PROFESSIONAL TRAINING · BOCA RATON, FL
Digital Forensics Training
Enetsec trains investigators, attorneys, IT staff and corporate security teams in digital forensic method. The course covers evidence preservation, image analysis and investigative process. Wanderson Castilho has practised for 21 years, has written four books on cybercrime, and has given 40 depositions in four years.
This page is for practitioners. If you already work with digital evidence, or you are about to, the training covers the parts of the discipline that most people learn the hard way: what to touch first, what not to touch at all, and how to document what you did so it survives review.
It is taught by a working examiner, not a full-time instructor. The material comes out of active casework.
What the training covers
-
Evidence preservation and acquisition
The first hour of a matter determines what is available for the rest of it. This module covers order of volatility, when to pull power and when not to, write-blocking, imaging and verification, and the documentation that has to exist at the moment of acquisition rather than being reconstructed later. Hashing is covered as a practical discipline, including what a hash does and does not prove.
-
Chain of custody in practice
Everybody can define chain of custody. Fewer people can produce a custody record that holds up when someone hostile reads it line by line. This module works from real custody forms and identifies the gaps that get exploited: unrecorded transfers, unexplained time intervals, tool versions omitted, and second examiners who never appear in the log.
-
Image and file analysis
Metadata, container structure, and the difference between a file that has been edited and a file that has been re-encoded. Authenticating an image is a different task from analysing its content, and the two get conflated constantly. This module separates them and covers how to describe the limits of each conclusion in writing.
-
Investigative methodology
How to frame a question that evidence can actually answer. Hypothesis and alternative hypothesis. When to stop. Recognising the point where a technical finding stops being technical and becomes an inference, which is precisely the point at which an examiner is most likely to overstate.
-
Reporting and defensibility
Writing a report that a non-technical reader can follow and a technical opponent cannot dismantle. Structure, language, the treatment of uncertainty, and the sentence patterns that create problems under cross-examination.
Who this is for
Private investigators adding a digital capability. Attorneys and paralegals who receive forensic reports and need to read them critically. Corporate security, IT and internal audit staff who are usually first on the scene of an incident. In-house counsel who want to understand what their outside examiner is actually claiming.
The training is available in English and Portuguese. Delivery is in person at the Boca Raton office, at a client site, or remotely, and the format is scoped to the group rather than fixed.
Why the person teaching it matters
We are going to make the connection explicit rather than hint at it.
An examiner who teaches the discipline has to be able to state his method plainly, defend it to people who will argue with him, and explain why a step is done that way and not another way. That is the same skill a deposition tests. Teaching is preparation for testimony, and the traffic runs in both directions: forty depositions in four years supply the examples that make a module on defensibility worth sitting through.
Wanderson Castilho holds a BSc in Physics from the Federal University of Paraná, holds Cellebrite, AccessData and Certified Computer Examiner certifications, and is a member of the Association of Certified Fraud Examiners (Source: SEAK Expert Witness Directory, 2026). He has published four books, including Manual do Detetive Virtual, a manual of digital investigative method, and 100 Critical Facts About the World’s Cybercrime, covered by Cybercrime Magazine (Source: Cybersecurity Ventures, 2019). He represented South and Central America to the Michigan Collegiate Cyber Defense Network and served on the electronic law commission of the São Paulo bar association.
Expert witness and litigation support
If you are here to assess an examiner rather than to become one, that page covers retained expert work, deposition and trial testimony, and independent review of an opposing examiner’s report.
02Wanderson Castilho, full profile
Credentials, publications and press, with sources.
What a participant said
GOOGLE REVIEW · 5 STARS
“Recomendo fortemente a Enetsec para quem precisa de serviços de perícia e investigação forense digital.”
English translation: “I strongly recommend Enetsec to anyone who needs digital forensic examination and investigation services.”
This review was written in Portuguese. The Portuguese text above is the reviewer’s original wording. The English text is a translation provided for readers and is not the reviewer’s own words.
Frequently Asked Questions
NO. 1 What makes an independent examiner different from a law enforcement examiner?
Scope, mandate and availability. A law enforcement examiner works within an agency’s priorities, on that agency’s queue, on matters the agency has opened. An independent examiner is retained on a specific question, can examine material the agency has not prioritised, and can be instructed to review another examiner’s work, which an agency examiner generally cannot. The method should be identical. The tooling, the hashing, the custody record and the documentation standard do not change because the payer changed.
NO. 2 Who is this training designed for?
Practitioners rather than beginners looking for a career entry point. Private investigators adding digital capability, attorneys and paralegals who need to read forensic reports critically, corporate IT, security and internal audit staff who are first on scene when something happens, and in-house counsel supervising outside examiners. There is no prerequisite certification. There is an assumption that you already work with matters where digital evidence turns up.
NO. 3 Is the training delivered in person or remotely, and in which languages?
Both, in English and in Portuguese. In-person sessions run at the Boca Raton office at 3651 FAU Boulevard Ste 400 or at a client site. Remote delivery is live rather than recorded, because the practical modules depend on questions and worked examples. Group size, module selection and duration are scoped to the audience, so a half-day session for a legal team looks nothing like a multi-day session for an investigative unit.
NO. 4 Does completing the training make me a certified forensic examiner?
No, and any provider telling you otherwise is misrepresenting what training is. Examiner certifications such as Cellebrite, AccessData and the Certified Computer Examiner credential are issued by their respective bodies after their own examinations. This training teaches method and gives you a documented record of attendance and content covered. It is designed to make you better at the work and better at reading someone else’s work, not to substitute for a credential.
NO. 5 Can you train our team on our own tools and our own case material?
Yes, and it is usually the more useful arrangement. Sessions can be built around the toolset your organisation already runs and, where confidentiality allows, around anonymised material from your own matters. That surfaces the specific gaps in your current process, which generic coursework never does. Tell us the tools, the team’s roles and the matter types you handle, and we will scope the session around them.
Arrange a session
Tell us who is being trained, what they already do, and what you want them to be able to do afterwards. Call (561) 846-9010 or use the contact page and choose the corporate path.
You can also book time with the examiner directly at a consultation with Wanderson Castilho, or read how the same method is applied in the expert witness practice.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES