THE LABORATORY · BOCA RATON, FL
The Enetsec Digital Forensics Lab
A forensic finding is only as strong as the record of how it was obtained. If nobody can show where the device was, who touched it, and whether it was altered while in the lab, the finding is attackable no matter how correct it is.
The Enetsec forensics lab in Boca Raton, Florida handles every device inside a documented chain of custody. We image storage media with write blockers, work only from verified copies, and keep the original sealed. Evidence stays encrypted in custody. The lab has examined more than 6,000 cases since 1999.
This page explains what happens inside the controlled environment. It is the part of the work clients rarely see, and it is the part that decides whether the report survives.
Chain of custody, from the front door onward
Every item receives a unique identifier the moment it arrives. We record the date and time of receipt, who delivered it, its condition, serial numbers, and photographs of the item as received. The item is then sealed in tamper-evident packaging with a signed label.
From that point, every transfer is logged. Who took it, when, for what purpose, and when it came back. The log is a continuous record with no gaps, because a gap is where an opposing examiner will spend the afternoon.
NO EXCEPTIONS FOR SMALL MATTERS
We do not skip this step for small matters. In our experience, the case you assumed would never reach a courtroom is the one that does.
Extraction and analysis in a controlled environment
Storage media is imaged through a hardware write blocker. The blocker sits between the source device and our workstation and physically permits reading while preventing any write operation reaching the original.
The resulting image is hashed. That hash value is a fingerprint calculated from the data, and any change to any part of the copy produces a different value. We record it at acquisition and recalculate it before and after analysis to demonstrate nothing shifted while the evidence was with us.
Mobile devices are handled in isolation, disconnected from cellular and wireless networks so that no remote command can reach the handset during acquisition. Cloud accounts are captured through documented, authorised acquisition with the account holder’s consent or lawful authority, and the capture parameters are recorded alongside the data.
THE ORIGINAL IS NEVER THE WORKING COPY
All examination then happens on the verified copy. The original goes into storage and stays there.
Evidence storage, encryption and retention
Evidence images are held on encrypted storage inside the lab. Access is restricted to assigned examiners, and access events are logged. Physical items are stored in a secured area, still sealed, still labelled.
We retain case data for a defined period after the report is delivered, and we confirm that period with you in writing at intake because litigation timelines vary. When the retention period ends you choose: secure destruction with a certificate, or return of the media. Nothing is discarded on assumption.
Tool validation
Tools are not trusted because they are expensive. Every tool we rely on is validated against known data sets where the correct answer is already established, and we record the tool name and version in the report so another examiner can reproduce the work.
WHEN TWO METHODS DISAGREE
Where a result matters to the conclusion, we confirm it using a second, independent method. If two methods disagree, that disagreement goes in the report. Wanderson Castilho holds Cellebrite, AccessData and Certified Computer Examiner credentials, and has practised for 21 years (Source: SEAK Expert Witness Directory, 2026).
What clients say
ON THE RECORD
“Wanderson goes above and beyond in his investigations — meticulous, thorough, and genuinely committed to finding the truth in digital evidence.”
Frequently Asked Questions
NO. 1 What are your evidence handling procedures?
Every item is identified, photographed and logged at receipt, then sealed in tamper-evident packaging with a signed label. Storage media is imaged through a hardware write blocker so the source is never written to. The image is hashed at acquisition. Analysis happens only on the verified copy. Every transfer of the item is recorded with person, time and purpose. The original stays sealed in secured storage until it is returned or destroyed at your instruction.
NO. 2 How do you maintain chain of custody?
With a continuous written log that starts at receipt and ends at return or destruction. Each entry records who had the item, when they took it, why, and when it came back. Nothing moves without an entry. Hash values recorded at acquisition are recalculated later to demonstrate the data did not change while we held it. The log is included with the report, so the handling record can be examined alongside the findings.
NO. 3 Is my data encrypted while you have it?
Yes. Evidence images are stored on encrypted storage inside the lab, and access is limited to the examiners assigned to your matter. Access events are logged. Physical items are held sealed in a secured area. We do not place case data on personal devices, and we do not use consumer file-sharing services to move evidence. Where a client needs a copy delivered, it goes out encrypted with the key transmitted separately.
NO. 4 How is evidence stored, and how long do you keep it?
Digital evidence is held encrypted in the lab; physical items are held sealed and labelled. Retention is agreed in writing at intake, because a family matter and a multi-year litigation matter need very different periods. When the agreed period ends, you choose secure destruction with a certificate of destruction, or return of the media to you or your attorney. We do not destroy anything without written instruction.
NO. 5 Will an examination damage my device or alter my data?
No. Forensic acquisition is designed to be non-destructive. Write blockers make it physically impossible to write to source media during imaging, and phones are acquired in isolation so nothing reaches the handset remotely. The examination itself runs on a copy, so your original data is not touched by the analysis. The one honest caveat: a device that is already physically damaged may need repair before acquisition, and we tell you before we do anything.
NO. 6 Are the forensic tools you use vetted and accepted by courts?
Yes. We use industry-standard platforms including Cellebrite and AccessData tools, which are widely used by examiners and law enforcement. Acceptance depends on more than the brand, so we validate each tool against known data sets and record the exact version used in the report. Where a finding is central, we confirm it by a second independent method. That reproducibility is what lets another examiner check the work.
Send us the device before anything changes
If a device holds evidence, the safest place for it is sealed in our custody.
Read the full digital forensics services process, or start with a private examination if you are not sure yet what you are dealing with. Call (561) 846-9010 or contact the lab.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES