The phone was seized and, weeks later, a report appears in the case file with screenshots of conversations, without a hash and without a record of who handled the device. Or the evidence the victim took to the police station is attacked for breaking the chain of custody.
CPP, arts. 158-A to 158-F (Brazilian Code of Criminal Procedure), applied to mobile phones, computers and screenshots, with what Brazil's Superior Court of Justice (STJ) has decided up to 2026.
Digital evidence rarely falls because of its content. It falls because of its path. The message may be genuine and yet nobody knows who opened the device, when and with what safeguards. The CPP describes that path in ten stages (CPP, art. 158-B). On a mobile phone, each stage has a technical equivalent: radio isolation, forensic image, hash, sealed media.
The STJ has decided a great deal, and not in a single direction. The 5th Panel excluded screenshots that the police took directly from the seized device. The Special Court held, in 2026, that a break requires concrete proof of tampering or prejudice.
The course teaches how to read the chain the way the expert reads it, link by link, and how to turn "a document was missing" into "there is a concrete risk of alteration", or to show that integrity has been demonstrated.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
A high-profile criminal investigation, with more than a dozen phones. The police inquiry and the official examination pointed to one person's involvement. The examination tested each correlation against alternative explanations, with everything recorded on sealed media. The links were false positives, and the person was cleared.
A person was accused of taking part in a robbery resulting in death (latrocínio). Before accepting the case, the expert read the entire police investigation file. The examination of the evidence showed that the accused had no connection with the crime.
A company found a mini computer hidden on its network. The report recorded what was lost: IT had handled the device, and collecting fingerprints became impossible.
The police investigation report contains screenshots of conversations from the co-defendant's phone, taken before the device was sent to the forensic institute. There is no tracking form and no hash.
In groups, participants receive the case of the phone browsed at the police station, with fictitious documents. Using the audit outline, they go through the ten stages of art. 158-B and separate documentary flaws from concrete risk. In 20 minutes, they deliver three applications and five expert questions. In the last 10 minutes, the instructor compares the answers with the answer key.
Laws and rulings discussed
CPP, arts. 158-A to 158-F (Brazilian Code of Criminal Procedure) · CPP, arts. 14, 155, 157, 159 §§ 3º to 6º, 182 and 563 · Law 13,964/2019, art. 20 (Anti-Crime Package) · STJ (Brazilian Superior Court of Justice), HC 653,515/RJ · STJ, AgRg in RHC 143,169/RJ, Case Law Bulletin 763 · STJ, AgRg in HC 828,054/RN · STJ, AgRg in HC 902,195/RS · STJ, Case Law Bulletin 838 · STJ, AgRg in HC 943,895/PR · STJ, AgRg in AREsp 2,967,267/SC · STJ, RHC 218,358/PI · STJ, AgRg in HC 1,014,212/ES · STJ, HC 1,054,038/SP, Case Law Bulletin Special Edition 33 · STJ, Inq 1,674/DF, Case Law Bulletin 891 · STJ, AgRg in Rcl 48,657/RS · STJ, RHC 99,735/SC · ISO/IEC 27037:2012
See also
Forensic Extraction from Mobile Phones and Devices → Judicial and Extrajudicial Expert Work → Method and Chain of Custody → See all courses →