faster by phone: 0800 6890668
PDR Plymouth Data Recovery 0800 6890668 Get a price
PDR / Legal and insurance work / Family and civil matters

Family and civil litigation · digital evidence, Plymouth

Family and civil disputes, Plymouth. A timestamp is a claim, not a fact until it is tested.

A quarrel over who altered a document, and when. A director shut out of the company's own records. Contested finances in a divorce, or a probate fight. A partnership row where the file everyone leans on has been deleted. A neighbour's camera that ends up the only witness anyone has. None of this is criminal work, so the statutory Code written by the Forensic Science Regulator has no purchase on it. What governs it is CPR Part 35, and that is what the report is built to.

The court's needs come before yours Authority confirmed Copied before reading

A quiet word first?
0800 6890668

What a timestamp really shows.

Created, modified and accessedCreated marks when the file landed on that volume, and copying it starts the clock over. Modified shifts when contents change. Accessed can move because something backed the file up, or a scanner opened it. All three take a value set by hand.
What deleting leavesA deleted file will often stay on the disk until something else wants the space. Records inside an application's own database behave differently: some linger in free pages and can be carved back out, some vanish immediately. Which of those occurred is something we answer rather than assume.
Why a screenshot proves so littleThere is nothing underneath a screenshot to examine — no device behind it, no record below, nothing to hash. Faking one takes a minute and the other side will point that out. The machine itself is the evidence.
One date settles nothingPut a timestamp beside everything else the machine holds — event logs, the list of recently opened files, backups, sync records — and it will either hold up or fall apart. Making that comparison is the job.

What Part 35 requires of an expert.

Not on this list? Call us →
Which provisionWhat it requiresHow that is met here
CPR 35.3 — where the duty liesAn expert is present to assist the court, and the rule puts that duty above any obligation owed to whoever gave the instructions or settles the billIt heads the report, and every conclusion in it follows from that
CPR 35.4 — the court's permission is neededThe application sets out the field, the issues and an estimate of costA written scope and one fixed figure reach you in time to go into that application
PD35 3.2 and 3.3Nine requirements of content, the range of opinion if there is a range, and a statement of truth in the wording the direction lays downAll nine answered, the examiner named among them
35.7 — joint expertsA court may order the evidence to come from one expert for both partiesJoint instructions are accepted, and each side gets the same report
CPR 35.6 — questionsOne round of written questions, inside 28 days, to clarifyAnswered in writing, and those answers then count as part of the report
Sending it in: the intake lab takes tracked, insured post, and we pay for the journey home. Ring us before the box goes if you want the packing talked through with an engineer. There is more on the contact page.

Each stage, in turn.

Every job written up →
01

A call in confidence first, then the price in writing Free

Ring us and say as much or as little as you like; the call itself is not charged for. What it has to settle is the shape of the matter — what took place, which machines and accounts it reaches, and the question the evidence must answer. That is the scope. One written figure follows from it, and you have that before anything is opened.

Kept in confidenceA single written figureThe question to be answered
02

Copy it before opening it

Nothing gets opened until a full copy exists. That is not ceremony. Browsing folders moves the very dates a case may turn on, and it leaves the other side an obvious question to ask: who decided what was worth a look? Nothing is filtered here.

A copy is made firstNothing read before it
03

The copy is worked

The original goes into storage and stays there. Work happens inside the copy: the documents in issue, what the file system holds about each of them, deleted material still capable of being carved out, and whatever the machine logged about drives, accounts and syncing. Where two dates conflict, we say which and why.

Documents, and messagesDeleted material recovered
04

Then the writing

It is written for the court rather than for you. Qualifications; the material it rests on; the substance of our instructions; who carried out the work; the range of opinion, where a range exists; and the statement of truth PD35 calls for. Accreditation is dealt with on page one.

Built to CPR Part 35 and PD35A statement of truth signed
05

Every exhibit, hash and log

Anything the other side cannot check is worth arguing about. So the bundle is built to be checked: the exhibit references, the images each finding was read from, every handover with a date on it, the hashes, and the notes written while the work was going on. Their own examiner can repeat the work and land in the same place.

Findings, and the exhibits behind themHashes kept, each move recordedAnyone can retrace it

What the work keeps showing

  • Authority is the awkward part of family work — a home computer both of you use; a machine bought by one and used by both; a company laptop being held by a director. Three separate questions.
  • No established authority, no job — and that is not a formality. Unauthorised access sits in the criminal law under the Computer Misuse Act 1990, and a lab is inside that law too.
  • Cheap providers overreach here — a created date offered as settled fact, and not a word about how it was reached. Nothing on a disk moves as easily as a date: copying resets one, restoring resets another, and a clock may simply have been wrong. Ours come qualified.
  • Handsets are not taken here — computers, drives, cards and the backups sitting on them, yes. Where the case turns on the phone itself, say so early and you will be told to instruct elsewhere.

What solicitors ask about most: CPR 35.10 requires the report to set out the substance of every material instruction it was written on, spoken or written down — and none of that is privileged. The documents behind those instructions will not be disclosed, and there will be no cross-examination on them, unless a court is satisfied that what the report states about them is wrong or has gaps. Worth knowing while the instruction letter is still being drafted. PD35 3.3 then sets the statement of truth in fixed wording, warning that making one falsely, without honest belief, is a contempt of court.

A job out of the casebook.

PL · PLY-2026-0863LOGGED ✓

The file predated the machine it was made on

A Tavistock partnership came apart over its accounts. One side produced a document it said dated from before the split. That file had been created on a computer bought after it, and the document's own internal record agreed with what the disk showed. We reported the date, the route we took to it, and the plain fact that no part of the drive established who had typed it. The claim settled soon after.

Closed with no hearingTimeline both parties agreeing

Before you seal the box.

Get these done

  • Establish who can authorise it
  • Stop using the machine — each hour of running shifts dates you may need
  • Set out in the instruction what is really in issue
  • Ask early if the court would prefer a single joint expert

What to avoid

  • Handing us a device you have no authority over
  • Going through it yourself for a look
  • Sending screenshots rather than the machine they came off
  • Tidying the drive before anyone images it

The questions callers ask most.

Does the Regulator's Code cover this?

No. Criminal proceedings in England and Wales are what the Forensic Science Regulator's statutory Code reaches, and ISO/IEC 17025 is the standard it sets there. A boundary claim, a financial remedy application, a row between directors — not one of those is a criminal proceeding. No accreditation is held here in any case, and page one of every report says so.

Can you look at my partner's laptop?

Only if someone with the right to authorise it has done so. Getting into a computer without permission is a criminal offence — the Computer Misuse Act 1990, section 1 — and it binds this bench just as firmly as it binds you. A machine you share, one the two of you bought, and one plainly theirs give three different answers. Put it to your solicitor first.

So what does a created date prove?

That the file arrived on that volume at that instant. Not that the words were written then, and not who wrote them. A copy resets it. Somebody can wind the clock back by hand. Modified and accessed move for reasons nobody meant. A date is worth something only where everything else on the machine agrees with it.

Can deleted messages be got back?

That turns on where they lived. Computers and storage media are what this bench handles, not handsets. Where the machine we hold carries a desktop mail client, a browser profile or a backup taken off a phone, deleted entries can hang on in the database's free pages until something reuses them. Once that space is overwritten, they have gone.

Before positions harden, get the facts imaged.

In a family or civil matter the device is often the one thing both sides will accept, so it is worth imaging cleanly before anyone leans on it. Start it here. The first look is free, and what you tell us goes no further.

0800 6890668