Family and civil litigation · digital evidence, Reading
None of this is criminal work, and the difference matters more than it sounds. Who altered a document, and on what date. A director shut out of the company records. Contested finances in a divorce; a probate fight; a partnership row in which the deleted file is the one everybody leans on; a camera next door that ends up the only witness there is. What the Forensic Science Regulator's statutory Code governs is criminal proceedings, England and Wales, and it reaches no further — so none of this falls inside it, and no accreditation is called for on any of it. CPR Part 35 governs the report, and Part 35 is what it is built to. One fixed figure in writing first, from £800 + VAT.
Talk it through in confidence
0800 6890668
| The clause | What it calls for | How we answer it |
|---|---|---|
| CPR 35.3 — the expert's first duty | An expert is there to assist the court, and the rule ranks that duty above anything owed to whoever instructs or pays | It heads the report; every conclusion below has to answer to it |
| CPR 35.4 — the court's permission | The application must give the field of expertise, the issues to be covered, and a cost estimate | You get a written scope and a fixed figure early enough to put into that application |
| PD35, paras 3.2 and 3.3 | Nine requirements of content, any range of opinion there may be, and a statement of truth worded as the direction lays down | All nine answered — including naming whoever carried out the examination |
| CPR 35.7 — a single joint expert | The court may direct that the evidence comes from one expert instructed by both parties | Joint instructions accepted, with the same report to each side |
| CPR 35.6 — written questions | One round of written questions, within 28 days, for clarification | Answered in writing, and those answers then form part of the report |
The scoping call costs nothing, and nothing chargeable starts until you have a price in writing. What the call fixes is the ground it covers: the events, the machines and accounts in play, and precisely what the evidence must establish. Forensic instructions start at £800 + VAT, and the scope decides where yours lands.
Nothing is opened before the full copy exists, and that is not ceremony. Open a folder and you move the dates the case may turn on; you also hand the other side an easy question — who chose which folders were worth looking at? Here, nothing is filtered.
The original goes into access-controlled storage and does not come out again. The image carries the work: documents in issue, what the file system records about each of them, deleted material that can still be carved back, and whatever the machine logged about attached drives, about accounts, about syncing. Where dates contradict one another, the report says which it prefers, and why.
PD35 has the report addressed to the court and not to you, so that is how it reads. Qualifications. The material it rests on. Our instructions in substance. Who did the work. Any range of opinion. And the statement of truth in the words PD35 lays down. Accreditation is handled on page one.
Hand the other side a finding they cannot test and you have handed them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came off, dated handovers, the hashes, and the working notes typed as the job ran. The examiner on the other side can run the whole thing again and reach the same answer.
What solicitors ask about most: under CPR 35.10 a report must give the substance of all material instructions, spoken or written, and privilege does not cover them. Disclosure of the underlying documents will not be ordered, and cross-examination about them will not be allowed, unless the court is satisfied that there are reasonable grounds to consider the statement of instructions inaccurate or incomplete. Worth knowing while the letter is still in draft. PD35 3.3 then fixes the wording of the statement of truth, warning that making one without honest belief in it is a contempt of court.
Accounts were the issue in a Thatcham partnership dispute, and one side produced a document said to date from before the split. It had been created on a computer bought afterwards, and the document's own internal record matched what the disk said. We gave the date, the route we had taken to it, and the plain point that nothing on the drive showed who had typed the thing. The claim settled shortly after.
No. The Regulator's statutory Code bites on criminal proceedings in England and Wales, and ISO/IEC 17025 is what it demands there. None of these is a criminal proceeding: a financial remedy application, a boundary claim, a falling-out between directors. Accreditation is not held here at all, whichever sort of matter it is, and the opening page of each report says exactly that.
Only where the person entitled to authorise it has said yes. Opening up a computer without authority is a criminal offence — section 1, Computer Misuse Act 1990 — and it binds this bench exactly as it binds you. Three situations, three answers: a machine you share, a machine the two of you bought, a machine plainly theirs. Ask your solicitor before you ask us.
It proves one thing: the file arrived on that volume then. Not when the words were typed, and not whose they were. Copy it and the value resets. Somebody can wind a clock back by hand. Modified moves, accessed moves, and often for reasons no one intended. A date is worth something only when the rest of the machine backs it.
That turns on where they were held. Computers and storage media come here; handsets do not. Where the machine holds a browser profile, mail in a desktop client, or a backup pulled off a phone, deleted entries can linger inside the database's free pages until that space is claimed again. Once it is overwritten, they have gone.
Disputes run for months and disks do not wait for them. Get the machine imaged now, keep the original sealed, and the examination can follow whatever timetable the court sets. There is no charge for the first look, the figure is fixed in writing, and nothing you tell us goes anywhere else.