A woman in divorce proceedings believed her husband had not been honest about money, and wanted to know what he had been doing on the family computer. We took the case — on the jointly-owned PC, instructed through her solicitor, to a scope agreed in writing. We also turned down two of the things she asked for, and that refusal made her case stronger, not weaker.
A woman in the middle of divorce proceedings believed her husband had not been straight about money — that there were accounts and assets he had not put on the table. What she wanted to know was what he had been doing on the family computer.
This is the request we are asked most often in a personal context, and the one where the answer depends entirely on the details. The device here was the desktop PC in the family home — jointly owned, jointly used, and one she had every right to access. And crucially, the instruction did not come from her directly: it came through her solicitor, as part of the financial disclosure in the proceedings, with the scope agreed in writing before anything began.
That distinction is not a formality. It is the difference between evidence that can be used and evidence that blows up in your hands.
She also asked us to look at his mobile phone, and to get into his personal email account. We said no to both, and it is worth being clear why.
His personal phone is his device, not a shared one. His private email and cloud accounts are his, and accessing them without authority is a criminal offence — not a grey area, an offence. No suspicion, however well-founded, changes that. It would also have been catastrophic for her case: material obtained that way tends to be inadmissible, and family courts take a famously dim view of a spouse who goes rifling through the other’s private accounts. People have lost the moral high ground, and a great deal of money, doing exactly this.
So the examination stayed where it was lawful: the jointly-owned computer, the agreed scope, nothing else.
The PC was logged into a documented chain of custody, write-blocked so nothing on it could be altered, and a full hash-verified forensic image was taken — a cryptographic fingerprint proving the copy is identical to the original and that nothing changed while it was with us. Analysis ran on a working copy; the original drive was sealed.
The scope her solicitor set was financial, and narrow. Within it: documents and spreadsheets, including deleted-file recovery from unallocated space, where deleted files linger long after the recycle bin has been emptied; any password-protected financial files opened with Passware Kit Forensic, strictly within the scope her solicitor had set; browser artefacts showing which financial services had been used and when; and account-related material saved, downloaded or opened on the shared machine.
The findings went to the instructing solicitor — not to her — so they could enter the proceedings properly through disclosure rather than as material she had gone and gathered herself. The report set out, in plain English with a technical appendix behind it: what was recovered, where it was found, what the timestamps showed, and what could and could not be inferred from each item.
It also recorded the ambiguities, because they matter. A file on a shared computer does not automatically tell you who put it there. A browser session on a machine two people use is not proof of who was sitting at it. We said so explicitly, and her solicitor was better served by knowing where the evidence was strong and where it was not than by a report that overreached and fell apart under scrutiny.
If you are heading into proceedings and you think the truth is sitting on a computer at home, the rules are simple. Do not snoop through your partner’s phone or log into their accounts — you may commit an offence and you will likely poison your own case. Do not keep using the machine, because free space is where deleted material survives and every day of use overwrites more of it.
Do speak to your solicitor and have the examination instructed through them, on a device you own or jointly own, to a scope agreed in advance. We are not lawyers and we do not advise on your case — your solicitor sets the scope and decides what can be used. What we do is preserve the evidence properly and report what it actually shows. forensic recovery handled any other way is worth very little, and can cost you a great deal.