EXPERT WITNESS PRACTICE · BOCA RATON, FL
Digital Forensics Expert Witness in Boca Raton, Florida
You are not hiring a lab. You are hiring the person who will sit in the chair and answer for the findings.
Wanderson Castilho is a digital forensics expert witness based in Boca Raton, Florida. He holds a physics degree from the Federal University of Paraná, is Cellebrite, AccessData and CCE certified, and has given 40 depositions in the past four years. Enetsec has analysed more than 6,000 cases since 1999.
That distinction decides cases. A report can be technically correct and still fall apart, because the examiner who wrote it cannot explain the method, cannot produce the documentation, or has never been cross-examined before. Opposing counsel does not attack your evidence first. Opposing counsel attacks the person who carried it into the record.
Enetsec is a digital forensics and cybercrime laboratory founded in 1999 by Wanderson Castilho. US operations opened in 2019, and the laboratory now works from an office at 3651 FAU Boulevard Ste 400 in Boca Raton. The expert witness practice serves attorneys, corporate counsel and law enforcement across South Florida and nationwide.
The credential stack, stated plainly
An expert’s qualifications get read aloud before anything else happens. Here is what gets read.
01
Education and certifications
Wanderson Castilho holds a Bachelor of Science in Physics from the Federal University of Paraná (UFPR). That matters more than it sounds. Digital forensics is applied measurement, and a physics background is training in how measurement error is described rather than hidden.
Castilho is certified on Cellebrite and AccessData, and holds the Certified Computer Examiner (CCE) credential. Those are the three that come up on voir dire in a digital evidence matter.
Certifications are not decoration here. When a court asks whether a method is generally accepted, the answer is stronger when the examiner is credentialed on the specific tool that produced the output in evidence.
02
Deposition record
He has given 40 depositions in the past four years and has 21 years in practice (Source: SEAK Expert Witness Directory, 2026). He is listed in the SEAK expert witness directory, the reference attorneys use when they need a testifying examiner with a documented record rather than a résumé.
03
Publications
Castilho has written four published books. 100 Critical Facts About the World’s Cybercrime (2018, Editora Esplendor) was covered by Cybercrime Magazine. 100 Fatos Marcantes Sobre o Cibercrime no Mundo is the Portuguese edition. Mentira: Um Rosto de Muitas Faces (2011) is a study of lie detection through facial microexpression analysis. Manual do Detetive Virtual (2009) is a practitioner’s manual for digital investigation.
Publication is one of the things a court can look at when it evaluates whether a method has been exposed to outside scrutiny. It is also, more practically, a written record of what the expert has said in public for over a decade. Nothing in it contradicts what he says under oath.
04
Professional memberships
He is a member of the Association of Certified Fraud Examiners (ACFE). He represented South and Central America to the Michigan Collegiate Cyber Defense Network, and served on the electronic law commission of the São Paulo bar association (OAB/SP).
The case behind the name
CASE FILE — 2007
In 2007 Castilho investigated the case of Rose Leonel, a Brazilian journalist whose private images were published without her consent. His examination traced the material back to its source and produced a conviction. Brazil later passed Lei 13.772/2018, the case that led to the law being named in her honour.
We include it because it shows the shape of the work: attribution of anonymous digital material to a specific origin, documented well enough to survive a criminal proceeding.
What a testifying expert actually does on your matter
The engagement usually runs in four stages, and not every matter needs all four.
-
First, scoping. Before anything is imaged, we want to know what the dispute actually turns on. A phone extraction that answers the wrong question is expensive and useless. In our experience, the single most common waste in a digital evidence matter is a full extraction ordered before anyone defined what fact it was supposed to establish.
-
Second, acquisition and examination. Devices are imaged forensically, hash values are recorded at acquisition and verified after, and the original media is preserved unaltered. Every tool, every version number and every step is logged as it happens, not reconstructed later.
-
Third, the report. A written report states what was examined, how, what was found, and where the data stops supporting a conclusion. We write the limits into the report. An expert who states limits in writing is much harder to surprise with them in a deposition.
-
Fourth, testimony. Deposition, hearing, or trial. The report is defended by the person who wrote it.
How the examination is built to survive challenge
We build every examination on the assumption that a competent opposing expert will read it line by line and try to break it.
That assumption changes the work. It means chain of custody is documented from the moment the device is received, with custody transfers signed and timestamped. It means the acquisition hash is recorded and reproducible, so a second examiner working from the same image can confirm they are looking at the same data. It means tool output is interpreted, not simply pasted. Forensic software returns artifacts; it does not return conclusions.
THE LIMIT
We do not promise that any court will admit any piece of evidence. No honest examiner can promise that, and an expert who does promise it is an expert who will be impeached with the promise. What we control is the methodology, the documentation and the ability to explain both.
Where this work gets tested
Three parts of this practice deserve their own explanation. Each one is where matters are actually won or lost.
Deposition and Trial Testimony.
After 40 depositions in four years, the questions stop being a surprise. Opposing counsel almost always works the same four seams: what you did not examine, what your tool cannot do, what you assumed, and what you were paid. Preparation is knowing which seam this case exposes before you sit down.
Read how findings are defended under cross-examination. 02Daubert Challenges and Admissibility.
Florida adopted the Daubert standard in 2019, which means a Florida judge now evaluates whether a digital forensics method is testable, reviewed, error-rated and generally accepted before a jury hears a word of it. Most exclusions we see have nothing to do with the science. They come from documentation that was never created in the first place.
Read how an examination is documented for a Daubert challenge. 03Rebuttal and Report Review.
When we review another examiner’s work, four failures recur: methodology that was never written down, gaps in the custody record, tool output read at face value, and conclusions that travel further than the data allows. A rebuttal report does not need to prove the opposite. It needs to show where the original stopped being supported.
Read how an opposing report is independently reviewed.Frequently Asked Questions
NO. 1 Are your digital forensic experts certified and court qualified?
Yes. Wanderson Castilho is certified on Cellebrite and AccessData and holds the Certified Computer Examiner (CCE) credential. He holds a BSc in Physics from the Federal University of Paraná and is a member of the Association of Certified Fraud Examiners. He is listed in the SEAK expert witness directory with 21 years in practice. Court qualification is decided by the court in each individual matter, so we provide the full CV and certification records early in the engagement so counsel can evaluate them before disclosure deadlines.
NO. 2 Do you provide expert witness testimony?
Yes. We accept engagements for report production only, for deposition testimony, and for hearing or trial testimony. Many matters begin as a report engagement and become testimony engagements later, so we document every examination to the testimony standard from the start rather than upgrading it afterwards. We also accept consulting expert roles where the work stays under counsel’s direction and no report is disclosed.
NO. 3 How many times has your expert been deposed?
Forty depositions in the past four years (Source: SEAK Expert Witness Directory, 2026). That volume matters for a practical reason rather than a bragging one. Deposition questioning in digital evidence matters is more repetitive than most attorneys expect, and an examiner who has answered the same attacks on scope, tool limitation, assumption and compensation dozens of times does not get rattled by them. Total practice experience is 21 years.
NO. 4 Can I speak directly with the founder?
Yes. Wanderson Castilho takes the initial consultation himself and remains the examiner of record on matters where he will testify. You are not routed to a sales team and then handed to an unnamed technician. Call (561) 846-9010 or email [email protected]. Office hours are Monday through Friday, 8:00 AM to 5:00 PM.
NO. 5 Do you take cases nationwide, or only in Florida?
We take cases nationwide and internationally. The office is at 3651 FAU Boulevard Ste 400, Boca Raton, FL 33431, and South Florida matters are the largest part of the caseload. Devices can be shipped to the laboratory under documented custody, and remote acquisition is possible for some cloud and server sources. Travel for deposition or trial testimony is arranged case by case.
NO. 6 Has your firm been doing this since 1999?
Yes. Enetsec was founded in 1999 in Curitiba, Brazil by Wanderson Castilho, and US operations were established in 2019. The laboratory has analysed more than 6,000 cases in that time (Source: Enetsec case records, 2026). That continuity matters when older evidence is at issue, because we have working familiarity with device generations and file systems that current examiners have often never handled.
Speak with the examiner before you designate
If a digital evidence question is going to decide your matter, have the conversation before the disclosure deadline rather than after it. We will tell you honestly whether the data can answer the question you need answered.
Call (561) 846-9010, email [email protected], or use the form at /contact-us/. You can also review the full digital forensics services catalogue or read about the laboratory and its procedures.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES