PART OF The Expert Witness practice
TESTIMONY · CROSS-EXAMINATION
Deposition and Trial Testimony in Digital Evidence Matters
The report is not the deliverable. The testimony is.
A forensic report becomes evidence only after the examiner defends it. Wanderson Castilho has given 40 depositions in the past four years and has practiced digital forensics for 21 years. Enetsec documents every examination step so the findings can be reproduced and explained under cross-examination.
An examination that reads well on paper still has to be explained out loud, under oath, by someone who did not write the questions. That is the moment the engagement is actually tested, and it is the moment most examiners have the least practice at.
What changes when the report becomes testimony
Written work gets edited. Testimony does not.
In a deposition, opposing counsel controls the sequence. You answer what is asked, in the order it is asked, without the ability to reframe. An examiner who wrote a conclusion he cannot restate in one plain sentence will discover that in the transcript rather than in the draft.
That is why we write reports the way we do. Every conclusion in an Enetsec report is stated in language the examiner can repeat verbatim on the stand, with the supporting artifact identified by name. In our experience, the reports that survive cross-examination best are the ones where the conclusion and the underlying artifact are never more than a sentence apart.
What 40 depositions actually teaches you
Volume matters here for one reason: the questions repeat.
Across 40 depositions in four years (Source: SEAK Expert Witness Directory, 2026), the attacks fall into a small number of recognizable patterns.
The scope attack
“You did not examine the laptop, did you?”
The question is not about the laptop. It is about establishing that the examination was incomplete. The answer is the scope agreement, in writing, from the beginning of the engagement, stating exactly what was submitted and what was not.
The tool limitation attack
“Your software cannot recover deleted messages from that application, can it?”
Every forensic tool has documented limits. An examiner who states them proactively in the report is answering a question. An examiner who is told them by opposing counsel is being impeached.
The assumption attack
“You assumed the person holding the phone was the account owner.”
Device attribution and person attribution are different findings. We separate them in writing. A phone can be tied to an account with high confidence while the person operating it at a given moment remains an open question, and saying so plainly is more durable than overreaching.
The compensation attack
“You are being paid for this opinion.”
The answer is that the fee is for the time and the examination, not for the conclusion, and that the fee is identical regardless of what the data shows. It is a routine question. It only lands when the witness reacts to it.
How we prepare with counsel
We prepare before the deposition, not the night before.
That preparation includes a walkthrough of the report with counsel, identification of the two or three weakest points in the analysis, and a plain-language version of every technical term likely to be used. Juries and judges do not need a lecture on file systems. They need one clear sentence about what a hash value is and why it matters, and then the finding.
We also prepare exhibits so the technical evidence can actually be shown. A screenshot of a database table proves nothing to a jury. A properly labeled exhibit that traces one message from raw artifact to report conclusion does.
Report only, consulting, or testifying
Not every engagement needs testimony. We work in three modes, and counsel picks.
Consulting expert work stays under counsel’s direction and is not disclosed.
Report-only engagements produce a written examination for use in negotiation or motion practice.
We treat all three to the same documentation standard because matters change roles more often than anyone expects.
Elsewhere in the Expert Witness practice
Frequently Asked Questions
NO. 1 Have your experts actually testified in state and federal courts?
Yes. Wanderson Castilho has served as a testifying expert across state and federal matters and has given 40 depositions in the past four years. He has 21 years in practice and is listed in the SEAK expert witness directory. Qualification is determined by the presiding court in each individual matter, so we supply the CV, certification records and testimony history at the start of the engagement so counsel can evaluate them before any disclosure deadline.
NO. 2 What makes an independent examiner different from a law enforcement examiner?
Scope and availability. A law enforcement examiner works to the investigating agency’s questions, on the agency’s timeline, and is generally not available to a private party to re-examine evidence or explain methodology outside the proceeding. An independent examiner is retained to the question counsel actually needs answered, produces a report counsel can review before it is disclosed, and is available for preparation, deposition and trial. Both should follow the same forensic standards.
NO. 3 Is my case confidential?
Yes. Matter details, party names and evidence contents are confidential and are discussed only with the retaining party. Evidence is stored encrypted at rest in the laboratory with access limited to assigned examiners. When we are engaged through counsel as a consulting expert, the work is performed under counsel’s direction. We will sign case-specific confidentiality agreements and protective orders as required.
NO. 4 How much does a digital forensic examination cost?
Cost depends on four variables: how many devices or accounts are submitted, how much data each holds, whether damaged or encrypted media requires additional handling, and whether the engagement includes testimony. Testimony carries separate deposition and trial day rates plus travel. We quote a scoped estimate in writing before work begins, and we will tell you when the likely cost outweighs the evidentiary value of the examination.
NO. 5 How long does a digital forensic examination take?
Turnaround depends on data volume and device condition. A single mobile device with a straightforward extraction is typically the fastest path. Multiple devices, large mail archives, cloud accounts, encrypted volumes or physically damaged media all extend the timeline. Court deadlines drive scheduling, so tell us the disclosure date at intake and we will confirm in writing whether it can be met before you retain us.
Retain the examiner before the deposition is calendared
Preparation time is the cheapest part of an expert engagement and the part most often skipped. Bring us in early enough to shape the scope rather than defend someone else’s.
Call (561) 846-9010 or start at /contact-us/. Learn more about the digital forensics expert witness practice, or read how examinations are documented for Daubert challenges and admissibility.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES