DIGITAL FORENSIC EXAMINER — BOCA RATON, FL
Wanderson
Castilho
Most digital forensics companies sell you a lab. We introduce you to a person.
Enetsec is a digital forensics and cybercrime laboratory in Boca Raton, Florida, founded in 1999 by physicist Wanderson Castilho. The lab recovers and authenticates digital evidence for attorneys, companies, families and law enforcement. Castilho has given 40 depositions as an expert witness in the past four years and has analysed more than 5,000 cases.
IN PRACTICE SINCE 1999 40 DEPOSITIONS / 4 YRS 5,000+ CASES ANALYSED
DIGITAL FORENSICS & CYBERCRIME LABORATORY · EST. 1999
Founder & Principal Examiner,
Enetsec – Cybercrime & Digital Forensics
FIG. 01 — THE EXAMINER WHOSE NAME GOES ON THE REPORT
The proof, before the pitch.
1999
IN PRACTICE SINCE
Founded in Curitiba, Brazil. US operations established 2019; laboratory in Boca Raton.
40
DEPOSITIONS · SEAK DIRECTORY 2025
Forty depositions given as an expert witness in the past four years.
4.8
22 GOOGLE REVIEWS
Attorneys, corporate officers and families — in the same review feed.
4
PUBLISHED BOOKS
Including 100 Critical Facts About the World’s Cybercrime (Editora Esplendor, 2018).
5,000+
CASES ANALYSED
Across two decades, two countries and every class of digital evidence.
In 2007 Castilho examined the matter of Rose Leonel, a Brazilian journalist whose private images were published without her consent. The examination traced the material back to its source and the case produced a conviction. Brazil later passed Lei 13.772/2018, the statute popularly named in her honour.
We solved the case the law is named after. We do not claim to have written the law.
FIG. 02 — BROADCAST & PRESS APPEARANCES, 1999–2026
FIG. 03 — FOUR PUBLISHED TITLES, 2007–2018
Four doors into this laboratory.
People arrive here for four different reasons, carrying two different fears. Attorneys and corporate officers are afraid their expert will be discredited and their evidence excluded. Individuals and families are afraid that something is happening to them and they do not know what is true. Both fears are answered by the same discipline. They are not answered by the same conversation — so pick your door.
Attorneys & litigation support
You need an examiner who survives cross-examination. Forensic images, documented chain of custody, reproducible extraction logs, and written findings that state the method alongside the result. We also take rebuttal work — testing whether another examiner’s stated method supports the stated conclusion.
SERVICES FOR LEGAL PURPOSES → DOOR 02Corporate & compliance
Business email compromise, ransomware, departing employees walking out with a customer list, vendor fraud. The first hour decides how much of the story is still recoverable. We scope the incident, preserve the systems that matter, and give leadership a plain-language account of what happened.
INCIDENT RESPONSE →Individuals & families
A romance scam. A missing family member. Images of you circulating that you never agreed to share. These cases turn on ordinary digital traces that people delete by accident while trying to investigate on their own. You do not need the technical vocabulary to call us. You need to stop deleting things and pick up the phone.
CALL (561) 846-9010 → DOOR 04Law enforcement & public agencies
Agencies retain us for overflow capacity, for second examinations, and for matters with an international dimension. Castilho represented South and Central America to the Michigan Collegiate Cyber Defense Network and is a member of the Association of Certified Fraud Examiners.
AGENCY ENGAGEMENTS →How we work.
Every engagement runs the same spine — documented so a second examiner can repeat each step and reach the same result. Watch it run.
SAME SPINE, EVERY MATTER —
SO A SECOND EXAMINER REACHES THE SAME RESULT.
When we examine a phone, the first thing we check is not the messages. It is whether the device state, the OS version and the backup history will let us reach the messages without altering them. That order is the difference between evidence and a story.
THE LIMIT
We work lawfully. We do not access accounts or devices without authority from the person who owns them or from a court.
That limit is not a marketing position. It is what keeps an examiner’s findings admissible and an examiner’s testimony intact.
What the record says about us.
-
STATEMENT 01RE: EXPERT TESTIMONY
[PENDING VERBATIM REVIEW]
TRIAL ATTORNEY · PALM BEACH COUNTY -
STATEMENT 02RE: INCIDENT RESPONSE
[PENDING VERBATIM REVIEW]
COO · LOGISTICS FIRM, FT. LAUDERDALE -
STATEMENT 03RE: PRIVATE CLIENT
[PENDING VERBATIM REVIEW]
PRIVATE CLIENT · ROMANCE-SCAM MATTER
IDENTITIES REDACTED — CLIENT MATTERS ARE CONFIDENTIAL BY DEFAULT.
Serving South Florida, from Boca Raton.
The laboratory sits in the FAU Research Park. Devices can be delivered in person or by tracked courier; acquisition can also run remotely when the matter allows it. Deposition and trial testimony travels nationally.
- Boca Raton
- Delray Beach
- Fort Lauderdale
- West Palm Beach
- Miami
- Boynton Beach
ONE LABORATORY · BOCA RATON, FL · TESTIMONY TRAVELS NATIONALLY
FIG. 04 — SERVICE AREA · TRI-COUNTY + NATIONAL TESTIMONY
Asked in almost every intake.
NO. 1 How fast can you take a case?
Preservation starts the day you call — often the same hour for incident-response matters. The examination itself is scheduled once the evidence is secured, because the order matters: preserve first, analyse second.
NO. 2 Can you recover deleted messages and photos?
Often — but honestly: it depends on the device, the OS version, how long ago the deletion happened, and what has been done to the device since. That is why the first instruction in almost every case is the same: stop using the device and stop deleting things.
NO. 3 Will you testify — deposition and trial?
Yes. Forty depositions in the past four years, plus trial testimony. Every report is written expecting cross-examination: method stated alongside result, so the findings survive the witness stand.
NO. 4 Can you get into my spouse’s phone or accounts?
Not without lawful authority — consent of the owner or an order of a court. That is not a hedge; it is what keeps the evidence admissible and the examiner’s testimony intact. We will tell you what can be done lawfully in your situation.
NO. 5 What does an engagement cost?
Scoped at intake and put in writing before work begins. Preservation, examination and testimony are priced as separate phases, so you are never paying for trial preparation on a matter that settles at the evidence stage.
NO. 6 Do you work outside Florida?
Yes. Remote acquisition covers much of the country, testimony travels, and matters with a Brazilian or cross-border dimension are handled in-house — a capability very few US examiners offer.
The evidence already exists. The question is who preserves it first.
One confidential call. We will tell you what is recoverable, what it will take, and — when the honest answer is that we cannot help — we will tell you that too.
CONFIDENTIAL INTAKE NO OBLIGATION EN / PT / ES