• A review of all computer equipment available, usually by logging in remotely.
• Identification of:
  • users and last log in times
  • computer software used; Microsoft, accounting, encryption software,
  • online/cloud software used
  • emails and deleted email
  • missing drives or other computers
  • data types found, present or deleted
• Analysis of deleted files, deleted profiles or any other “missing” information
• Records of downloads of software and other data files
• Potential sources of data relevant to the enquiry
• Identification of other devices such as handheld mobiles and notepads
• Review of information to create a timeline of events

• We are often able to recover previously deleted data; restoration of deleted files
• Reconstruction of Microsoft Outlook for each user with all emails and calendar data
• Recovery of other files such as call center voice files

• Review of accounting data where the accounts data file is available (possibly restored if previously deleted)
• Re-creation of deleted or unavailable accounts data from records, computer data, deleted but restored computer data files
• Reconciling accounting data file to past signed accounts and any other available information
• Checking data to prime records where available
• Establishing a timeline of events, including a solvency review at agreed intervals
• Reporting on:
  • financial information
  • missing information, including bank and other third party statements, transaction documentation and financial transaction instructions
  • altered data and relevant users
  • further data entry and reconciliation work required to produce conclusive financial information

Our final report may be after data entry and reconciliation work has been carried out (See below)

• Establish missing accounts data and enter into a duplicate copy of the data file to retain integrity of original data. This includes mass data entry by our team of experienced data entry staff
• Review of the accounts data file to establish the accuracy of data already entered and the consistency with data entered by our team.
• Reconcile accounts balances with any third party evidence available

Having extracted/restored as much deleted or otherwise lost data, reviewed the accounts data, entered and reconciled additional data and reported we can then examine the information relevant to the scope of work as previously agreed. It is possible that the forensic IT and accounting work carried out by our teams may widen the scope of work.

There normally follows a period of liaising with the Insolvency practitioner, lawyers and any relevant third parties before producing a final report which may be instrumental in the next legal steps.

One of our network associates, working closely with us, provides asset tracing and recovery services. Tracing assets such as cars and small boats is normally straightforward but where assets have been misappropriated or transferred to unrelated parties or overseas ownership, further investigation is required. For larger and mobile assets, such as valuable yachts and private aircraft, tracing is still possible, as well as asset recovery, even in hostile environments.