Partnership and Shareholder Dispute Forensics

Small companies hold Merseyside together: two-partner practices in the commercial district, agencies and studios in the Baltic Triangle, family haulage yards behind the docks, accountancy and surveying offices out towards Chester. When the people at the top stop speaking, the company's records suffer first. Work stays on systems the business owns. We put a date on each deletion, rebuild what was taken out, and record which login was responsible.

Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.

// the day the records start to matter

The moment to freeze the systems

In a two-director company, or a family firm anywhere in the county, any of these is the point at which images should be taken.

Invoices or entire ledgers look thinner since a director left
Enquiries dried up and then reappeared at a company nobody recognises
A shared mailbox or drive was emptied shortly before the handover
Figures in the ledgers appear to have been edited since the falling-out
Passwords changed overnight and one partner has lost access
Solicitors are engaged and a mediation or hearing date is set

One filing system, two versions of events

A partnership dispute is two accounts of the same company argued out of a single set of records, which happens to suit an examiner rather well. The estate is corporate — servers, office machines, business mailboxes — so it can be worked without anybody's private property coming near the bench, and it contains the things neither side can go back and edit: deletions, alterations, the dates attached to them, and the account under which each was made. We establish that and leave it where it falls, whichever partner benefits.

Rebuilding the books

Accounts removed on the way out of the door are rarely gone for good. Images of the office machines and the server return erased invoices, statements, contracts and correspondence, along with the exports and working files that Sage, Xero and QuickBooks scatter behind them while they run. Each recovered item carries the date of its removal, which makes the shape obvious: ordinary housekeeping, or a run of deletions in the week the argument broke out. If valuation becomes the issue, that set hands straight over to a forensic accountant.

Following the diverted work

Whether trade was steered elsewhere decides most of these disputes, and systems remember steering. An enquiry address forwarding outside the company. A customer database exported whole a fortnight before the split. Quotations reappearing on somebody else's letterhead. Files leaving on a stick, or climbing into private cloud storage. Attach each of those to a date, an account and a piece of hardware and it stops being one partner's complaint and becomes the company's own record.

Neutrality has to be structural

These findings will be read by people who no longer trust one another, so neutrality belongs in the procedure rather than in a covering letter. Originals pass through write-blockers into E01 files verified by SHA-256. Custody is signed at each handover. Passware is used on protected files only where the right to their contents exists. The instruction may come from one partner, from both, or from the court, and in every case CPR 35.3 places the expert's duty with the court. Where the claim is issued in the Business and Property Courts, the material is arranged around the disclosure duties in Practice Direction 57AD, so that claimant and defendant work from one schedule rather than two.

The underlying method is described at the forensic recovery hub. Mailbox and tenancy material has its own page, dating a deletion belongs with deleted-file forensics, and the figures are on the prices page.

// the threads that lead somewhere

What the company's systems still hold

Between the server, the office machines and the mailboxes, the account of what happened is usually already there.

Restored accounts

Erased invoices and statements, with accounting exports and backup copies.

Mailbox history

Messages sent, deleted and redirected, each with the date it occurred.

Diverted trade

Where new enquiries and quotations were being sent instead.

Shared storage

Deletions and moves across shared drives, arranged by date.

Copies leaving

Sticks and personal cloud accounts receiving company material.

The sequence

Edits, deletions and transfers gathered into a single timeline.

// the fee, and who may instruct

The fee, and the basis we require

The price, without hedging

Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.

Who may instruct

Partnership work is confined to the firm's own systems and sits most comfortably under a joint or court instruction. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.

// posting your device in

Sending it in — a padded box and a label

A server estate needs planning, so speak to us on 0800 689 0668 before anything is unplugged. Submissions can be made jointly where both sides prefer it. Equipment goes by tracked, insured post to the Manchester laboratory — nothing is collected — and is signed into custody on arrival.

Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.

  • Wrap it well and use a box or padded envelope stiff enough that nothing rattles. Hold on to the cables, caddies and power supplies; they are no help at this end.
  • Fill in the shipping and booking-in form (PDF) — name, number, and a line or two about what went wrong — and drop it in the box beside the drive.
  • Royal Mail Special Delivery gets it here tracked and insured. Book your own courier instead if you prefer; either way the parcel is signed for.
  • Driving over instead? Reception at the Manchester address below accepts drop-offs, Mon–Fri 9:00am–5:30pm. What there is not, anywhere, is a Liverpool counter or a collection service.
// the address on the parcel

Manchester Data Recovery

Manchester Data Recovery
Peter House, Oxford Street
Manchester, M1 5AN

↓ Print the shipping & booking-in form (PDF)

Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.

Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.

// partnership disputes — from both sides

What the parties ask us

Usually. Imaging returns erased ledgers, invoices and letters, together with the exports and working copies the accounting software left lying around, and each deletion arrives with its date attached. The result is one page showing what went and when.
Where it passed through systems the firm owns, generally yes. A forwarding address, a database exported in one movement, quotes reissued on another letterhead, files pushed into private storage: each leaves a dated trace attributable to an account. That is a pattern on paper, not a grievance.
Whatever the partnership owns — the server, desktops and laptops, shared storage and business mailboxes. A partner's personal telephone or home computer stays out unless the court directs otherwise, and the scope is settled before a disk is touched.
By procedure, and by who instructs. Verified images and a complete custody record remove the tampering argument, and a joint or court instruction fixes the duty to the proceedings rather than to a party. The findings say what the record supports, whoever that assists.

Image the systems before the record thins.

Free diagnosis, a written scope, and joint instructions accepted without fuss.