FDR / Services / Business partner and shareholder disputes

Shareholder dispute · mass deletion · wiping tools · forwarding rules · company device

Business partner and shareholder disputes. When a partnership breaks down, the office computer records what was deleted, when, and how hard.

When partners or shareholders fall out, company records have a way of disappearing, and the company's own computers record the disappearance in detail. The Windows change journal logs a mass-deletion event as a dense burst of delete records at a particular time; Prefetch and the installed-programs list record a cleaning or wiping tool being downloaded, installed and run, and its settings often show a secure-overwrite option; the Security log records which account was logged on; and the mail profile records forwarding and auto-delete rules created before the dispute surfaced. The telling detail is usually timing: a mass deletion the morning after a solicitor's demand letter tells its own story. The standard forensic report sets all of this out factually, with a timeline built against the key dates. It is examined on the authority of the company, by a board resolution or a majority of directors, or under a court order, and it is honest that the account used is recorded while the person at the keyboard is not.

Owner-only, authority requiredFree first conversationStandard report £800 + VATWe say what it cannot prove

Rather talk it through? An engineer answers the bench line
0800 6890668

Before anything else: stop using the device, and do not let anyone have a look at it. Every time a computer is switched on and used, the very artefacts an examination relies on, the timeline, the recently-opened lists, the deleted-file space, are overwritten a little more. Do not reinstall, do not run recovery software, do not let IT open it to check, and keep it powered off. Preserve it as it is, record who has held it, and send it with the authority documents we ask for. If proceedings are contemplated, the duty to preserve evidence has already begun.

Who instructs us, and the authority we need.

The device is company property, and the authority to examine it comes from the company: a board resolution, or the agreement of a majority of the directors, or a court order where the directors are in dispute. We ask for that authority in writing, together with the company's solicitor's confirmation of the dispute and, importantly, the dates that matter, such as the date of a demand letter or a resignation, because timing is often the heart of the matter.

Where the former partner's personal material is present (a personal email account configured in the mail client, personal files), we identify it and leave it alone; we do not sign in to personal accounts. The examination is of the company's records on the company's device.

If directors are in dispute about the examination itself, the company's solicitor should confirm who is authorised to instruct it, or a court order should be obtained. We would rather wait for clear authority than act on a contested instruction.

What the standard report typically contains.

Mass deletion, timedThe USN journal records deletions as timestamped events. The report shows any burst of deletions, how many files, which folders, and at what time, and compares that against the dates the instructing party gives, such as a demand letter.

Wiping and cleaning toolsPrefetch records a cleaning or wiping tool being run, with the first and last run times and a run count; the installed-programs list and Application log record its installation; its settings file often shows a secure-overwrite option. The report sets this out, and shows how much of the deleted data could, and could not, be recovered.

Which account was usedThe Security log records interactive logons and logoffs by account. The report shows which account was logged on during the deletion or wiping, while stating that the account used is not the same as the person at the keyboard.

Mail forwarding and auto-delete rulesThe mail profile records rules created to forward incoming mail to an external address or to divert and delete mail from particular senders, with the times they were created. The report lists them; what was forwarded afterwards is not held on the device.

The questions it can answer, and what it cannot.

Describe your situation →

What you want to know	What the examination shows	What it cannot prove on its own
Whether company records were deleted or wiped	The USN journal, Prefetch and recovered files	Who did it, beyond the account that was logged on
When the deletion happened, against the dispute	Timestamps compared with the dates you provide	The motive; artefacts record actions, not intentions
Whether a wiping tool was used	Prefetch run times, installation records, tool settings	That every wiped file is unrecoverable until recovery is attempted
Whether mail was being forwarded out	Forwarding and auto-delete rules in the mail profile	What was forwarded, which is not stored on the device

From the exhibit arriving to the report.

Work we have closed →

The first conversation, and the authority check Free

Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.

FreeOwner-only; authority established firstThe honest answer about what is possible

Imaging behind a write blocker, and the hashes

When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.

