REPUTATION & REMOVAL · BOCA RATON, FL
Management and Interruption of Defamatory Crises
A coordinated defamation campaign does not feel like one at first. It feels like bad luck. A review here, a post there, a comment on an industry forum, an anonymous account that seems to know things.
Enetsec identifies who is running a defamation campaign and then works to interrupt it. We document the sources first, because removal without evidence leaves you no case. Founder Wanderson Castilho has given 40 depositions in the past four years. Call (561) 846-9010 in Boca Raton, Florida.
Then the pattern becomes visible. The same phrasing appears in four places. The accounts were created within days of each other. Posts land on a schedule. Somebody is running this.
At that point you have two problems, and most people only try to solve one of them.
Removal Is Not the Whole Problem
The instinct is to get it taken down. That is understandable, and it is incomplete.
If you take down the posts without first documenting them, you have deleted your own evidence. The person running the campaign starts again next month under different accounts, and this time you have nothing to show a platform, an attorney or a court, because the record of the first campaign no longer exists anywhere except in your memory.
The sequence that works is the other way around. Identify, document, then remove. Everything on this page is built on that order.
Why a Forensics Laboratory and Not an Agency
There are two kinds of firm already selling into this problem, and both do part of the job.
Law firms handle the legal instrument. They send the letters, they file when filing is warranted, and they are essential. But a demand letter needs a defendant, and a filing needs evidence attached to it. Somebody has to produce both.
Reputation agencies handle visibility. They push content down, they manage the search result, and they can genuinely reduce what the world sees. But suppression does not identify the person, and it does not stop them.
Attribution and removal are the same capability chain. Finding out who wrote the post and getting the post taken down both depend on the same underlying material: the account artifacts, the timestamps, the metadata, the archived state of the content and the documented custody of all of it. That is forensic work. A laboratory that can do the identification is already holding everything the removal request needs, and a removal request built on documented evidence carries weight that a complaint form does not.
We run the whole sequence. That is the argument for calling us rather than starting somewhere else and being handed off.
Identifying the Source of a Coordinated Campaign
Coordination leaves fingerprints. People are consistent even when they are trying not to be.
We look at account creation dates and sequences, posting time distributions, reused phrasing and stylistic tells, image reuse and image origin, shared infrastructure across accounts and sites, domain registration and hosting history, cross-platform overlaps, and where they exist, message headers and log records. Individually each signal is weak. Together they produce a picture.
In our experience the campaigns that look most anonymous are usually the ones with a personal origin: a former employee, a former partner, a competitor with a specific grievance, a family dispute that moved online. The technical work narrows the field. The interview work with you narrows it further, because you usually know the motive even when you do not know the name.
THE BOUNDARY
We do not access anyone’s device or account to do this. Everything we produce comes from public material, from records you are entitled to, and from material lawfully obtained through counsel or process.
Documenting It So It Survives Challenge
Everything we collect is preserved to an evidentiary standard from the first capture.
Content is archived with the page state, the URL, the capture time and the hash value recorded. Screenshots alone are not enough; a screenshot proves nothing about when it was taken or whether it was altered. Acquisitions are logged with the tool and version used. Chain of custody begins at collection and does not have a gap in it.
That matters because defamation matters get contested hard. The other side will argue the content was fabricated, taken out of context, or altered. A documented, reproducible capture answers that. An email attachment of a screenshot does not.
The examiner who does this work is the person who can be deposed on it. Wanderson Castilho, founder of Enetsec, is a Certified Computer Examiner who holds a BSc in Physics from the Federal University of Paraná and has given 40 depositions in the past four years (Source: SEAK Expert Witness Directory). He has served on the electronic law commission of the São Paulo bar association and is a member of the Association of Certified Fraud Examiners (Source: The Interamerica Group).
Interrupting an Active Campaign
Once the source is identified and the record is preserved, interruption becomes practical rather than reactive.
