The complaint came in on Friday. By Monday, IT had already opened the computer "just to take a look", and the evidence that would have supported the dismissal ended up supporting its reversal.
Where digital evidence gets lost, and how to preserve it and bring it into civil, employment and commercial proceedings.
Digital evidence is rarely lost in court. It is lost in the first hours: IT switches the machine on, the client deletes, someone photographs only the part that matters, the audio is forwarded through an app.
When the other side challenges it, the debate turns to how the evidence got there. Once a digital photo or a printed message is challenged, the CPC (Brazilian Code of Civil Procedure) requires the electronic authentication to be produced or an expert examination to be carried out (CPC, art. 422, § 1º and § 3º).
Adriano Vallim, Forensic Expert and Digital Crime Specialist, uses cases from the laboratory to show which instructions to give on the first day and which technical document to request at each stage.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
IT spent days examining the computer of a suspended director and found improper access. In the employment lawsuit, the forensic examination showed that the access took place after the computer was handed to IT. The dismissal for cause was reversed.
The laptop of an employee under suspicion was preserved covertly before the employee was suspended. When it was returned, the disk had been zeroed. The examination demonstrated deliberate deletion, and the earlier preservation secured the content.
To have a public tender annulled, the third-placed bidder filed digital evidence of fraud. The examination showed that it had been produced with a tampered browser; the metadata pointed to who created it.
The official conclusion pointed to one person's involvement. Tested against alternative explanations, the correlations were false positives, and the person was cleared.
In groups, participants receive an illustrative example: the PDF of a contract was allegedly altered after it was signed. The file is in the director's email, the negotiation is on WhatsApp, and the server overwrites versions every month. In 12 minutes, each group delivers the map of sources, the first-day instructions and the technical document to request.
Laws and rulings discussed
CPC, art. 381 (Brazilian Code of Civil Procedure) · CPC, art. 382 · CPC, art. 384 · CPC, art. 422, caput, § 1º and § 3º · CPC, art. 429, II · CPC, art. 479 · Marco Civil da Internet (Law 12,965/2014, Brazilian Internet Framework), arts. 13 and 15 · CPP, arts. 158-A to 158-F (Brazilian Code of Criminal Procedure) · STJ (Brazilian Superior Court of Justice), Case Law Bulletin 838, 5th Panel, decided 10 December 2024, sealed case · STJ, news release of 3 June 2026, Jurisprudência em Teses, issue 281
See also
Method and Chain of Custody → Computer Forensics and Digital Investigation → Anti-Forensics and Destroyed Evidence → Judicial and Extrajudicial Expert Work → See all courses →