THE EXAMINER · BOCA RATON, FL
Wanderson Castilho
A physicist runs a method twice and expects the same answer. A court expects the same thing of digital evidence.
Wanderson Castilho is a digital forensic examiner in Boca Raton, Florida. He holds a physics degree from the Federal University of Paraná, has practised for 21 years, and has given 40 depositions in the past four years. He is Cellebrite, AccessData and Certified Computer Examiner certified.
He founded Enetsec in 1999 in Curitiba, Brazil, and opened United States operations in 2019. The laboratory now works from an office at 3651 FAU Boulevard in Boca Raton, Florida.
His training is in physics, not in law enforcement. That background shapes how he works. A physicist is taught to state a method, run it again, and get the same answer. Digital evidence is judged by the same standard in a courtroom. A finding that cannot be reproduced is a finding that can be excluded.
Education and certifications
Castilho holds a BSc in Physics from the Federal University of Paraná (UFPR) (Source: SEAK Expert Witness Directory, 2026).
He holds three examiner certifications that courts and opposing counsel routinely ask about:
- Cellebrite certification, covering mobile device acquisition and analysis
- AccessData certification, covering forensic imaging and examination of computer media
- Certified Computer Examiner (CCE), a vendor-neutral examiner credential
He is a member of the Association of Certified Fraud Examiners (ACFE) (Source: The Interamerica Group, 2025), and holds further certifications from the Behavior Analysis Training Institute and the Blockchain Intelligence Group.
BSc PHYSICS · UFPR CELLEBRITE ACCESSDATA CCE ACFE MEMBER BEHAVIOR ANALYSIS TRAINING INSTITUTE BLOCKCHAIN INTELLIGENCE GROUP
Twenty-one years of practice
Castilho has practised digital forensics for 21 years (Source: SEAK Expert Witness Directory, 2026). Enetsec has analysed more than 6,000 cases since 1999 (Source: Enetsec, 2026).
The caseload has two halves and they do not resemble each other. One half is litigation and corporate work: attorneys who need a phone imaged before a deposition, companies that need to know what left the building and when, counsel who need an opposing examiner’s report reviewed. The other half is individuals. Parents. People whose accounts were taken. People who need to know what is true about something happening to them right now.
IN OUR EXPERIENCE
Both halves ask the same underlying question. They want to know what actually happened, stated in a way that will hold up when someone challenges it.
Expert witness work
Castilho has given 40 depositions in the past four years (Source: SEAK Expert Witness Directory, 2026). He is listed in the SEAK Expert Witness Directory, one of the reference directories attorneys use to identify qualified examiners.
Testifying changes how an examination is run. When we know a finding may be read back to us under cross-examination, we document the acquisition, the tool versions, the hash values and the chain of custody as we go, not afterwards. The report is written to be defensible before anyone has asked a question about it.
Academic and professional service
Castilho represented South and Central America to the Michigan Collegiate Cyber Defense Network (Source: The Interamerica Group, 2025).
He served on the electronic law commission of the São Paulo bar association, the OAB/SP (Source: EBC Rádios, 2018). That commission works on how Brazilian law treats electronic evidence and digital conduct. Sitting on it meant arguing about admissibility with lawyers rather than about tooling with engineers, which is useful practice for anyone who later has to explain a hash value to a court.
Four published books
Castilho is the author of four published books.
-
01
100 Critical Facts About the World’s Cybercrime
Two decades of internet crime, the most sophisticated offences and how the technology gets turned against people. Published in English and as 100 Fatos Marcantes Sobre Cibercrimes no Mundo. Cybercrime Magazine covered the book on publication (Source: Cybersecurity Ventures, 2019).
View the listing -
02
Do You Know What Your Child Is Doing on the Internet?
Written for parents, relatives and educators: what a connected device actually exposes a child to, and how to deal with it when something goes wrong. Published as Você sabe o que seu filho está fazendo na internet?
View the listing -
03
Deception, a Multifaced Issue
A book about lie detection through the analysis of facial microexpressions. The subject is how people’s faces behave when what they say and what they know do not match. Published as Mentira, Um Rosto de Muitas Faces.
View the listing -
04
The Virtual Detective’s Manual
An early manual on digital investigative method, written when much of the field had no textbook at all. Published as Manual do Detetive Virtual.
View the listing
The Rose Leonel case
In 2007, Castilho examined the case of Rose Leonel, a Brazilian journalist whose private images had been published without her consent. His examination traced the material back to its source, and the case produced a conviction.
In 2018, Brazil enacted Lei 13.772/2018, which criminalises the non-consensual recording and distribution of intimate images. The statute is popularly known as the Rose Leonel Law, named in her honour.
TO BE PRECISE ABOUT WHAT THAT MEANS
Castilho solved the case the law is named after. He did not write the law and he did not cause it to pass. The law carries her name because of what was done to her and because of what she did publicly afterwards. His contribution was the examination that identified who was responsible.
We state it that way deliberately. An expert who overstates one thing invites the question of what else he has overstated.
Press and citations
Castilho is quoted in national and trade press on data breaches, cybercrime trends and digital evidence.
- CNN BRASILDEC 2021On Brazil’s position in global data leak volume
- CYBERCRIME MAGAZINEMAR 2019On the publication of 100 Critical Facts About the World’s Cybercrime
- SECURITY LEADERSFEB 2025On the declining role of technical skill in digital crime
- EBC RÁDIOS2018On the book and on his OAB/SP commission service
- CRYPTO IDINTERVIEWOn responding to a large-scale data breach
- ACHEIUSACOLUMNColumnist archive
Where he works
Consultations and examinations run out of the Boca Raton office at 3651 FAU Boulevard Ste 400, Boca Raton, FL 33431. The office serves Palm Beach County and Broward County, and matters are handled for clients outside Florida where the work does not require a local licence.
You can book time with him directly rather than with an account manager. That is unusual in this market and it is intentional.
Frequently Asked Questions
NO. 1 How many times has your expert been deposed?
Forty times in the past four years. That figure comes from the SEAK Expert Witness Directory listing for Wanderson Castilho and covers depositions given as a retained digital forensic expert. Deposition volume matters to retaining counsel for a practical reason. An examiner who has been questioned under oath forty times has already been asked most of the questions opposing counsel is going to ask, and has already had his method tested by people paid to find holes in it.
NO. 2 Are your digital forensic experts certified and court qualified?
Yes. Wanderson Castilho holds Cellebrite, AccessData and Certified Computer Examiner (CCE) certifications, and a BSc in Physics from the Federal University of Paraná. He is a member of the Association of Certified Fraud Examiners. He is listed in the SEAK Expert Witness Directory. Certifications tell you which tools and methods an examiner has been trained and tested on, which is normally the first area opposing counsel probes.
NO. 3 Have your experts actually testified in state and federal courts?
Yes. Castilho has served as a retained digital forensic expert and has given 40 depositions in the past four years, in addition to trial and hearing testimony. We do not publish outcomes of matters we have worked on, and no examiner should. What we can tell you is the volume of testimony given, the certifications held, and the method used, and you can test all three before you retain anyone.
NO. 4 Can I speak directly with the founder?
Yes. Consultations are booked with Wanderson Castilho, not with an intake representative or an account manager. He founded the firm in 1999 and still runs examinations personally. Booking is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, by calling (561) 846-9010. For litigation matters, the person you speak with in the first call is the person who would sign the report.
NO. 5 Has your firm been doing this since 1999?
Yes. Enetsec was founded in 1999 in Curitiba, Brazil, and United States operations were established in 2019 with an office in Boca Raton, Florida. Across that period the laboratory has analysed more than 6,000 cases. The practical value of the date is continuity of method: the documentation and chain-of-custody procedures used today were built and revised over more than two decades of casework, not assembled recently.
Book time with Wanderson Castilho
If you have a matter that needs an examiner, the fastest route is a direct conversation. The person you speak with in the first call is the person who would sign the report.
Call (561) 846-9010 or use /contact-us/. Read about the expert witness practice, the laboratory, or booking a consultation.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT