Open, and the first look is free · 9am–5:30pm, Mon to Fri Quicker to ring: 0800 6890668
RDR Reading Data Recovery 0800 6890668 Get it quoted
RDR / Evidence and expert work / The family and civil side

Family and civil litigation · digital evidence, Reading

Family and civil disputes, Reading. A date on a file is a claim; it is not a fact until it is tested.

None of this is criminal work, and the distinction matters more than it appears. Who modified a document, and when. A director excluded from the company's records. Disputed finances in divorce proceedings; a dispute over the administration of a deceased person's estate; a partnership disagreement in which the deleted file is the one everybody leans on; a neighbour's camera that ends up the only witness there is. The statutory Code of the Forensic Science Regulator governs criminal proceedings in England and Wales only and does not extend beyond those boundaries, so none of the above falls within its scope, and none of it requires accreditation. CPR Part 35 governs the report, and Part 35 is exactly how it is constructed. There is one fixed figure in writing first, from £800 + VAT.

The court comes before the client Authority established first Imaged before anything is opened

Talk it through in confidence
0800 6890668

What a date on a file actually proves.

The created, modified and accessed datesThe created time is when the file arrived on the volume; if you copy it somewhere else, that clock starts again. The modified time changes when the content changes. The accessed time can change because someone ran a backup or a scanner looked at the file. Each of these three can also be set by hand.
What deleting leaves behindDeleted files normally remain in place until the disk needs that space for another use. Entries stored within an application's database do not behave in this way. Some may sit among the unused space (free pages), where carving can still reach them; others are gone the instant they are removed. Ascertaining which of the two occurred is our job, not something to be assumed.
Why a screenshot carries so littleA screenshot has absolutely nothing under it to analyse: no device, no record beneath, nothing to hash. Anyone can create a believable screenshot within minutes, and the other side will certainly make that point. What counts as evidence is the actual machine.
One date on its own settles nothingSet a timestamp against everything else on the machine (event logs, recently opened files, backups, sync records) and it will either stand up or not. Making that comparison is the bulk of the work.

Part 35, line by line, and what we do about it.

Not here? Tell us what it is doing →
The clauseWhat it calls forHow we answer it
CPR 35.3 — the expert's first dutyAn expert exists to assist the court, and the rule places that duty above any obligation to those who instruct or payIt opens the report; each conclusion below has to answer to it
CPR 35.4 — the court's permissionThe application must include the field of expertise, the issues to be covered and an estimate of costsYou are given a written scope and a firm figure in time to put them into your application
PD35, paras 3.2 and 3.3Nine specific requirements of content, any range of opinion on the matters, and a statement of truth worded as the direction sets outAll nine points fully addressed, including identifying who conducted the examination
CPR 35.7 — a single joint expertThe court may direct that the evidence comes from a single expert instructed jointly by both partiesJoint instructions accepted, with one report prepared for both parties
CPR 35.6 — written questionsOne round of written questions for clarification, within 28 daysAnswered in writing, and those answers then form part of the report
Sending it to the lab: get a quote first, by phone or using the form. Send it by tracked, insured post to the Oxford intake lab, or drop it off at the Oxford intake lab (Monday to Friday, 9am to 5:30pm, no appointment needed). The return leg is at our expense. Need help packing? Call us before sealing your box and an engineer will tell you what to pack and what to leave out. All remaining details are on our packing and posting page.

What we do, in order.

How other jobs ended →
01

Say what has happened, in confidence — the figure follows in writing Free

The first scoping call costs nothing. There will be no chargeable work on your case until you have a price in writing. The purpose of this call is to define the scope of the work. Specifically, we identify all relevant events, the accounts and machines involved and, most importantly, what the evidence needs to prove. Forensic instructions begin at £800 + VAT, and the scope decides where yours lands.

The call stays confidentialA fixed price, in writingThe question it has to settle
02

Copied before it is opened

Nothing is opened before a complete copy exists, and this is not ceremony. When you open a folder you risk altering the dates the case may turn on; you also give the other side an easy question: who decided which folders were worth looking at? Here, nothing is filtered.

A full image comes firstNothing opened before it
03

The original sealed, the image worked

The original goes into access-controlled storage, and it never comes out again. The image carries the work: the documents in issue, what the file system records about each of them, deleted material that can still be carved back, and anything the computer logged about attached drives, user accounts or syncing. When the dates conflict, the report states which it prefers and why.

Files and messagesDeleted material carved out
04

Then it is written for the court

Since PD35 has the report addressed to the court (and not to you), that is how it is written. Qualifications. The material it relies upon. Our instructions in substance. Who performed the work. Any range of opinion. And the statement of truth using the wording PD35 lays down. Accreditation is dealt with on page one.

Drafted to CPR Part 35 and PD35Signed statement of truth
05

The bundle, hashes and handover log

Give the other side a finding they cannot check or test, and you are giving them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came from, dated handovers, the hashes, and the working notes typed while the job was running. The examiners on the other side will be able to re-run everything and come to the same answer.

Every finding tied to an exhibitHash values kept, every move loggedRepeatable, step for step

What we tell every instructing party

  • Authority is the hard part of family work: a shared home computer; a computer one of you bought and both of you used; a company laptop still in a director's hands. Three questions, and three different answers.
  • No authority, no job, and this is not paperwork. Unauthorised access is an offence: section 1 of the Computer Misuse Act 1990, which applies to a laboratory just as it does to everyone else.
  • This is where cheap providers overreach: a created date handed over as settled fact, with nothing said about how it was found. Nothing else on a disk changes as readily as a date: copy the file and one value resets, restore it and another does, and the clock may have been off from the start. Ours arrive qualified.
  • Handsets are not taken here: computers, yes; drives and cards, yes; phone backups sitting on a machine, yes. If the case hinges on the handset itself, let us know on the first call so that we can refer you elsewhere.

What solicitors ask about most: under CPR 35.10 the report must include the substance of every material instruction, given orally or in writing, and those instructions are not privileged. The court will not order disclosure of the underlying documents, or permit cross-examination about them, unless it is satisfied that there are reasonable grounds to believe the statement of instructions is inaccurate or incomplete. Worth noting while the letter is still being drafted. PD35 3.3 then sets the wording of the statement of truth, and warns that making one without an honest belief in its truth is a contempt of court.

How one of these actually went.

RG · RDG-2026-2013ON FILE ✓

A document older than the computer it was created on

The accounts in a Thatcham partnership dispute were the issue, and one side produced a document alleged to predate the break-up. That document had been created on a computer purchased after the break-up, and the document's own internal record corresponded with what the hard disk indicated. We reported the date, our route to it, and simply stated that nothing on the drive showed who had typed the document. Shortly afterwards the claim settled.

Wound upbefore any hearingOrder of eventsaccepted by both parties

What helps, and what makes it worse.

First things to do

  • Determine who has lawful authority to approve the examination
  • Stop using the machine: each additional hour of use changes dates you may need
  • Say in the instruction what is genuinely in issue
  • Ask us early whether a single joint expert would suit the court better

What makes it worse

  • Handing over a device you have no authority to have examined
  • Having a look through it yourself first
  • Sending screenshots instead of the machine they came off
  • Cleaning the drive before it is imaged

What people ask before they send it.

Is this covered by the Regulator's Code?

No. The Regulator's statutory Code applies to criminal proceedings in England and Wales, and ISO/IEC 17025 is what it demands there. None of these are criminal proceedings: a financial remedy application, a boundary claim, a dispute between directors. Accreditation is not held here at all, whatever the type of matter, and each report states exactly that on page one.

Will you examine my partner's laptop?

Only where the person entitled to authorise it has done so. Unauthorised access to a computer is a criminal offence (section 1, Computer Misuse Act 1990), and it applies to this bench just as it does to you. There are three scenarios, each with its own answer: a computer you share, a computer the two of you bought, and a computer plainly theirs. Please ask your solicitor before you ask us.

What can a created date really show?

It establishes one thing: that the file arrived on that volume at that time. It does not establish when the words were typed, nor who wrote them. Copy the file and the value resets. Someone can wind a clock back by hand. Modified dates move, accessed dates move, often because of actions nobody intended. A date is valuable only if it is supported by the rest of the machine.

Can deleted messages be recovered?

That depends on where they were stored. Computers and storage devices are taken here; handsets are not. When a machine holds a browser profile, a desktop email client or a backup from a handset, deleted items can remain in the database's free pages until that space is reclaimed. Once it is overwritten, those items are gone.

If this sounds like yours, start here.

How forensic jobs run → What goes in the report → Deleted files, and what is left → Casework for court and claims →

Have the image taken while the answer is still there.

Disputes can drag on for months, but disks don't wait for them. Get the machine imaged immediately and keep the original sealed, and the examination can follow whatever timetable the court sets. There is no cost for the first look, the price will be fixed in writing, and nothing you tell us goes anywhere else.

0800 6890668

Get it quoted Posting it to Oxford