Peritia
Digital Forensics · Web2 & Web3

We don't opine.
We prove it.

A digital forensics firm. We reconstruct what happened and prove it with evidence that withstands cross-examination in court — from a WhatsApp chat to a smart-contract exploit.

An expert report is worth not what it claims, but what it can prove. Every conclusion rests on evidence acquired methodically, sealed with a hash and defensible against the opposing party's expert.

SHA-256CHAIN OF CUSTODYISO 27037 · UNE 197001
record a1f9c34e77b0 · sealed ✓
Accreditation · Exhibits

Verifiable technical authority. Real offensive-security research, not credentials.

EX-01
Recognised by NASA
vulnerability reported · official acknowledgment
EX-02
Published official CVEs
vulnerabilities with public record
EX-03
Vulnerability in a Web3 protocol
smart contract in production
EX-04
20 years in systems & security
sysadmin · DevOps · leadership
EX-05
Solana security · audit-ready
smart contracts · Rust
// Laboratory

Most tools flag.
We prove it.

A lead doesn't win a trial. The difference between an expert report that holds and one that collapses is method: acquisition without altering the original, integrity verified by hash, and a chain of custody that documents every step.

We always work on a forensic copy. The original is preserved intact; the analysis is reproducible; and the conclusion arrives with evidence anyone can verify.

custody.log
# forensic acquisition
device   Galaxy S23 · Android 14
method   bit-for-bit copy (dd) · write-block
sha256   9f2b…a1f9c34e77b0
match    ✓ source == copy
# chain of custody
sealed   2026-07-31T02:14Z
status   ✓ intact · admissible
Services · Catalogue

Two worlds. The same standard of proof.

From the everyday digital evidence of a lawsuit to the reconstruction of an exploit on blockchain. Every service ends in an expert report compliant with procedural law, defensible in court.

W2 Web2 Forensics
The digital evidence of everyday litigation —employment, commercial and criminal—: what decides dismissals, fraud, unfair competition and defamation.
WhatsApp & messaging certificationExtraction from the source device —not screenshots—, integrity verification and proof of authorship, date and immutability in line with Supreme Court doctrine.
W2·01
Email · phishing / BECHeader and SPF/DKIM/DMARC authentication analysis, tracing of the message's real origin and reconstruction of CEO fraud or identity spoofing.
W2·02
Device forensicsAcquisition with a write-blocker, recovery of deleted data and files, and reconstruction of the device's activity timeline.
W2·03
Ransomware & incidentsFull intrusion chain: entry vector, attacker family and TTPs, extent of encryption and detection of data exfiltration.
W2·04
Cloud forensics · AWSAnalysis of CloudTrail, VPC Flow Logs and GuardDuty to reconstruct access, privilege escalation and persistence in the cloud.
W2·05
Counter-expertise & challengeCritical review of the opposing party's report: methodological flaws, broken chain of custody and unfounded conclusions.
W2·06
W3 Web3 / Blockchain Forensics
Crimes and disputes over blockchain: crypto scams, exploited protocols and digital assets. The terrain almost no expert masters with technical rigour.
Cryptocurrency tracingMulti-chain on-chain tracking, address-cluster analysis and de-anonymisation through mixers, bridges and exchanges to the funds' exit point.
W3·01
Fund recovery · scamsIdentification of the funds' flow and destination exchange, with a supporting report for the judicial freezing request under the MiCA framework.
W3·02
Smart-contract forensicsTechnical reconstruction of the exploit, replay of the attack on a mainnet fork and exact quantification of the damage.
W3·03
Wallet drainers · pig butcheringAnalysis of the scam scheme, the malicious signatures approved by the victim and full tracing of the operation.
W3·04
NFT · DeFi · protocolsExpertise on protocol logic, price oracles and the business mechanics in dispute.
W3·05
Method · ISO/IEC 27037 · UNE 197001

Proof is built in order. Or it collapses.

A broken chain of custody is the #1 reason digital evidence, even when true, ends up inadmissible. This is the process that holds it up.

PHASE 01
Identification
Delimiting the relevant devices and evidence sources, documenting their state without altering them.
PHASE 02
Acquisition
Bit-for-bit forensic copy with write-blocking and SHA-256 of source and copy, which must match.
PHASE 03
Preservation
Chain of custody documented end to end —who, what, when and how— with time-stamping.
PHASE 04
Analysis
Work on the copy, with a reproducible method: the same data and tools lead to the same result.
PHASE 05
Report
Expert report compliant with UNE 197001: object, scope, methodology, analysis and conclusions, understandable to the judge.
PHASE 06
Ratification
Defence of the report in court, responding to cross-examination by the opposing expert and counsel.
For law firms

Your case needs proof that withstands the opposing expert.

We work with lawyers from minute one, before touching a single byte. Evidence acquired badly —a screenshot, a dump without a hash, an undocumented custody— is challenged and collapses, however true it is.

We collect it methodically, seal it and defend it in court. And if the proof is against you, we tell you before the judge does.

“A broken chain of custody is the #1 killer of digital evidence.”
— that's why the work starts before the report.
Contact

Do you have a case with bits involved?

Confidential initial consultation, no commitment. Tell us the case and we'll say frankly whether there's evidence to obtain and how.

Same-day response · live chat (coming soon)