ADVISORY PRACTICE · BOCA RATON, FL
Digital Forensics Consultancy for Legal Teams
Sometimes you do not need an examination. You need to know what to ask for.
Legal consultancy is technical advice for counsel before and around an examination. Enetsec helps attorneys scope discovery requests, draft preservation language, read opposing expert reports and prepare cross-examination questions. Wanderson Castilho has worked digital cases since 1999 and served on the electronic law commission of the São Paulo bar association.
This is the advisory side of the practice. No device is imaged, no report is produced for disclosure, and often no expert is designated. What you get is a technical adviser sitting on your side of the table while you make decisions that are hard to reverse later.
ADVICE, NOT PRODUCTION
The examination work itself, the imaging and the disclosed forensic report, lives on our services for legal purposes page. These two engagements are deliberately separate. This one is advice. That one is production.
Where a technical adviser changes the outcome of a decision
-
Scoping discovery before you serve it
Discovery requests for digital evidence are often written in terms the producing party can honestly satisfy while giving you nothing. Asking for “all text messages” from a custodian is not the same as asking for a forensic extraction of a named device with specified date ranges and application coverage. We help you write the request so that what arrives is actually examinable.
We also help on the other side of that. When a request lands on your client and looks disproportionate, we can describe in technical terms what it would actually require, which is usually more useful in a meet-and-confer than an objection.
-
Preservation and litigation hold language
Preservation instructions written without technical input routinely miss the sources that matter. Cloud backups on provider retention clocks. Ephemeral messaging applications. Company-issued devices that IT is scheduled to reimage. Server logs with a 30-day rotation. We have seen critical evidence disappear on a routine retention schedule while a hold letter sat in an inbox.
-
Reading the other side’s expert report with you
Before you decide whether to commission a rebuttal, it helps to know whether there is anything to rebut. We read the report with counsel, identify which conclusions are supported and which are not, and tell you honestly where the weaknesses are. Where a full independent examination is warranted, that becomes a separate rebuttal and report review engagement.
-
Preparing cross-examination
This is the highest-value hour in most engagements. We help counsel build the technical questions for the other side’s examiner: what the tool cannot do, what was not examined, what version the analysis was run on, where the custody record stops, and where the conclusion outruns the artifact. After 40 depositions in the past four years (Source: SEAK Expert Witness Directory, 2026), our founder has answered these questions often enough to know which ones actually land.
-
Evaluating whether an expert is needed at all
Occasionally the honest advice is that the digital evidence will not decide your matter and the budget is better spent elsewhere. We say that when it is true. It costs us a project and it is the reason firms come back.
How the engagement is structured
Most consultancy work is hourly and starts with a call. There is no imaging, no custody chain and no disclosed report unless the engagement changes shape.
THE PRIVILEGE QUESTION
Where counsel wants the work privileged, we can be retained as a non-testifying consulting expert working under counsel’s direction. That structure has a practical consequence worth planning for at the start: if the matter later requires disclosed testimony, counsel and the examiner should discuss the transition deliberately rather than drifting into it.
We also brief organizational leadership when the matter requires it. A board or an executive team facing a data incident needs the technical picture translated without being managed, and counsel usually wants to control how that conversation happens.
What a client firm says
Marcelo Candiotto Freire of Candiotto Valle Advogados describes the advisory relationship this way:
ON THE RECORD
“Their work not only strengthens our legal strategies but also contributes significantly to the broader goal of ethical commerce.”
Strengthening a legal strategy is the accurate description of this service. We are not producing the evidence in an advisory engagement. We are making sure counsel’s decisions about evidence are made with the technical facts in hand.
Who advises
Wanderson Castilho leads consultancy engagements personally.
He founded Enetsec in 1999 and has 21 years in practice. He holds a BSc in Physics from the Federal University of Paraná, is Cellebrite, AccessData and CCE certified, and is a member of the Association of Certified Fraud Examiners. He served on the electronic law commission of the São Paulo bar association, which is unusual background for a technologist and the reason he reads a discovery request the way a lawyer does rather than the way a lab does.
He has also written four books on cybercrime and digital investigation, and has been interviewed on digital crime by CNN Brasil, Cybercrime Magazine and Security Leaders.
Frequently Asked Questions
NO. 1 Do you work cases for regular people, or only for law firms?
Both. This particular page describes advisory work for attorneys and legal teams, which is a specific service with a specific structure. We also work directly with individuals and families on device examinations, harassment and scam investigations, missing person matters and personal digital security. If you are an individual, start with a call and we will tell you which service fits and roughly what it involves before you commit to anything.
NO. 2 Do you handle business and corporate investigations?
Yes. Corporate work includes data exfiltration by departing employees, intellectual property theft, internal fraud investigations supported by our founder’s ACFE membership, partnership and shareholder disputes, incident response after an intrusion, and regulatory investigation support. We work through outside counsel or directly with in-house legal, and we structure the engagement to preserve privilege where counsel needs it.
NO. 3 Can an investigation begin remotely?
Often, yes. The initial consultation, scoping, preservation guidance and review of documents or existing reports are all done remotely. Some evidence sources, including certain cloud accounts, mail archives and servers, can be acquired remotely with proper authorization. Physical devices generally need to reach the laboratory, and they can be shipped under a documented custody chain rather than hand-delivered. We tell you at intake which parts of your matter require physical possession.
NO. 4 Do you work with legal teams and organizational leadership?
Yes, and we treat them as different audiences. Counsel needs technical precision, methodology detail and the limits of what the evidence supports. Leadership needs the same facts without jargon, plus a clear statement of what is known, what is not yet known, and what decisions are actually time-sensitive. We prepare separate briefings for each rather than one document that serves neither, and counsel controls the sequence.
NO. 5 Can you tell me if my phone has spyware or stalkerware on it?
We can examine a device you own or lawfully control for indicators of monitoring software, including installed applications, configuration profiles, unexpected permissions, anomalous network behavior and known artifacts. Findings are documented so they can be used in a legal proceeding if needed. We only examine devices with lawful authority from the owner or the court. We do not access, unlock or monitor a device belonging to another person.
Book an advisory call before the next deadline
The decisions that matter most in a digital evidence matter, what to preserve, what to request, and whether to designate at all, get made early and are expensive to unwind. One call at the right time is usually enough.
Call (561) 846-9010, email [email protected], or book through /contact-us/. Review the digital forensics expert witness practice, or see how testimony is prepared and defended in deposition and trial testimony.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES