EXAMINATION PRACTICE · BOCA RATON, FL
Digital Forensic Services for Legal Purposes
This page is about the examination itself. Evidence comes in, a documented forensic process runs, and a written report comes out that the examiner can defend under oath.
Enetsec produces court-admissible digital forensic examinations for attorneys in Boca Raton and across South Florida. The laboratory images devices, authenticates the data, documents chain of custody and delivers a written report the examiner can defend. Founded in 1999, Enetsec has analysed more than 6,000 cases.
If what you need is technical advice while you scope discovery or evaluate someone else’s analysis, that is a different engagement, and it is described on our legal consultancy services page. This page is the laboratory work.
What we examine
Evidence in a modern matter is rarely in one place, so we work across sources.
Mobile devices are the largest category: iOS and Android phones and tablets, including messages, call logs, photographs with their embedded metadata, application data, location artifacts and deleted-record recovery where the data survives. Computers and laptops follow: file systems, documents and their revision history, browser and search artifacts, connected-device records and system logs.
We also examine email and mail archives, cloud accounts and storage where lawful access is provided, servers and network logs, external drives and memory cards, and social media and messaging account exports. Where damaged media is involved, we assess recoverability before quoting the work rather than after.
Every one of these is handled the same way, because the process is what makes the output usable.
How the examination runs
-
Scoping
We start with the legal question, not the device. What fact does this examination need to establish, and can digital evidence establish it? We will tell you when the answer is no. In our experience, an early scoping call saves more money than any other single step in a forensic engagement.
-
Intake and custody
Each item is logged on arrival with make, model, serial number, physical condition and the identity of the person who delivered it. The custody record starts there, and every transfer after it is signed and timestamped through to return or documented destruction.
-
Forensic acquisition
Devices are imaged with write protection so the original data is not altered. Hash values are recorded at acquisition and verified before analysis, which is what allows anyone later to confirm that the data examined is the data seized. Analysis is performed on working copies. The original image is preserved.
-
Examination and authentication
Recovering data is only half of it. The other half is authentication: establishing that a file, a message or an image is what it appears to be. That means checking metadata for internal consistency, comparing timestamps across independent sources, and looking for the signatures of editing, re-encoding or fabrication. A screenshot of a text message is not evidence of a text message. The device record behind it might be.
-
The report
You receive a written report stating what was examined, the tools and versions used, the methodology followed, the findings, and the limitations. Custody documentation is attached. Exhibits are prepared so a finding can be shown, not just asserted.
Matter types we support
Civil litigation and discovery disputes. Business and partnership disputes where records, communications or intellectual property are in question. Employment matters including data exfiltration by departing employees. Fraud and financial investigations, which draw on our founder’s membership in the Association of Certified Fraud Examiners. Family law matters involving devices, accounts or asset concealment. Defense work requiring independent examination of evidence already analysed by another party. Regulatory and compliance investigations.
WHO WE ACT FOR
We work with solo practitioners and with larger firms, and with in-house counsel directly.
What a client firm says
Marcelo Candiotto Freire, an attorney at Candiotto Valle Advogados, writes:
ON THE RECORD
“Their expert digital forensic analysis has been crucial in identifying business owners and companies operating outside legal and regulatory boundaries.”
That describes the attribution work accurately. Tracing activity to a responsible entity, and documenting the trace well enough that it holds up, is a large share of what this laboratory does for legal clients.
Who performs the work
Examinations are performed and signed by Wanderson Castilho or by examiners working under his direction, and he remains the examiner of record on any matter where he will testify.
Castilho holds a BSc in Physics from the Federal University of Paraná, is Cellebrite, AccessData and CCE certified, and has 21 years in practice with 40 depositions in the past four years (Source: SEAK Expert Witness Directory, 2026). He is a member of the Association of Certified Fraud Examiners and has written four published books on cybercrime and investigation.
We say this plainly because it is the difference that matters to a legal buyer. You are retaining a named individual who can be qualified, not an anonymous technician whose CV you will see for the first time at disclosure.
Frequently Asked Questions
NO. 1 How do you work with attorneys and law firms?
Directly, and under counsel’s direction. Most engagements start with a scoping call to define the forensic question, followed by a written scope and estimate before any work begins. We can be retained as a consulting expert whose work is not disclosed, or as a testifying expert who produces a disclosed report and appears for deposition and trial. We accept protective orders and case-specific confidentiality agreements, and we work to your disclosure calendar.
NO. 2 What digital forensic services do you offer?
Forensic imaging and examination of mobile devices, computers, servers, external media and cloud accounts. Deleted-data recovery where the data survives. Authentication of files, images, messages and metadata. Email and mail archive analysis. Attribution of online activity and accounts. Independent review and rebuttal of opposing expert reports. Expert witness testimony at deposition and trial. Incident response and intrusion analysis for corporate matters.
NO. 3 What do I get at the end of the examination?
A written forensic report and its supporting materials. The report states the items examined, the tools and versions used, the methodology followed, the findings and their limitations. Attached are the chain of custody record, hash verification records, and exhibits prepared for use in a proceeding. Where relevant we also deliver an extraction export so counsel can search the underlying data. The examiner is available to walk counsel through all of it.
NO. 4 What should I do right now to preserve evidence?
Stop using the device and do not delete anything, including things that seem irrelevant. Do not run cleanup tools, factory resets or “optimizer” applications. Do not let a third party attempt recovery, because most consumer recovery software writes to the drive it is reading. Keep the device charged and, where it is safe to do so, off the network. Write down who has had access to it and when. Then call us before anything else happens to it.
NO. 5 What is cell site analysis and CDR mapping used for?
Call detail records and cell site data are used to describe where a device connected to the network over time. It is useful for testing a timeline or an alibi, showing device movement between areas, and corroborating other records. Its precision is frequently overstated. A cell sector shows a coverage area, not a point, and coverage varies with terrain, load and antenna configuration. We report it as an area with stated uncertainty, never as a pin.
Bring the evidence in before it degrades
Digital evidence has a shelf life. Devices get used, storage gets overwritten, cloud logs age out on provider retention schedules. The earlier we take custody, the more there is to examine.
Call (561) 846-9010, email [email protected], or start at /contact-us/. See the full digital forensics expert witness practice, or read how examinations are documented for Daubert challenges and admissibility.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES