When someone dies, their life is on a laptop nobody can log into, a phone nobody knows the code for, and accounts that answer to no one. We recover what the family is entitled to — carefully, on the record, and within the law.
Advice and intervention are delivered personally, in Spanish, English, Catalan and Italian. We are not a lawyer’s office and not a detective agency — we work alongside your notary and solicitor.
Their computer holds the photographs, the correspondence, the accounts of a business, the manuscript they were working on. Nobody has the password.
The handset still works, but the passcode died with them, and every attempt makes the wait longer.
Invoices, suppliers, payroll, a domain about to expire, a server only they had the keys to. The company cannot wait for probate.
Email, cloud storage, social profiles, subscriptions billing a closed card. Each provider has a different process and most families never find it.
The backup disk was the plan. The backup disk no longer spins, or the NAS lost a second drive during a rebuild.
Assets, accounts and heirs in more than one jurisdiction, and no two countries treating digital inheritance the same way.
Not the phone, not the laptop, not the tablet — even if a shop tells you it is the only way to make it usable. A reset destroys the data and, on Android and iPhone, can add an activation lock that makes the device useless to everyone.
Every wrong attempt lengthens the lockout, and a device can be configured to erase itself after ten. If you have attempts left, they are worth more to a specialist than to a guess.
A hard disk that clicks, grinds or spins up and down is failing mechanically. Every further power-on risks the heads scoring the platters and turning a recoverable disk into an unrecoverable one.
A NAS that has failed a rebuild once is under maximum stress. Clicking rebuild again is the most common way a recoverable array becomes a total loss.
Cloud storage, photo backups and email are often the only surviving copy. A cancelled subscription can start a deletion clock you cannot stop, and a closed account is usually gone for good.
Consumer “unlock” and “undelete” tools write to the very disk you are trying to read, overwriting the data they claim to recover. Some are simply malware.
Counter-intuitive, but real: saved browser passwords and some encryption keys exist only in a running session. Shutting a machine down can permanently close routes that were open.
Old passwords, a partner’s guesses, the PIN they used for their card, the name of a pet. A great many successful recoveries come from a family member remembering something, not from a laboratory.
None of this requires you to hire anyone. If you take nothing further from this page, take these eight points — and feel free to send them to whoever in the family is currently holding the devices.
Digital Legacy · Legacy Contact
If your relative named a Legacy Contact, that person submits the access key issued at nomination, together with the death certificate. Note two things families are rarely told: Apple cannot reissue or replace a lost access key, and access lasts three years, after which the data and the account are permanently deleted — so it is a deadline, not an archive. If no Legacy Contact was named, or the access key is lost, Apple’s route requires a court order naming you as the rightful inheritor. Activation Lock on an inherited iPhone or Mac is a separate process again. Apple will not unlock a device or disclose a passcode.
Inactive Account Manager
Configured in advance, it notifies up to ten trusted contacts after a set period of inactivity and can release specified data to them. If it was never set up, Google has a separate request process for a deceased user’s account — outcomes vary and full data release is not guaranteed.
Memorialisation · Legacy Contact
A Facebook or Instagram account can be memorialised or removed at the family’s request. Legacy Contact, however, is a Facebook feature only: a nominated person can manage limited functions — a pinned post, the profile photo, friend requests. Instagram has no equivalent at all; memorialisation is the only option and it confers no login and no management role. On neither platform can anyone read private messages, and Meta does not release them.
Court order (personal accounts)
The old Next of Kin programme has been discontinued. For a personal Microsoft account, Microsoft now requires a formally served subpoena or court order for account content, and an unclaimed account lapses on a schedule: Outlook.com and OneDrive content can be deleted after around a year of inactivity, and the account itself closes after two, with a sixty-day window to reopen it. A business Microsoft 365 tenant is a different matter entirely — there Microsoft runs a tenant-ownership and admin recovery process against proof of domain control and company documents, and no court order is needed. This matters more than it sounds: since Windows 11 24H2, a laptop set up with a Microsoft account is often silently encrypted, with the BitLocker recovery key escrowed only to that account. Setting up with a local account avoids this, and on Home edition it also depends on the manufacturer enabling the flag, so a self-built desktop usually is not affected. But an OEM laptop bought since late 2024 plus a Microsoft account nobody can reach is becoming the most common dead end we see.
No inheritance mechanism
There is no next-of-kin process and no way to obtain message history from Meta. Anything recoverable comes from a device backup — an iCloud or Google Drive chat backup, or a local backup on the handset — not from the service.
Emergency access · recovery kit
1Password’s Emergency Kit and Bitwarden’s emergency access work well if they were set up beforehand. If they were not, a zero-knowledge vault has no back door — not for us, not for the vendor. Worth searching the house for a printed recovery kit.
Bereavement process · seed phrase
Custodial exchanges — Coinbase, Binance, Kraken — have formal bereavement processes for transferring holdings to heirs, though what each one requires, which legal entity handles it and how long it takes vary considerably. Self-custody depends entirely on the seed phrase existing somewhere. If it does not, nothing recovers it.
Each provider applies its own rules on top of whatever the law of your country says. Working out which route is actually open in your case, and in what order to attempt them, is most of what the consultation is for.
Where something is not recoverable from the device, there is often a second route — the provider’s own process, a synced copy elsewhere, an old backup, a machine the person used before. Finding that route is most of the work. One caveat on the account route specifically: it is the slowest and least predictable item on this page, no provider guarantees a full release, and none of it is within our control.
You tell us what happened, what devices and accounts exist, and what you are actually trying to reach. We tell you what looks feasible and what does not.
We establish who is legally entitled to instruct us, and identify the documents needed. Where the succession is not yet settled, we tell you what has to happen first.
Devices arrive under a written contract, or we come to them. Everything is logged on receipt, and the chain of custody is documented from that moment.
We take a write-blocked forensic image before anything else, so the original is never worked on. Then we report what is present, what is recoverable, and at what cost.
Scoped to what the mandate covers. Third-party and living-user content is segregated and not delivered, and we record that we did so.
Data is delivered on encrypted media or a secure transfer, with a written report. Working copies are securely destroyed on an agreed schedule.
€180
60 minutes, online. Credited in full against any engagement booked within 30 days.
A straight answer about your situation, from someone who has done this before.
On request
Fixed price, agreed in advance. Prepaid, under written contract.
Send us the devices, or we collect them. We find out what is actually there before anyone commits to a recovery.
On request
Quoted from the assessment, never before it.
The work itself — from straightforward imaging to cleanroom repair, array reconstruction and provider account processes.
On request
Day and week rates for Spain, Europe and the rest of the world. Travel, accommodation and transport are invoiced separately, at cost, with receipts.
Some situations cannot be shipped — a family home to work through, an office that has to keep running, an estate with too much in it to box up.
On request
One-off engagement or annual retainer.
For advisors managing an estate, and for families who would rather not go through this unprepared a second time.
Prices are quoted per case because the cases genuinely differ — a single laptop and a twenty-year archive across four countries are not the same job. Everything is agreed in writing before work starts, and we tell you when we think the work is not worth commissioning.
The GDPR does not apply to the personal data of deceased persons. Recital 27 leaves the question to each Member State, and the Member States answered differently — so there is no single European rule, and a cross-border estate has to be handled jurisdiction by jurisdiction.
In Spain, the right comes from Ley Orgánica 3/2018 (LOPDGDD). Article 3 lets heirs — and, notably, people linked to the deceased by family or de facto ties, even where they do not inherit — request access to the deceased’s personal data. Article 96, the derecho al testamento digital, extends this to online service providers, and adds the albacea testamentario and anyone the deceased expressly designated. Where the deceased expressly prohibited access, we respect it — but that prohibition cannot defeat the heirs’ rights over content forming part of the caudal relicto.
In Catalonia, Llei 10/2017 made this the first jurisdiction in Spain to legislate digital wills — and then lost half of it. Articles 411-10 and 421-24 of the Codi civil de Catalunya survive only in part: in STC 7/2019 the Constitutional Court struck down article 411-10.3(b) and article 421-24.1 — the provisions that allowed digital wills, and their executor, to be constituted by entry in the electronic register — together with the register itself and the mediation regime, on the ground that creating a public register of private law is reserved to the State. What remains is article 411-10.3(a): the executor of digital wills can still be designated, but only in a testament, codicil or memòria testamentària. The practical consequence is sharp, and it is the reason we push families towards a will — in Catalonia today, if it is not in a testamentary instrument, there is no mechanism at all. And there is no register to consult, in Catalonia or anywhere in Spain, whatever anyone tells you.
In Italy, Article 2-terdecies of the Codice Privacy allows the deceased’s rights to be exercised by anyone with a personal interest, by a mandatary, or for family reasons deserving protection — and a prohibition can never prejudice patrimonial rights arising from the death. In 2021 the Tribunale di Milano ordered Apple to assist parents recovering their late son’s iCloud data on precisely that basis.
Across most of the EU, Regulation 650/2012 gives you the European Certificate of Succession: proof of your status in 25 Member States without legalisation or apostille, with a statutory presumption of accuracy. Denmark and Ireland are not bound by the Regulation, so an estate touching either of them still needs the local route. Obtaining a certificate early is often the fastest way to unlock a cross-border digital estate. It does not bind providers outside the EU.
Heirs succeed to the deceased’s rights. They do not succeed to the privacy of the living people who wrote to them — that right belongs to each participant in a communication and was never the deceased’s to pass on. So we scope every extraction to the estate, we segregate and do not deliver third-party-only and living-user content, and we work on stored data only. We will not keep an account alive to capture new incoming messages.
We do not offer lock or password bypass as a service. We do not investigate living people — in Spain that is reserved to licensed detectives privados, and if your case needs it we will say so and refer you. Where a crime is suspected, where heirs are in conflict, or where a device may be evidence, the correct route is judicial, and we will tell you that rather than take the work.
Nexo Apex is a software company in El Vendrell, Catalonia. We build and run our own products, and we do recovery and forensic work — which, by its nature, we cannot put names or case studies to on a website.
We work with families, and with the advisors handling an estate, on recovering a relative’s digital life: the devices, the archives, the accounts, and the businesses that could not simply stop. The consultation, the forensic work and the dealings with providers, notaries and counsel are handled personally by our founder . Where a case needs a cleanroom or specialist media hardware, that step goes to a partner laboratory under our own chain of custody — and we tell you so in the quotation rather than after.
Write as much or as little as you can manage. You do not need to have the paperwork in order, and you do not need to know the technical details — that is our part.
Everything you write reaches us directly and is treated in confidence. There is no automated follow-up sequence and nobody will chase you.