Sample report: recovering financial records from your own laptop. The lawful route: the instructing party's own device, for her disclosure.

The questions were: (a) recover deleted documents from the Finance folder covering 2022 to 2025; (b) establish when the recovered documents were created, last modified and, where recorded, printed; (c) recover emails relating to a named savings account and a named pension provider from the local Outlook data file; (d) recover any earlier versions of the household budget spreadsheet.

On scope. This is the instructing party's own device. We do not examine a spouse's or former partner's device or accounts without that person's authority or a court order; in Tchenguiz v Imerman [2010] EWCA Civ 908 the Court of Appeal held that taking the other spouse's confidential documents is a breach of confidence, and the lawful route to them is disclosure through the court. No third-party account was accessed.

The laptop was bought by the instructing party, receipt supplied, and used by her alone; she signed a declaration of ownership. The examination is of her own data, on her instructions, for the purpose of legal proceedings.

OSForensics for Deleted Files Search, file metadata, the email viewer, the Volume Shadow Copy module, Recycle Bin $I review and the case report; Autopsy to confirm recovered-file counts. Times are UTC.

Deleted Files Search over the user profile returned 1,204 deleted items; filtered to the Finance path and to Office and PDF types, 86 were in scope. Seventy-nine were recovered at quality 95 to 100 and seven partially. Recycle Bin $I records show that 41 of them were deleted through the Recycle Bin on 3 February 2026 between 21:10 and 21:24 UTC; the full list with original paths and sizes is at Appendix C.

The metadata below is as recorded inside each file by the application that saved it. It can be edited, and it is reported as found.

The local Outlook data file holds 212 messages matching the two names in scope between March 2022 and January 2026, including 14 in Deleted Items and 9 recovered from the file's unallocated space. Sender, recipient, date and subject are listed at Appendix D; message bodies are supplied on encrypted media.

Four Volume Shadow Copies existed, dated 12 October 2025, 9 November 2025, 21 December 2025 and 18 January 2026. Each holds a version of the household budget spreadsheet; the four versions were exported and hashed. The differences between them were not analysed, which is a matter for the instructing party or an accountant.

Recovery shows what existed on this device and when it was saved, modified or printed according to the file. It does not show whether other copies exist elsewhere, or whether a document is accurate. Metadata can be edited. Seven files were only partly recovered and may be incomplete.

From the instructing party's own laptop: 79 of 86 in-scope deleted documents were recovered intact, 41 of them deleted through the Recycle Bin on the evening of 3 February 2026; 212 relevant emails were recovered, 23 of them deleted; and four earlier versions of the household budget were recovered from shadow copies.

Exhibits: E1 laptop, returned; E1/IMG1 image, retained encrypted; E1/REC recovered files and messages on encrypted media. Appendices: A acquisition log; B tool versions; C recovered documents with hashes; D message list; E glossary.