DIGITAL FORENSICS LABORATORY · BOCA RATON, FL
Digital Forensics Services in Boca Raton, Florida
Digital forensics is the practice of recovering data in a way that survives challenge. Anyone can open a phone and read messages. The difference is whether what you found can be shown to be authentic, complete, and unchanged by the person who found it.
Enetsec is a digital forensics laboratory in Boca Raton, Florida, founded in 1999 by physicist Wanderson Castilho. The lab acquires, examines and authenticates evidence from computers, phones and cloud accounts for attorneys, companies and families. Castilho holds Cellebrite, AccessData and Certified Computer Examiner credentials and has given 40 depositions in the past four years.
That difference is the whole job. A finding that cannot be reproduced by another examiner is not evidence. It is an opinion. We build every case file so that a second examiner, working from the same copy, reaches the same result.
What we examine
We handle three classes of source: computers and storage media, mobile devices, and cloud or online accounts. Most real cases involve all three at once, because people live across all three.
Computers and storage media
Laptops, desktops, external drives, servers, memory cards and USB media. We recover deleted files, reconstruct file system activity, and build a timeline of what was created, opened, copied or removed. Deleted does not always mean gone. When a file is deleted, the operating system usually marks the space as reusable rather than erasing the content, so recovery depends on how much the device has been used since.
Mobile devices
Phones and tablets carry the densest record of a person’s activity. We extract messages, call logs, photos with their embedded metadata, application data, location artifacts and account credentials that the device has stored. In our experience, the item that decides a case is rarely the message itself. It is the metadata around it, the timestamp, the device it was created on, and whether it was edited before it was sent.
Cloud and online accounts
Email, messaging platforms, social accounts, file sync services and backups. Cloud data is preserved differently from device data, and it expires. Providers keep some records for weeks and others for months. This is why the first hours matter more than anything else you will read on this page.
What does the forensic process look like from start to finish?
Nobody explains this clearly, so here it is in full.
Step 1. Intake and scope
We start with a conversation, not a device. What happened, when you noticed it, who had access, and what question you actually need answered. A scope defined as “look at the phone” produces an expensive report nobody can use. A scope defined as “determine whether these three messages were sent from this device on this date” produces an answer.
Step 2. Preservation
Before any examination, the evidence is frozen in place. For a computer or a drive, that means a forensic image taken through a write blocker, a device that allows reading but physically prevents writing back to the source. For a phone, it means an extraction taken under documented conditions. For a cloud account, it means a preservation request and a capture of the account state before anything ages out.
Step 3. Verification
Every image gets a cryptographic hash value, a fixed-length fingerprint calculated from the data itself. If a single bit changes, the hash changes. We record the hash at acquisition, and we can recalculate it at any later point to demonstrate that the copy has not been altered. This is the mechanism that makes the rest of the work defensible.
Step 4. Examination
All analysis happens on the verified copy. The original is sealed and stored. We carve deleted content, parse application databases, correlate timestamps across sources, and identify gaps where data was removed. Where a tool produces a result, we validate it against a second method before it enters the report.
Step 5. Authentication
Recovery answers what exists. Authentication answers whether it is genuine. We examine file structure, compression artifacts, metadata consistency and editing history to determine whether an image, audio file, document or message thread has been altered. Fabricated evidence is now common enough that we treat authentication as a standard step, not an add-on.
Step 6. Reporting and testimony
You receive a written report that states the method, the tools and versions used, the findings, and the limits of what the evidence supports. It names what we could not determine as plainly as what we could. If the matter proceeds, Wanderson Castilho is available for deposition and testimony. He has given 40 depositions in the past four years (Source: SEAK Expert Witness Directory, 2026).
Who we work for
Attorneys and firms who need an examiner who will hold up under cross-examination. Companies dealing with data theft by a departing employee, invoice fraud or a suspected breach. Individuals and families facing harassment, impersonation, a romance scam, or images shared without consent.
THE STANDARD DOES NOT MOVE
We have worked both sides since 1999. The clinical standard does not change when the client is a frightened parent instead of a law firm. Only the pace of the conversation does.
Explore the Digital Forensics silo
The Enetsec Digital Forensics Lab.
Chain of custody is not paperwork, it is the reason a finding is admitted or excluded. This page documents exactly how a device is received, sealed, imaged, stored and returned, including how long we retain evidence and how it is encrypted while we hold it.
See how evidence is handled inside the lab. 02Private Investigations Into Digital Incidents.
Most people who call us do not have a case yet. They have a situation and no idea what is true. This page covers private examination before anything becomes a legal matter, and what you can learn without filing anything.
Start a private examination. 03Background Checks.
A company can look clean on its registration and still trace back to the same three people through four holding entities. This page explains how documented due diligence maps ownership, litigation history and identity from lawful sources before you sign or send money.
Run documented due diligence.What clients say
ON THE RECORD
“Excellent service! Wanderson Castilho and the Enetsec team are highly professional and efficient. They recovered important digital evidence quickly and delivered a clear report.”
Frequently Asked Questions
NO. 1 What does the forensic process look like from start to finish?
Six stages: intake and scope, preservation, verification, examination, authentication, then reporting. We define the question first, then take a forensic image through a write blocker so the original is never modified. That image is hashed to prove integrity. All analysis happens on the copy. Findings are validated by a second method where possible, and the report states the tools, the method, the results and the limits. Typical matters run one to four weeks depending on data volume.
NO. 2 What digital forensic services do you offer?
Acquisition and examination of computers, storage media, phones, tablets and cloud accounts. Recovery of deleted files, messages, photos and application data. Authentication of images, audio, video and documents. Timeline reconstruction and metadata analysis. Data theft and insider misuse investigations. Report writing, expert declarations, deposition and testimony. Re-examination of another examiner’s work. We have been doing this since 1999 and have analysed more than 6,000 cases.
NO. 3 Are your forensic reports court-admissible?
Yes. Every report is written to be defensible, which means the method is reproducible, the chain of custody is documented from receipt to return, and the tools and versions are named so another examiner can repeat the work. Admissibility is decided by the court, not by us, so we never promise an outcome. What we control is whether the work meets the standard the court applies, and that is how we build every file.
NO. 4 How much does a digital forensic examination cost?
Cost depends on four variables: how many devices, how much data each holds, whether the device is locked or damaged, and whether testimony is needed. A single phone extraction with a written report sits at the low end. A multi-device corporate matter with cloud accounts and deposition support sits far above it. We scope the work before quoting and tell you when a cheaper approach answers your question. Call (561) 846-9010 for a scoped estimate.
NO. 5 How long does a digital forensic examination take?
Most single-device matters take one to two weeks from receipt to report. Multi-device or cloud matters typically run three to four weeks. Acquisition itself is often the longest mechanical step, because imaging a large drive is limited by read speed, not by effort. Urgent preservation can begin the same day you call, which matters because cloud records expire on the provider’s schedule, not yours.
NO. 6 What do I get at the end of the examination?
A written report containing the scope, the evidence received and its identifiers, the acquisition method, hash values, the tools and versions used, the findings, and a plain statement of what the evidence does not support. Where relevant you also receive exported evidence files, timelines and exhibits suitable for filing. On request we provide a declaration or affidavit. Reports are written to be read by a judge, not only by a technician.
Speak with the examiner before you decide anything
If a device holds something that matters, the safest thing you can do right now is stop using it and call us. Preservation is cheap. Reconstruction after the data is overwritten is often impossible.
Call (561) 846-9010 or contact the lab and we will tell you honestly whether you need a forensic examination at all.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES