The breakdown of a business partnership turns the company's data into a battlefield: deleted records, diverted funds and customers, and a cleaned-out shared drive. We recreate how events unfolded using the partnership's own systems, for firms across Staines and Surrey. We offer a free diagnostic and freephone advice.
Confidentiality and quality of evidence. Every case starts with a free diagnostic and a written scope prior to conducting the investigation.
When a business partnership dissolves in Staines, Surrey or further afield, it is time to protect your company's data systems so that nothing else is destroyed.
In the event of falling out amongst the partners or directors of an enterprise, the data held by that company immediately becomes a point of contention. One partner may delete important records; another may divert incoming enquiries or take the entire customer base. It then becomes difficult for the remaining party to determine what the business actually still holds. Since the hardware (computers, servers etc.) belongs to the partnership, we can properly examine company-owned systems and genuinely jointly-owned business assets, and establish on the evidence what was deleted, moved or taken, and when.
Once deleted, invoices, ledgers, spreadsheets, contracts and emails often remain recoverable until they have been overwritten on the hard drive. We create an exact image of the computer or server used by the company, locate records buried in unallocated space, recover exports and backups from accounting software like Sage, Xero and QuickBooks, and build a chronological history of the deletion or alteration of each file. Where the numbers themselves are in dispute, our findings pass cleanly to a forensic accountant to quantify the loss.
Where did the value go? That is typically the biggest area of disagreement during a partnership dispute. Email and file activity often show enquiries being redirected, customer databases and pricing being exported, and company documents being copied to either a USB device or a personal cloud storage account before the parties separate. By linking that activity to specific dates, devices and accounts, we can identify when a diversion started and what left. That is the difference between an accusation and one you can prove.
All work produced will withstand the scrutiny of the opposing party: write-blocked, hash-verified images, documentation of the chain of custody, and a forensic report with two sections, findings and a technical appendix. Because both parties will likely mistrust each other, we are happy to be instructed jointly or under a court direction, so neither party could claim the evidence was selectively presented. If there are password-protected files or encrypted volumes that prevent access, we use Passware Kit Forensic to open them where it is lawful to do so.
Our partnership investigations are part of our forensic data recovery service; see the main hub for the complete evidence-grade process, from imaging through to reporting.
On the partnership's own systems, these are the strands we bring together into a single, defensible view.
Invoices, ledgers and accounting package exports, carved back from the disk.
Sent, received and deleted email, from the mailbox and the drive.
Files and messages that show where enquiries and money went.
Who deleted or moved what files across the company systems, and when.
Company data taken to a competitor, a side company or a personal account.
The order of events across the weeks around the split.
We investigate company-owned systems and genuinely jointly-owned business assets (equipment that belongs to the partnership), not a partner's private personal device, which we will never access covertly. Because emotions run high when partners are in disagreement, we are happy to receive instructions jointly from both parties or through a court direction, so the outcome cannot be dismissed as one partner's version of events.
For partnership cases we work from the disks rather than the machine or chassis: remove the disks from the PCs or servers in question and label each one by its bay position, instead of sending us the entire machine or chassis. Please call 0800 689 0668 first to get a quote, and we will decide together what needs to be submitted and how it should be preserved. As soon as it arrives at our secure Guildford location, we document the chain of custody. Both parties may instruct us jointly.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV/DVR or server? You will need to remove the internal hard drive or SSD and send us just the drive, as we are unable to remove the drive for you. We also cannot recover storage soldered onto a motherboard, such as in Apple Silicon Macs and some thin laptops. Only drives that can be removed from a machine and sent to us can be recovered. If you are unsure whether your device has a removable drive, please call us before sending. RAID, server and SAN drives need to be removed from their enclosure and labelled by bay. For a NAS, send the disks themselves if they are removable, otherwise the entire NAS device. An external single drive should come to us whole, along with its cable and power supply.
↓ Print the booking-in & shipping form (PDF)
Please mark the package for the attention of Guildford Data Recovery, and we will call you as soon as we have diagnosed your media.
Unsure as to how to proceed with sending the item in for recovery? Then simply call 0800 689 0668, or complete the free online diagnostic prior to dispatching the item to obtain your price quotation.
Secure the company data before any more is lost, with a free diagnostic or freephone advice and evidence-grade handling at every step.