THE LABORATORY · BOCA RATON, FL
About Enetsec
Enetsec – Cybercrime & Digital Forensics is a digital forensics laboratory founded in 1999 in Curitiba, Brazil. United States operations opened in 2019, and the lab now works from an office at 3651 FAU Boulevard in Boca Raton. The team has analysed more than 6,000 cases.
The laboratory recovers, preserves and authenticates digital evidence. Attorneys retain us when a case turns on what a phone, a laptop or a server can be shown to contain. Companies retain us after a breach, a theft of data, or an internal matter that needs to be documented properly. Individuals come to us when something is happening to them online and nobody has been able to tell them what.
How the firm started
Wanderson Castilho founded Enetsec in 1999 in Curitiba, Brazil. He is a physicist by training, with a BSc from the Federal University of Paraná, and he built the practice around the idea that a digital finding has to be reproducible before it is worth anything.
At the time, most of what is now standard method did not exist as a discipline. There was no textbook. He later wrote one, Manual do Detetive Virtual, published in 2009.
United States operations opened in 2019. The Boca Raton office serves Palm Beach County, Broward County and the wider South Florida market, and takes matters from clients elsewhere where the work does not require a local licence.
EST. 1999 · CURITIBA US OPERATIONS 2019 BOCA RATON, FL EN / PT
What the caseload looks like
More than 6,000 cases have been analysed since 1999 (Source: Enetsec, 2026). Broadly, they fall into five groups:
-
Litigation support and expert witness work.
Imaging, examination, report writing, deposition and testimony.
-
Digital forensics.
Mobile devices, computers, cloud accounts, deleted data recovery, authentication of files and images.
-
Incident response and cybersecurity.
Ransomware, intrusion, data exfiltration, and the question of what actually left the network.
-
Reputation and content matters.
Defamation, non-consensual content, and the investigative work that identifies a source.
-
Individuals and families.
Compromised accounts, devices someone else has access to, and household safety.
IN OUR EXPERIENCE
In our experience the technical work is the same across all five. What changes is who is asking and what they need at the end. A general counsel needs a report that survives a challenge. A parent needs a plain answer and a next step.
How we work
Every examination follows documented chain-of-custody procedure. Devices are received, logged, imaged and hashed, and every step is recorded with dates, tool versions and the person who performed it. We work from the forensic image, not the original device, so the original stays in the condition it arrived in.
We write the report before anyone asks us to defend it. That is a habit that comes from testifying. When we examine a device, the first question we ask is not “what can we find” but “how will we show how we found it.”
The person behind the lab
The firm is not anonymous. Wanderson Castilho has practised for 21 years, has given 40 depositions in the past four years, holds Cellebrite, AccessData and Certified Computer Examiner certifications, and has published four books (Source: SEAK Expert Witness Directory, 2026).
He is a member of the Association of Certified Fraud Examiners, represented South and Central America to the Michigan Collegiate Cyber Defense Network, and served on the electronic law commission of the São Paulo bar association.
Where to start
Digital forensics services
Covers the core laboratory work: mobile and computer examination, deleted data recovery, and file authentication, with the deliverable described in plain terms.
02Expert witness and litigation support
Covers retained expert work for attorneys, including rebuttal of an opposing examiner’s report.
03Individual and family device help
Covers compromised accounts, household device safety and spyware detection.
Languages and the South Florida market
The laboratory works in English and Portuguese. A meaningful share of the South Florida caseload comes from the Brazilian-American community, and several of our Google reviews are written in Portuguese. If Portuguese is easier for you, say so when you call and the consultation will be in Portuguese.
Frequently Asked Questions
NO. 1 Do you take cases nationwide, or only in Florida?
Both. The office is in Boca Raton and most in-person device intake happens in Palm Beach and Broward counties. We also take matters from outside Florida where the work does not require a local licence, which covers most laboratory examination and expert witness work. Devices can be shipped under documented chain of custody, and cloud and remote acquisitions do not require the device to travel at all. Call (561) 846-9010 and describe the matter.
NO. 2 Do you work cases for regular people, or only for law firms?
Both, and roughly half the caseload is individuals. Attorneys and companies retain us for litigation and incident work. Private clients come to us about compromised accounts, devices someone else may have access to, family safety, and online matters where they need to know what is actually true. The method is identical. The report is written in plain English for private clients and in litigation format when counsel is involved.
NO. 3 Do you handle business and corporate investigations?
Yes. Corporate matters include data theft by a departing employee, internal misconduct, breach and ransomware response, vendor and counterparty due diligence, and identifying who was behind an attack. We work with in-house counsel, outside counsel and executive leadership, and we document to litigation standard from the first hour, because a matter that starts as an internal question often becomes a legal one.
NO. 4 Do you work with legal teams and organizational leadership?
Yes, and usually at the same time. In corporate matters the technical findings go to leadership so they can make decisions, while the evidentiary record goes to counsel so privilege and admissibility are protected. We are used to running both tracks. We will agree the reporting line at the start, including who receives interim updates and who signs off on the final report.
NO. 5 Can an investigation begin remotely?
Yes, in most cases. A first consultation is by phone or video. Cloud accounts, email systems and many mobile artefacts can be acquired remotely under documented chain of custody. Physical devices either come to the Boca Raton office or ship to us with a signed custody form. What we cannot do remotely is examine a device we do not have lawful authorised access to, and we will tell you so in the first call.
Talk to us
If you are not sure which service you need, that is normal and it is what the first call is for. Call (561) 846-9010, email [email protected], or use the contact page and pick the path that matches your matter.
Read the full profile of Wanderson Castilho, the digital forensics services, the expert witness practice, or individual and family device help.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT