FDR / Services / Divorce and family finance, by lawful disclosure

Divorce · family finance · Form E · lawful disclosure · Imerman · your own device

Divorce and family finance, by lawful disclosure. We help with the finances the lawful way: your own records, or a court-ordered examination. Never a spouse's private device.

Financial disclosure is at the heart of a divorce, and a computer can hold the records that complete it: deleted statements, spreadsheets, the emails that show what accounts existed. We help with this, but only by the lawful route, and that distinction matters more here than anywhere. We examine your own device to recover your own deleted records for your Form E and disclosure, and we examine a jointly owned business computer only on a solicitor's instruction under a court order or an agreed disclosure protocol. What we will not do, ever, is examine your spouse's or former partner's private device or accounts without their authority. The Court of Appeal in Imerman v Tchenguiz held that taking and copying a spouse's confidential documents is a breach of confidence and is not to be condoned; the lawful route to the other side's records is disclosure through the court. The standard report recovers what is on the device you are entitled to examine, factually, for your solicitor and the proceedings.

Owner-only, authority requiredFree first conversationStandard report £800 + VATWe say what it cannot prove

Rather talk it through? An engineer answers the bench line
0800 6890668

Before anything else: stop using the device, and do not let anyone have a look at it. Every time a computer is switched on and used, the very artefacts an examination relies on, the timeline, the recently-opened lists, the deleted-file space, are overwritten a little more. Do not reinstall, do not run recovery software, do not let IT open it to check, and keep it powered off. Preserve it as it is, record who has held it, and send it with the authority documents we ask for. If proceedings are contemplated, the duty to preserve evidence has already begun.

Who instructs us, and the authority we need.

There are two lawful situations, and we work only within them. The first is your own device: you own it, you used it, and you want your own deleted financial records recovered for your disclosure. We ask for your proof of ownership and a declaration that the device is yours. The second is a jointly owned business computer, examined on your solicitor's instruction under a court order or an agreed disclosure protocol; we ask for the order or the protocol and the solicitor's instruction.

The line we do not cross is your spouse's or former partner's private device or accounts. The Court of Appeal in Imerman v Tchenguiz [2010] EWCA Civ 908 held that a spouse who, without authority, examines, copies or retains the other's confidential documents commits a breach of confidence, and that such self-help is not to be condoned. The lawful route to the other side's records is disclosure through the court, Form E, questionnaires, and specific disclosure or search orders where justified, and your solicitor will guide that.

Within the lawful situations, the report recovers what is on the device you are entitled to examine: deleted documents, their metadata, email archives and earlier versions, factually, for your solicitor to use in the proceedings.

What the standard report typically contains.

Deleted financial records recoveredFrom your own device, the report recovers deleted financial documents, statements, spreadsheets, letters, with a recoverability measure, and the record of what was deleted and when, from the Recycle Bin and the journal.

Document metadataIt sets out each document's created, last-modified and, where recorded, last-printed dates and its author field, as held inside the file, which can matter to when a record was prepared or altered.

Email archivesIt recovers emails relating to named accounts, providers or assets from the local mail data file, including deleted messages recovered from the file, with sender, recipient, date and subject.

Earlier versions from shadow copiesWhere Windows kept Volume Shadow Copies, it recovers earlier versions of key documents, a budget, a schedule of assets, so that what a document said at an earlier date can be shown.

The questions it can answer, and what it cannot.

Describe your situation →

What you want to know	What the examination shows	What it cannot prove on its own
What financial records were on your own device	Recovered documents, metadata, emails, versions	That no other copies exist elsewhere
When a record was created, modified or printed	The document's internal metadata	That the metadata was not itself altered; it is reported as found
What emails about an account or asset existed	Recovered mail, including deleted messages	The truth of what the emails assert
What a document said at an earlier date	Earlier versions from shadow copies	Why it was changed

From the exhibit arriving to the report.

Work we have closed →

The first conversation, and the authority check Free

Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.

