Almost every dispute today turns on a signature, a conversation, a file or a system record. This page shows, area by area, where forensic examination enters and what it answers for the lawyer.
The theory of a banking case looks nothing like that of a probate dispute or an arbitration. The evidence, more and more, looks alike: e-mails, messages, audio, access logs, contracts signed on a phone, receipts and paper documents.
The CPC, the Brazilian Code of Civil Procedure, requires the judge to be assisted by an expert whenever proof of a fact depends on technical knowledge (CPC, art. 156). The lawyer's first question is simple: is there a fact in this case that only a technical examination can demonstrate? Who signed, who sent, when the file was created, whether it was altered, what happened inside the system.
The method does not change from one area to another: preservation before any analysis, examination on the copy, hash, chain of custody and an expert report that another expert can reproduce. What changes is the reading. The examination is planned from the theory and the strategy of the case, to answer what the case needs to prove.
The legal characterisation of the facts remains with the lawyer and the court. The forensic examination delivers the facts demonstrated.
Party-appointed expert work, expert questions, challenges to expert reports and dissenting technical opinions in any dispute involving technical evidence. In arbitration, work as expert appointed by the arbitral tribunal or as party-appointed expert.
Learn more BankingFraud through Pix and APIs, money-mule accounts, intrusion with insider participation, loans with disputed signatures and digital onboarding by selfie and biometrics. The examination also supports filings and technical reports to the Banco Central do Brasil and the CVM.
Learn more LGPDWhat leaked, from how many data subjects and since when. Support for the incident notification to the ANPD, an expert report for the follow-up filing, and examination of what websites and apps collect through cookies, tags and scripts.
Learn more ComplianceForensic collection of corporate e-mail, computers and phones that survives the later lawsuit. The mistake that most often brings an investigation down is the company's IT department examining the equipment before the forensic expert.
Learn more LabourInternal fraud by an employee, copying of confidential data before leaving, and dismissal for cause grounded in an expert report, so that the decision is not overturned. Also screenshots and audio of disputed authenticity.
Learn more FamilyWills, gifts, powers of attorney and receipts with disputed signatures, including those of elderly or ill persons. Conversations and audio in divorce and custody, and phones monitored without authorisation.
Learn more TechnologySoftware contracts and projects, preservation of a page or profile before it disappears, authorship of anonymous profiles and the technical grounds for a request to disclose subscriber data.
Learn more IPCode, product, customer base or documentation taken by a former partner, former executive or competitor. The examination demonstrates origin, copying and priority with dated evidence.
Learn more InsuranceCause, extent and date of the incident for the adjustment of a cyber claim. Before the incident, assessment of the controls the insurer will require. Also claim photos and documents suspected of editing.
Learn more CADEE-mails and messages delivered with chain of custody in leniency agreements, technical monitoring of the copy made during dawn raids and counter-evidence on the seized material.
Learn more CorporateMinutes, powers of attorney and amendments to articles with disputed signatures, partners who leave taking data, screening of executives' e-mail and devices before a merger, and earn-out disputes with evidence in systems.
Learn more DeepfakeVoice or image generated by artificial intelligence, doctored video, fake profiles and content leaked before release. The examination tests authenticity and opens the way to identifying authorship.
Learn more ProcurementBids with the same author in the metadata, forged evidence to annul a tender, disputed certificates of technical capacity, and toll, measurement and billing systems in disputes over the economic balance of the contract.
Learn moreReal estate fraud still runs largely on paper: deeds, powers of attorney, purchase agreements and receipts with disputed signatures, sales by someone who is not the owner, and signatures by proxy or by elderly persons in the transfer of property. In condominiums come camera footage, messages in residents' groups and virtual assemblies.
The examinations are in the units for Forensic Handwriting and Questioned Document Examination, Signature by Proxy, Documents and Typescript Examination, Audiovisual Forensics: Video and Image and WhatsApp and Chat Examination.
Challenge. An elderly woman claimed to have bought, in instalments, a house that had entered the estate of its former owner. The deceased's daughter said her father had never sold the property and that the woman was only a tenant. As proof of purchase, the woman produced signed receipts and proof of payment of the instalments.
Method. Forensic handwriting examination of the signatures on the receipts, compared with known specimens of the deceased, and document examination of the payment records that stated the amounts paid.
Outcome. The signatures on the receipts were indeed the deceased's. The payment records used to demonstrate the instalments on the house, however, were forged. The examination separated the genuine document from the forged one, and each came to count for what it really was.
Calculations and accounting examinations remain with a partner forensic accountant. What belongs here is the technical side: the integrity of electronic tax documents and of the systems that generate them.
The most frequent examination is of an ERP altered directly in the database, bypassing the application's processes. The screen shows the new data, but the alteration can leave traces in the database and system records. Also within scope are forged invoices and digital documents, NF-e XML files of disputed authenticity, digital certificates used by third parties, and technical monitoring of data copying during tax search and seizure.
The judicial administrator, the creditors and the company itself need facts: what existed, where it went and whether the documents are from the date they show. The accounting side remains with a partner forensic accountant. Digital forensics helps when it is necessary to:
The examinations are in Anti-Forensics and Destroyed Evidence, Forensic Data Recovery and Digital Questioned Document Examination.
The forensic examination also serves, case by case:
See also
For Lawyers → Judicial and Extrajudicial Expert Work → Expert Reports and Opinions → Representative Cases → Method and Chain of Custody →