Forensic Laboratory · VALLIM Perícias

Computer forensics and data recovery

This is the unit that receives computers, servers, mobile phones and media of every kind. Acquisition runs on write blockers and forensic duplication hardware of international standing, able to process up to 7 NVMe and 4 SATA/SAS units simultaneously at the source: the original media is read without a single bit being written to it, and the forensic image is created already authenticated by a hash computed during the acquisition itself.

For damaged media, the unit keeps a clean room with a laminar flow cabinet, where drives are opened for read head replacement and component transplant from donor units, in the controlled environment this kind of intervention demands. Dedicated analysis servers, separate from the acquisition workstations, index and correlate large volumes of data to reveal links and identify every trace.

After collection and forensic indexing, the media holding the preserved copy wait in a vault room compliant with ABNT NBR 15247 / EN 1047-2 until the case is closed, with restricted access and continuous monitoring.

Mobile devices have their own handling: the device is isolated from the network the moment it arrives, preventing remote wiping and content alteration, and the extraction is carried out by someone who knows in depth the complexity of this kind of analysis, from the system lock to the recovery of application data. The audio, the conversation or the photo that matters to the case leaves the device with a hash, a link to the device and chain of custody, not from the forward that survived in the family group.

The unit also receives the material that others gave up for lost: media with electronic failure, drives that will not mount, deleted files. Recovery runs with the same discipline as the rest of the laboratory, because data recovered without method becomes a file; recovered with method, it becomes evidence.

Clean Room I: read head replacement with a donor unit

DATA LAB · Clean Room IHead replacement · donor unit

Clean Room II: laminar flow cabinet and precision bench

DATA LAB · Clean Room IILaminar flow cabinet

Documents and signatures, physical and digital

The questioned document examination unit examines the physical document in every layer: the stroke of the signature, the inks, the printing, the substrate. Specialised optical instruments read what the eye cannot reach: stroke pressure, ink crossings, the order of entries, retouching and erasures, under magnification and directed lighting that reveal alterations invisible to ordinary light.

It is also the home of forensic handwriting comparison: the analysis of writing exemplars against the questioned document, under the four requirements that define a serious examination (authenticity, contemporaneity, suitability and quantity of the exemplars). And, on the border with the digital world, the Doc Lab works together with the Data Lab on the examination of documents that were born electronic: PDFs, metadata, signatures captured on screen.

Each light source answers a different question. Ultraviolet light at 365 nm reveals fluorescence in the paper and the inks and the halos left by a chemical wash; infrared distinguishes inks that look identical to the naked eye and reads what lies under obliterations; transmitted light exposes watermarks, insertions and splices; and grazing light, almost parallel to the paper, brings out pressure grooves and reliefs invisible under frontal lighting, as the record alongside shows.

The ESDA, an electrostatic detection apparatus for indentations, goes beyond what light reaches: it recovers the compressed writing impressed on the sheets below the document, even when no groove is visible. What was written on a pad remains legible pages later, and more than one fraud has come undone exactly there.

The examination is completed by measurement: a paper thickness micrometer, forensic millimetre scales and calibrated photomicrography, the record that illustrates the expert report and lets the judge check, with their own eyes, each finding described.

OpticsMicroscopy and magnification to examine stroke, ink and substrate

LightingDirected and oblique light revealing grooves, retouching and alterations

ComparisonAuthentic, contemporary exemplars against the questioned document

Digital bridgeElectronic documents examined together with the Data Lab

Document examination bench: trinocular microscope with camera and monitor, directed lighting and ESDA

DOC LAB · Optical examination and ESDADirected and oblique light

Latent writing revealed by grazing light: the groove of an inkless pen on paper

DOC LAB · Latent writingGrazing light

Forensic phonetics and audiovisual examination

The audio unit conducts forensic speaker comparison, the authenticity examination of recordings and the analysis of audiovisual content, including the detection of synthetic voice and video generated by artificial intelligence. The work combines the perceptual analysis of the trained forensic expert with instrumental acoustic analysis, following the practice recommended by the IAFPA and by the ENFSI Best Practice Manual.

Voice exemplar collection follows a directed protocol, in a controlled environment, combining reading and spontaneous speech, over a channel compatible with the questioned recording whenever possible. And the yardstick of honesty that runs through the whole laboratory applies here too: exclusion may be categorical; positive identification is always graded, to the exact extent the technique allows anyone to state.

The analysis station works in an acoustically treated room, with reference monitoring and spectral examination conducted on screen: spectrograms, formants, fundamental frequency and the physiological microvariations no impersonator controls. When the material allows, automatic comparison systems complement the analysis, always under human interpretation: the machine computes, the forensic expert concludes.

Before any comparison, the origin of the audio matters: whenever possible, the unit extracts the original recording straight from the device, together with the Data Lab, before the applications recompress it. Intelligibility enhancement, when applied, recovers what the recording contains and never creates content, with every intervention documented in the expert report.

SpeakerPerceptual and acoustic comparison against a standard collected by protocol

AuthenticityCuts, splices, recompression and traces of AI fabrication

AudiovisualVideo, image, CCTV and photogrammetry with international methodology

TranscriptFaithful forensic transcription, with unintelligible passages declared

Forensic audio analysis station: spectrograms under analysis and capture in a treated room

AUDIO AND VOICE · Spectral analysisTreated room

What protects your case while it is here

Access

Controlled environment

Units with restricted access and continuous monitoring. Case material does not circulate: it comes in sealed, stays tracked and leaves documented.

Custody

Certified vault room

Originals kept in compliance with ABNT NBR 15247 / EN 1047-2 until the case is closed, with a trail of every handling: who, date, time and purpose.

Secrecy

Confidentiality in writing

NDA before any analysis, LGPD (Brazil's data protection act) applied to the expert work itself and professional secrecy kept even after the contract ends.

Own facilities, controlled environment