FreeOwner-only; authority established firstThe honest answer about what is possible

Imaging behind a write blocker, and the hashes

When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.

Bit-for-bit, behind a write blockerMD5 and SHA-256, verifiedThe original never altered

The examination, on the image

The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.

Scoped to your questionsConfirmed in a second toolPrivate material filtered out

The report

The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.

Factual, tool-generated, self-containedChain-of-custody and case-log reports5–10 working days

Before you send the exhibit

Examine only what you are entitled to: your own device, or a jointly owned business computer under a court order. Not your spouse's private device.
Talk to your family solicitor first; the lawful route to the other side's records is disclosure, and your solicitor will guide it.
Preserve your own device and stop using it if you need deleted records recovered, before the space is reused.

Imerman v Tchenguiz [2010]: copying a spouse's confidential documents is a breach of confidence; the lawful route to the other side's records is disclosure through the court.

One examination, in outline.

UK · FDR-2026-0415JOB LOGGED ✓

A laptop examined for a party to a divorce, through her solicitor, the device being her own, to recover deleted financial records for her Form E

On the instructing party's own device, with her declaration of ownership, the laptop was imaged behind a write blocker. The report recovered 79 of 86 in-scope deleted financial documents intact, 41 of them deleted via the Recycle Bin on a single evening, with their metadata; 212 relevant emails including 23 deleted ones; and four earlier versions of the household budget from shadow copies. It was provided to her solicitor for disclosure. No other device was examined.

Her own records recovered for disclosureIllustrative synthetic example

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Stop using the device and keep it powered off
Preserve it as it is; record who has held it
Gather your proof of ownership or authority
Tell us the questions you need answered

What sets us back

Letting IT or anyone open it to have a look
Reinstalling, wiping or running recovery software
Carrying on using the device
Assuming artefacts prove who was at the keyboard

We examine devices only for the people and organisations with lawful authority over them. Before any work begins we ask for proof that the device is yours, or documented authority to have it examined: proof of ownership, a director's or HR letter for a company device with the lawful basis, a solicitor's instruction, a court order, or an executor's grant. It is a condition of the work, not a formality, and it is what keeps the examination on the right side of the Computer Misuse Act 1990. We will not access another adult's device or accounts without their consent or a court order, we will not install monitoring software or bypass anyone's security, and we do not undertake covert surveillance. A device with no proof of authority is returned unexamined.

Questions answered before you instruct.

Can you recover deleted financial documents for my divorce?

Yes, from your own device, or from a jointly owned business computer on your solicitor's instruction under a court order or agreed protocol. We recover deleted documents, their metadata, emails and earlier versions, factually, for your disclosure and your solicitor.

Can you examine my husband's or wife's laptop or phone?

No. We do not examine a spouse's or former partner's private device or accounts without their authority or a court order. The Court of Appeal in Imerman v Tchenguiz held that copying a spouse's confidential documents is a breach of confidence. The lawful route to the other side's records is disclosure through the court, which your solicitor will guide.

My spouse deleted records from our joint business computer. Can that be examined?

On your solicitor's instruction under a court order or an agreed disclosure protocol, yes, because it is a jointly owned business device being examined through the proper channel. We ask for the order or the protocol and the instruction, and then recover and report what is there.

Will the report be accepted in the family court?

The standard report is a factual account of what was recovered from a device you were entitled to examine, suitable for your solicitor and for disclosure. Where the court directs expert evidence on a device, typically as a single joint expert, an expert report is quoted separately.

What does it cost?

The standard report for the one device is £800 + VAT. An expert report, if the court directs one, is quoted separately. The first conversation is free.

Related services and evidence.

Deleted files and the Recycle Bin →Document metadata →Volume Shadow Copies and earlier versions →Email archives →Harassment on your own device →

The device holds the answer; preserve it first.

The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.

0800 6890668

Price my job Packing and posting

Services, by situation

What we examine

What the evidence can show

What it costs, and what follows