Univik QBooks Recovery for Forensics on Windows
At a Glance
Key Features
Audit Trail Lists From the File
The audit trail tables stored in a company file open as the lists Audit trail and Audit trail lines. Search them, print them or export them like any other list.
At a Glance
QuickBooks Forensics in Numbers Audit trail lists, flagged rows and what one sample file gave
2
Audit Trail Lists
Audit trail and Audit trail lines open as lists.
1,891
Possibly Deleted Rows
Found in one 2024 sample file with the option on.
0
Writes to the File
The source file is only read.
310
Tables Readable
The 2024 sample held 310. Other versions hold 271 and up.
3
Export Formats
Excel, CSV and HTML carry the findings out.
Key Features
What QuickBooks Forensics Software Shows Six views for examining a company file read-only
Possibly Deleted Records, Marked Unverified
A tick box adds rows found in older pages and emptied row slots. They show in their own group and carry the word unverified.
A Source File That Is Only Read
The source file is opened for reading only. A restored backup goes to a new folder and never replaces an existing file.
Warning Marks on Damaged Rows
A row taken from a page that failed its check is flagged in the list, in the printout and in every export. Damage tests found no wrong row without a mark.
A Recovery Log of Every Run
The log lists the file size, the tables read, the encrypted fields found and the possibly deleted rows recovered, with the time the run took.
Find Anywhere Across Every Table
Find anywhere (Ctrl+Shift+F) can search every database table as well as every list, so a name or an amount turns up wherever the file stores it.
The Problem First
The Problem FirstWhy the QuickBooks Audit Trail Is Hard to Reach
An examiner often holds only a copy of the company file. Two facts make the audit trail hard to use from there.
Trap 1: The Report Lives Inside QuickBooks
Intuit places the Audit Trail report under Reports > Accountant & Taxes. A file that will not open in QuickBooks cannot produce it. Neither can a PC with no QuickBooks.
Trap 2: Condense Data Can Remove Entries
The Use the Condense Data utility article says condensing cannot be undone. Its option to remove audit trail info takes edited, voided and deleted transactions out of the audit trail report.
The Way Out: Read the File Itself
Univik QBooks Recovery opens the stored audit trail tables and the rows left in older pages without QuickBooks. Our view: this is a lead finder. Use it to decide where to look and prove each finding with records you can verify.
Possibly Deleted Records
How QuickBooks Forensics Software Treats Deleted Rows Where the rows come from and how far to trust them
| Source in the file | What a row may be | How to use it |
|---|---|---|
| Stale pages | An older version of an entry that was later changed | Compare it with the live record |
| Deleted-row slots | An entry that was deleted | Look for support in a backup or paper |
| Pages that failed a check | A row read from damaged data | Look for the warning mark before you rely on it |
None of these rows can be verified by the software. Each one is a lead.
Step by Step
How to Examine a QuickBooks File Read-Only
Copy the file, load it with the option on and export what you find.
1
Work on a Copy
Copy the file to a local folder and keep the original as you received it. Write the date and source of the copy in your own log.
2
Read the File With the Deleted-Records Option On
Press Select QuickBooks File… and tick Also look for possibly deleted records and older versions (unverified) before the file loads. The Recovery log lists what was read and what was found.
3
Review the Lists and Export Your Findings
Open the audit trail lists and the Possibly Deleted Records group from the left panel. Press Export Data and tick the possibly deleted box so those rows reach the Excel, CSV or HTML file.
Download Univik QBooks Recovery
Needs Windows 11 or 10 · examine a copy · QuickBooks not required
Our Test
What QuickBooks Forensics Software Found in a Sample File One 2024 company file with the option on
Univik test
Univik read a 2024 sample company file of 53 MB with the possibly deleted option on. The run took 3.3 seconds and recovered 145,103 records in 310 tables. It also listed 1,891 deleted or earlier record versions and found 19 encrypted fields.
In Univik's damage tests every row that came out wrong carried a flag. That covers the data the software reads. It says nothing about who changed a record or when.
The catch: every one of the 1,891 rows is unverified. We cannot tell a deleted entry from an older version of a live entry. The software also did not read any condensed company file in these tests.
Who It Is For
Who It Is ForWho Uses QuickBooks Forensic Accounting Software?
Forensic Accountants With a Client File
A dispute needs the books as they stood. Read the file, list the possibly deleted rows and take the leads to the records that can confirm them.
CPAs Reviewing a New Engagement
Before you trust a prior bookkeeper's file, scan it for rows that were removed. Export the findings to Excel and raise questions with the client.
IT Teams Helping an Internal Review
Management asks IT to look at a company file after a departure. Read a copy read-only and hand over an HTML or Excel file.
Limits
LimitsLimits of QuickBooks Forensics Software Four things Univik software does not do
Who
No User or Time Claims
The software does not state who changed or deleted a record or when.
Unverified
Possibly Deleted Means Unverified
A row may be a deleted entry or an older version. Confirm it elsewhere.
Compare
No Backup Comparison
Two files cannot be compared in one view. Read each file on its own.
Condensed
Condensed Files Were Not Tested
Nothing here says what remains after Condense Data. Try an older backup too.
Side by Side
Side by SideAudit Trail Report or QuickBooks Forensics Software? Two ways to look at what changed in a file
Start with the Audit Trail report when QuickBooks is installed and the file opens in it. Use Univik QBooks Recovery for any file that will not open.
| What you need | Audit Trail report in QuickBooks | Univik QBooks RecoveryTRIAL |
|---|---|---|
| Reads a file that will not open in QuickBooks | No | Yes |
| Needs QuickBooks installed | Yes | No |
| After Condense Data | May no longer list removed entries | Not tested |
| Cost | Included in QuickBooks | Free trial, then from $99 |
The Intuit column follows its Condense Data article.
Checklist
System Requirements What to prepare before an examination
Windows 11 or 10
A PC with Windows 11 or 10 and .NET Framework 4.8 is enough. Windows 11 includes the framework.
No QuickBooks Needed
QuickBooks and an Intuit licence are not needed to read the file.
A Working Copy
Examine a copy so the original stays as received. Write down where the copy came from.
A Folder for Exports
Choose a folder that you control for the Excel, CSV or HTML files.
| Product | Univik QBooks Recovery release 6.11 |
| Input | Company files (.qbw) and backups (.qbb) |
| Shows | Audit trail lists, possibly deleted rows and the Recovery log |
| Output | Excel workbooks, CSV files and HTML reports on request |
| Trial limit | Exports hold 25 items per list. Screens are not limited |
| Licence prices | Personal at $99 for 2 PCs, Business at $299 for 10 PCs and Enterprise at $599 for 50 PCs |
Questions
QuickBooks Forensics Questions
No. Univik QBooks Recovery does not name the person who deleted anything. It lists rows that may be deleted entries and marks them unverified. Treat each one as a lead and look for support in backups, bank records or paper.
The report itself is built inside QuickBooks under Reports > Accountant & Taxes > Audit Trail. Univik QBooks Recovery opens the audit trail tables stored in the file as lists called Audit trail and Audit trail lines, with no QuickBooks needed.
Intuit says Condense Data cannot be undone and its option to remove audit trail info takes edited, voided and deleted transactions out of the audit trail report. Univik has not tested a condensed file, so it cannot say what the audit trail lists still hold. Check an older backup too.
No. The software reads one file at a time and has no comparison view. To compare two backups, read each one on its own and set the exports side by side.
No. They come from stale pages and deleted-row slots of the database. A row may be a deleted entry or an older version of a live entry. The software cannot tell which. That is why every row carries the word unverified.
No. The source file is opened read-only and every export goes to a folder you choose. Even so, examine a copy and keep the original as it came.
Yes. Data that can still be read comes out. Each row taken from a damaged page is flagged in the list and in every export. In Univik's damage tests every wrong row carried a flag.
Neither for lists, transactions, reports and the audit trail lists. Only tax IDs, account and card numbers and SSNs wait for the QuickBooks Admin password, A Skip button leaves them out.
Univik makes no such claim. Univik QBooks Recovery is a reading tool and its possibly deleted rows are unverified. Ask counsel how your findings must be documented.
Excel workbook, CSV files and HTML report. Tick the possibly deleted box in the export window so those rows come along. Print puts any list on paper.
Related Software
More QuickBooks Tools From Univik
Checked by Nick Rogers Founder of Univik
Facts Reviewed 11 November 2026
Nick Rogers, founder of Univik, signed off every claim above on 11 November 2026. Counts come from Univik's own run on a sample file and carry no claim about any real company. Intuit statements link to the article they come from.
Updated on 11 November 2026
Univik Since 2013No Edits to the FileUnverified Rows MarkedRefund Within 30 Days
Intuit Inc. owns the QuickBooks trademark and has no tie to Univik.