Method and Chain of Custody

From first contact to post-report support, all documented

The six steps summarised on the home page are, in practice, a complete protocol. Below is what happens at each stage and what you receive at the end of each one.

Stage 01

Initial assessment of the case

A no-cost consultation to understand the nature of the dispute, the objectives and the available evidence. This is where the most important question is answered before any spending: does the argument have technical support? The assessment is frank both ways, including when the recommendation is not to run an examination. Cases with a procedural deadline approaching or an incident under way get priority in response.

Stage 02

Technical and commercial proposal

A formal document with scope, planned methodology, deadlines and fees, priced case by case: fixed fees, technical hourly rate or fees contingent on the outcome. The confidentiality agreement (NDA) is signed before any analysis, and the conflict of interest check happens at this stage. Nothing starts with a handshake: what will be done is put in writing before it is done.

Stage 03

Forensic collection and preservation

The heart of the chain of custody: receipt photographed and described, numbered seal, acquisition with write blockers and hardware duplication producing a bit-for-bit forensic image, with the hash calculated during the acquisition itself. Mobile devices are isolated from the network immediately. When the evidence sits in another city or country, assisted remote collection documents every step of the session.

Stage 04

Technical analysis in the laboratory

Every examination runs on the copy, never on the original, which waits in a certified vault room (ABNT NBR 15247 / EN 1047-2) with restricted access. Dedicated servers index and correlate the data; alternative hypotheses are tested and ruled out in writing; the limitations of the examination are stated before the conclusion. Recognised forensic tools, with the version recorded in the report.

Stage 05

Delivery of the expert report

The final instrument states the methodology, documents the chain of custody, answers the questions to the expert point by point and presents the conclusions in language the court follows without an interpreter. ICP-Brasil digital signature, delivery media finalised as read-only and a verification hash: either party can check the integrity of what it received.

Stage 06

Post-report support

The work does not end at filing: written clarifications, supplementary submissions, attendance at hearings and technical defence of the report against challenge. Whoever signs it defends every conclusion in person, before any instance where it is questioned.

The full history of every trace

Chain of custody is the traceable record of everything that happened to the evidence: who touched it, when, with which tool and for what purpose, from receipt to the outcome of the case. The concept entered Brazil's Code of Criminal Procedure (CPP) through Law 13,964/2019 (arts. 158-A to 158-F), and the courts apply it with growing rigour to digital evidence: material accessed before examination, with no hash and no seal, has been held unusable.

In laboratory practice, this takes the form of verifiable gestures: every interaction with the material has an author, date, time and purpose noted down; the examination runs on the forensic image authenticated by hash; the original stays sealed in the vault room; and the delivery media goes out read-only. Any forensic expert, including the one appointed by the opposing party, can retrace the path and reach the same verification.

It is this reproducibility that decides the fate of a report in court. The CPC, art. 479 (Brazilian Code of Civil Procedure) reminds us that the judge is not bound by the expert report; what persuades is the method demonstrated. And the fruit of the poisonous tree doctrine cuts the other way: evidence contaminated at source contaminates everything derived from it. Between those two threads, the chain of custody is what keeps the evidence standing.

ReceiptPhotographed and described, with a numbered seal and identifiers on record

AcquisitionWrite blocker + hardware duplication, hash calculated on the spot

ExaminationOn the copy only; alternative hypotheses tested, limitations stated

StorageCertified vault room, restricted access and continuous monitoring

DeliveryReport with ICP-Brasil, read-only media, verification hash

Audit trailEvery handling recorded: author, date, time and purpose

The chain of custody flow: from the seal to the vault room and the expert report

The standards behind every examination

National scope

ISO/IEC 27037Identification, collection, acquisition and preservation of digital evidence

ISO/IEC 27041Assurance of the suitability of investigative methods

ISO/IEC 27042Analysis and interpretation of digital evidence

ISO/IEC 27043Incident investigation principles and processes

CPP art. 158-AChain of custody in criminal proceedings (Law 13,964/2019)

CPC art. 156 et seq.Expert evidence in civil proceedings

Marco Civil / LGPDBrazil's internet framework and data protection act applied to digital evidence

NIST / SWGDETechnical references for forensic procedure adopted in Brazilian practice

International scope

GDPREuropean Union, in cases involving data of European subjects

eIDASElectronic signatures and identification in the European Union

PIPEDA / Law 25Canada, in local operations and disputes

CCPA / HIPAAUnited States, according to the sector of the case

LATAM data lawsArgentina, Chile, Uruguay, Paraguay and Mexico

ISO/IEC 27050e-Discovery in cross-border disputes

How international work is handled →