We prepare the evidence packages that platforms actually respond to, with the content, the capture record and the pattern documented in a form their trust and safety teams can act on. We give your attorney the material a demand letter or a filing needs, including the attribution work that names a party. Where the campaign is being run through a hosting provider or a registrar, we prepare the abuse documentation for that route. And we monitor for recurrence, because a campaign that is interrupted often restarts under new accounts, and the second wave is far easier to shut down when the first is fully documented.
THE LIMIT
We do not promise that a platform will act. Platform decisions belong to platforms. What we control is the quality of what is put in front of them, and that is the variable that actually moves outcomes.
What You Receive
A written examination report identifying the sources found, the method used and the limits of the findings. An archived evidence set with hash values and custody documentation. A platform-ready removal package for each item. Attorney-ready exhibits. A monitoring plan for recurrence. And the same examiner available for a declaration or testimony if the matter proceeds.
Go Deeper
Frequently Asked Questions
NO. 1 Are your forensic reports court-admissible?
Our reports are prepared to the standards courts require: documented acquisition, verified hash values, unbroken chain of custody, recorded tool versions, and findings stated within the limits of what the evidence supports. Admissibility is decided by a judge on the record in a specific matter, so no examiner can promise it in advance. What we can do is make sure nothing about our method gives anyone a reason to exclude the work, and that the examiner who did it can testify to every step of it.
NO. 2 Can you rebut or re-examine another examiner’s forensic report?
Yes, and rebuttal work is a regular part of this practice. We re-examine the original evidence where it is available, review the other examiner’s method, tooling and documentation, and identify where the findings exceed what the data supports. Common issues are conclusions drawn from incomplete acquisition, timestamps interpreted without accounting for time zone or system clock drift, and screenshots offered where a verified capture was needed. We report what we find, including where we agree with the other examiner.
NO. 3 Do you provide expert witness testimony?
Yes. Wanderson Castilho works as a testifying expert and has given 40 depositions in the past four years. He is Cellebrite, AccessData and Certified Computer Examiner certified and is listed in the SEAK expert witness directory. The examiner who conducts the examination is the examiner who testifies, which matters because testimony that relies on work someone else performed is far easier to attack.
NO. 4 How do you work with attorneys and law firms?
We take direction from counsel and structure engagements so that work performed at counsel’s request is scoped appropriately from the start. Typically we begin with a scoping call to define the questions the examination needs to answer, deliver preliminary observations verbally, then produce the written report once the scope is settled. We provide exhibits, declarations, deposition support and rebuttal work. We also tell counsel early when the evidence will not support the theory, because finding that out at deposition is worse.
NO. 5 How many times has your expert been deposed?
Forty times in the past four years. Wanderson Castilho has 21 years in practice, is Cellebrite, AccessData and Certified Computer Examiner (CCE) certified, holds a BSc in Physics from the Federal University of Paraná, and has authored four published books on cybercrime and digital investigation. He founded Enetsec in 1999 and the laboratory has analyzed more than 6,000 cases since then.
NO. 6 How much does a digital forensic examination cost?
It depends on scope, and the variables are knowable: how many accounts and platforms are involved, how much content has to be captured and archived, whether device acquisition is required, whether attribution work is needed or only preservation, and whether the matter is likely to require testimony. A narrowly scoped preservation and capture engagement is a fraction of a full multi-platform attribution examination. We quote in writing after a scoping call, and we tell you which parts of the scope you can defer.
Start With Documentation, Not Deletion
If a campaign is running against you right now, do not delete anything and do not respond publicly yet. Call (561) 846-9010 or reach us through our contact page, and we will start by preserving what is live before it disappears. If the material against you includes non-consensual images, go directly to our page on the removal of inappropriate content.
Call (561) 846-9010, email [email protected], or start at /contact-us/. If you also need to know who is behind an anonymous account, see identification of the origin of internet attacks.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES