Taking instructions now — the first conversation is freeExhibits posted in from anywhere in the UK, or handed in at ten drop-off pointsQuicker still, give us a ring:0800 6890668
FDRForensic Data Recovery 0800 6890668 Price my job
FDR / Casebook

Examinations closed · written up after

The casebook. Closed examinations, described as they ran, including what each could not prove.

Nothing is published until the client has approved it, and every identifying detail is removed. The entries below are illustrative examples written to show the shape an entry takes, marked as such, and they will be replaced by genuine closed examinations as they are approved. Each links to the service it illustrates.

Rather talk it through? An engineer answers the bench line
0800 6890668

Most recent at the top.

Sample reports →
UK · FDR-2026-0401CASE CLOSED ✓

A company laptop examined on a managing director's authority, after a director left to set up in competition

Imaged behind a write blocker on the employer's written authority. The standard report set out two removable drives first connected in the final four days, client and pricing folders opened from them, a personal cloud client installed and used to upload about 1.8 GB, and 412 deletions on the last afternoon, 58 files recovered. It stated that the artefacts did not establish who was at the keyboard.

Standard report the company could act on8 working days
Illustrative example — replace with a genuine case
UK · FDR-2026-0415CASE CLOSED ✓

A party to a divorce, through her solicitor, recovering deleted financial records from her own laptop for her Form E

Her own device, with her declaration of ownership. The report recovered 79 of 86 deleted financial documents intact with their metadata, 212 relevant emails including 23 deleted ones, and four earlier versions of the household budget from shadow copies. No other device was examined.

Her own records recovered for disclosure6 working days
Illustrative example — replace with a genuine case
UK · FDR-2026-0432CASE CLOSED ✓

An office PC examined on a board resolution, after a director left and company records went missing

Both drives imaged on the board's authority. The report set out 6,318 deletions across three company folders the morning after the solicitor's demand letter, a cleaning tool installed and run with overwriting enabled that same morning, and two mail rules forwarding company mail created two days earlier. 1,944 files were recovered intact.

Deletion timed against the demand letter2 disks quoted as extra
Illustrative example — replace with a genuine case
UK · FDR-2026-0447CASE CLOSED ✓

A liquid-damaged laptop examined for a policyholder, with the insurer's claim reference, for lost business records

The condition was photographed on receipt; the drive's corroded connector was cleaned and the intervention recorded; 99.98 per cent of sectors were imaged. The report set out 612 GB of recovered data, the business records substantially intact to the date of the incident, and 118 files unrecoverable.

Condition, recovery and data, on the record9 working days
Illustrative example — replace with a genuine case
UK · FDR-2026-0452CASE CLOSED ✓

A shop's DVR drive, sent the same afternoon as a break-in, to recover the night's footage before the loop overwrote it

The owner stopped the recorder within hours. The drive was imaged and its file system interpreted; four hours of footage from the night were recovered with their timestamps, and the recorder's clock was found to run six minutes fast, which the report recorded for the insurer and the police.

4 hours of footage recoveredClock checked: six minutes fast
Illustrative example — replace with a genuine case
UK · FDR-2026-0458CASE CLOSED ✓

An executor, with the grant of probate, needing to know which banks and policies a late father had kept on his desktop

On the executor's authority, the drive was imaged and the financial records catalogued: statements from five institutions, two insurance policies and a pension letter, three of the documents recovered after deletion. No online account was signed into, and personal correspondence was left aside.

5 institutions identified for the estate7 working days
Illustrative example — replace with a genuine case
UK · FDR-2026-0461CASE CLOSED ✓

An employer's HR investigation into alleged misuse of a work laptop, scoped to one allegation and a three-week period

The examination was confined to web activity and installed software in the period, as the scope required, with personal material filtered out. The report set out what the device recorded, and also recorded that a second allegation fell outside the agreed scope and was not examined.

Scoped to the allegation and period5 working days
Illustrative example — replace with a genuine case
UK · FDR-2026-0466CASE CLOSED ✓

A woman preserving threatening emails received on her own laptop, alongside a police report, after some had been deleted

On her own device and account data, the mail file was preserved from a write-blocked image; 31 messages were set out with their full headers and dates, nine of them recovered after deletion. The report explained that headers record a claimed origin, which the police could take further with the provider.

31 messages preserved, 9 recovered4 working days
Illustrative example — replace with a genuine case

Yours need never appear here.

Nothing is published without your approval. The first conversation is free either way.

0800 6890668

Price my jobPacking and posting