Bit-for-bit, behind a write blockerMD5 and SHA-256, verifiedThe original never altered

The examination, on the image

The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.

Scoped to your questionsConfirmed in a second toolPrivate material filtered out

The report

The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.

Factual, tool-generated, self-containedChain-of-custody and case-log reports5–10 working days

Before you send the exhibit

Preserve the PC as it is and do not let anyone tidy it up; a well-meant clean-up destroys the evidence.
Give us the dates that matter: a demand letter, a resignation, a board meeting. Timing is often the whole point.
Sort out authority first where directors disagree; the company's solicitor should confirm who can instruct the examination, or obtain a court order.

The Windows change journal records deletions as timestamped events, so a mass deletion can be placed to the hour and compared against the date of a demand letter.

One examination, in outline.

UK · FDR-2026-0432JOB LOGGED ✓

An office PC examined for Oakfield Design Ltd on a board resolution, after a director left and company records were found missing

On the board's authority, both drives were imaged behind a write blocker. The report set out 6,318 deletions across the company's project, accounts and contract folders on the morning after the solicitor's demand letter, a cleaning tool downloaded, installed and run with a three-pass overwrite enabled that same morning, the former director's account logged on throughout, and two mail rules created two days earlier forwarding and diverting company mail. Of the deleted files, 1,944 were recovered intact. The report stated that the account used was recorded, not the person at the keyboard.

The deletion timed against the demand letterIllustrative synthetic example

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Stop using the device and keep it powered off
Preserve it as it is; record who has held it
Gather your proof of ownership or authority
Tell us the questions you need answered

What sets us back

Letting IT or anyone open it to have a look
Reinstalling, wiping or running recovery software
Carrying on using the device
Assuming artefacts prove who was at the keyboard

We examine devices only for the people and organisations with lawful authority over them. Before any work begins we ask for proof that the device is yours, or documented authority to have it examined: proof of ownership, a director's or HR letter for a company device with the lawful basis, a solicitor's instruction, a court order, or an executor's grant. It is a condition of the work, not a formality, and it is what keeps the examination on the right side of the Computer Misuse Act 1990. We will not access another adult's device or accounts without their consent or a court order, we will not install monitoring software or bypass anyone's security, and we do not undertake covert surveillance. A device with no proof of authority is returned unexamined.

Questions answered before you instruct.

Can you show our former partner deleted the company's files?

We can show, factually, what the computer records: a mass-deletion event with its time and the folders affected, whether a wiping tool was run, which account was logged on, and what was recovered. Where that deletion lines up with a demand letter or a resignation, the report sets out the timing. We cannot prove who was physically at the keyboard.

They used a cleaning tool, so is it all gone?

Not necessarily. A cleaning tool's secure-overwrite option does destroy some files beyond recovery, but the report shows that the tool was run and when, which is itself significant, and recovers whatever remains. The combination of the deletion event, the tool's run times and the partial recovery is often what matters.

Who can authorise examination of a company computer in a dispute?

The company, by a board resolution or a majority of the directors, or a court order. Where the directors are in dispute, the company's solicitor should confirm who is authorised to instruct, or an order should be obtained. We act only on clear authority.

Is this a standard report or an expert report?

A shareholder dispute is often served by the standard report for an initial, factual account you and your solicitor can act on. Where it proceeds to an unfair-prejudice petition or an injunction and the court needs opinion evidence, an expert report is quoted. We advise at the first conversation.

What does it cost?

The standard report is £800 + VAT for a single disk, with a two-disk office PC quoted as extra. An expert report, if the matter needs one, is quoted separately and runs into the thousands.

Related services and evidence.

Departing employee data theft →Mass deletion and the USN journal →Program execution and wiping tools →Email archives and mailbox rules →A timeline of user activity →

The device holds the answer; preserve it first.

The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.

0800 6890668

Price my job Packing and posting

Services, by situation

What we examine

What the evidence can show

What it costs, and what follows