Probate · deceased's computer · executor · grant of probate · financial records · estate
Probate: a deceased person's computer. An executor often needs what is on a computer to settle an estate; the grant of probate is the authority to examine it.
Settling an estate often means finding records that exist only on the deceased's computer: which banks and providers they used, what investments and policies they held, unpaid accounts, and the documents an executor needs to administer the estate and account to the beneficiaries. We examine a deceased person's computer for the estate, on the authority of the executor or administrator, and produce a catalogue of the financial records, accounts and documents the estate needs, recovering deleted documents and email archives where they help. The authority is the grant of probate or letters of administration (or the will and the death certificate while the grant is pending), which is what entitles the executor to deal with the deceased's property, including the computer. We examine for the estate's purposes, and we do not sign in to the deceased's online accounts or reproduce third parties' private data beyond what the estate requires. It is careful, respectful work at a difficult time.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is the executor or administrator of the estate, and the authority is the grant of probate or letters of administration, which entitles the executor to deal with the deceased's property, the computer included. Where the grant is still pending, we can begin on the will and the death certificate with the executor's declaration, and confirm on the grant. We ask for that documentation.
We examine for the estate's purposes: the records needed to identify assets and liabilities, to administer the estate and to account to the beneficiaries. We do not sign in to the deceased's online accounts, which raises separate questions for the providers, and we do not reproduce third parties' private data, correspondence with people who are not part of the estate, beyond what the estate genuinely requires.
It is work that calls for care and discretion, and we treat it that way. The report gives the executor a clear catalogue to work from, recovered documents where they help, and a factual account of what the computer held.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| What financial records the computer held | The catalogued documents, with dates | The current state of accounts held elsewhere |
| Which institutions the deceased used | Documents and records on the device | Balances or holdings, which the institutions hold |
| What relevant documents were deleted | Recovered deleted documents and versions | Why they were deleted |
| What the estate's email correspondence shows | Recovered relevant email | The truth of what the correspondence asserts |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Do not sign in to the deceased's online accounts; that raises separate questions for the providers. The computer's own records are what we examine.
- Have the grant of probate ready, or the will and death certificate while it is pending, with your authority as executor.
- Keep the computer as it is and do not let it be reset or wiped before it is examined.
The grant of probate entitles an executor to deal with the deceased's property, the computer included; it is the authority for a probate examination.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can you get into my late relative's computer to find their accounts?
We can examine the computer on your authority as executor and catalogue the financial records and the institutions they dealt with, recovering deleted documents where they help. We work from the computer's own records; we do not sign in to online accounts, which is a matter for the providers with the grant of probate.
What authority do you need?
The grant of probate or letters of administration, which entitles you as executor to deal with the deceased's property. Where the grant is pending, we can begin on the will and the death certificate with your declaration and confirm on the grant.
Will you read all of their personal emails and files?
No. We examine what the estate needs, the financial records, accounts and relevant documents, and we leave purely personal correspondence and third parties' private data aside beyond what the estate genuinely requires. It is careful, respectful work.
The computer needs a password we do not have. Can you still examine it?
Often, yes, because we examine the drive from a forensic image rather than by logging in, and a Windows login password does not encrypt the files. Where the drive itself is encrypted, we would discuss the recovery key or password with you; our sister service covers encrypted drives.
What does it cost?
The standard report cataloguing the records the estate needs is £800 + VAT for the one computer. The first conversation is free.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.