Peritia

Digital Forensics Expert Witness · Web2 & Web3

We don't opine.
We prove it.

A digital forensics firm. We reconstruct what happened and prove it with evidence that withstands cross-examination in court — from a WhatsApp chat to a smart-contract exploit.

An expert report is worth not what it claims, but what it can prove. Every conclusion rests on evidence acquired methodically, sealed with a hash and defensible against the opposing party's expert.

SHA-256CHAIN OF CUSTODYISO 27037:2016 · UNE 197001:2019
Request a consultationSee methodology
record a1f9c34e77b0 · sealed ✓
Technical background

Verifiable security research. Expert-witness practice started in 2026.

EX-01
Vulnerability reported to NASA
public acknowledgment in its disclosure programme
EX-02
Assigned and published CVEs
vulnerabilities with public record
EX-03
Vulnerability in a Web3 protocol
smart contract in production
EX-04
20 years in systems & security
sysadmin · DevOps · leadership
EX-05
Solana security analysis
smart contracts · Rust

Reports are produced in accordance with UNE 197001:2019 and UNE 197010:2015, with acquisition and custody following UNE-EN ISO/IEC 27037:2016.

// Laboratory

Most tools flag.
We prove it.

A lead doesn't win a trial. The difference between an expert report that holds and one that collapses is method: acquisition without altering the original, integrity verified by hash, and a chain of custody that documents every step.

We always work on a forensic copy. The original is preserved intact; the analysis is reproducible; and the conclusion arrives with evidence anyone can verify.

custody.log
# forensic acquisition
device   Galaxy S23 · Android 14
method   bit-for-bit copy (dd) · write-block
sha256   9f2b…a1f9c34e77b0
match    ✓ source == copy
# chain of custody
sealed   2026-07-31T02:14Z
status   ✓ intact · admissible
Services · Catalogue

Two worlds. The same standard of proof.

From the everyday digital evidence of a lawsuit to the reconstruction of an exploit on blockchain. Every service ends in an expert report compliant with procedural law, defensible in court.

W2 Web2 Forensics
The digital evidence of everyday litigation —employment, commercial and criminal—: what decides dismissals, fraud, unfair competition and defamation.
WhatsApp & messaging certificationExtraction from the source device —not screenshots—, integrity verification and proof of authorship, date and immutability in line with Supreme Court doctrine.
W2·01
Email · phishing / BECHeader and SPF/DKIM/DMARC authentication analysis, tracing of the message's real origin and reconstruction of CEO fraud or identity spoofing.
W2·02
Device forensicsAcquisition with a write-blocker, recovery of deleted data and files, and reconstruction of the device's activity timeline.
W2·03
Ransomware & incidentsFull intrusion chain: entry vector, attacker family and TTPs, extent of encryption and detection of data exfiltration.
W2·04
Cloud forensics · AWSAnalysis of CloudTrail, VPC Flow Logs and GuardDuty to reconstruct access, privilege escalation and persistence in the cloud.
W2·05
Counter-expertise & challenging digital evidenceCritical review of the opposing report: acquisition methodology, integrity and chain of custody, reproducibility of the analysis and whether the conclusions follow from the data. The Spanish Supreme Court does not accept a generic challenge: it requires concrete, objective indications of tampering (STS 332/2019; STS 603/2025), and substantiating those requires technical grounds.
W2·06
W3 Web3 / Blockchain Forensics
Crimes and disputes over blockchain: crypto scams, exploited protocols and digital assets. A field that requires reading the code and the chain, not just an account statement.
Cryptocurrency tracingMulti-chain on-chain tracking, address-cluster analysis and de-anonymisation through mixers, bridges and exchanges to the funds' exit point.
W3·01
Tracing of funds in crypto fraudOn-chain tracing report: reconstruction of the funds' route, identification of the destination crypto-asset service provider and preservation of the evidence with chain of custody. It gives your lawyer the technical basis to support a criminal complaint and to request the court order the appropriate measures (art. 127 octies Spanish Criminal Code; arts. 589, 597 and 764 LECrim). We do not handle funds and we do not promise their recovery: that depends on the judicial procedure and is not always possible.
W3·02
Smart-contract forensicsTechnical reconstruction of the exploit, replay of the attack on a mainnet fork and exact quantification of the damage.
W3·03
Wallet drainers · pig butcheringAnalysis of the scam scheme, the malicious signatures approved by the victim and full tracing of the operation.
W3·04
NFT · DeFi · protocolsExpertise on protocol logic, price oracles and the business mechanics in dispute.
W3·05
Method · UNE-EN ISO/IEC 27037:2016 · UNE 197001:2019

Proof is built in order. Or it collapses.

A broken chain of custody allows evidence to be successfully challenged even when its content is true: if it cannot be shown that the evidence has not been altered since it was obtained, the court cannot rely on it. This is the process that holds it up.

PHASE 01
Identification
Delimiting the relevant devices and evidence sources, documenting their state without altering them.
PHASE 02
Acquisition
Bit-for-bit forensic copy with write-blocking and SHA-256 of source and copy, which must match.
PHASE 03
Preservation
Chain of custody documented end to end —who, what, when and how— with time-stamping.
PHASE 04
Analysis
Work on the copy, with a reproducible method: the same data and tools lead to the same result.
PHASE 05
Report
Expert report compliant with UNE 197001:2019: object, scope, methodology, analysis and conclusions, understandable to the judge.
PHASE 06
Ratification
Defence of the report in court, responding to cross-examination by the opposing expert and counsel.
For law firms

Your case needs proof that withstands the opposing expert.

We work with lawyers from minute one, before touching a single byte. Evidence acquired badly —a screenshot, a dump without a hash, an undocumented custody— is challenged and collapses, however true it is.

We collect it methodically, seal it and defend it in court. And if the proof is against you, we tell you before the judge does.

Discuss a case
“An expert witness does not defend a party: he answers a technical question under oath of objectivity.”
— art. 335.2 LEC. That is why the work starts before the report.
Contact

Do you have a case with bits involved?

Confidential initial consultation, no commitment. Tell us the case and we'll say frankly whether there's evidence to obtain and how.

Same-day response · live chat (coming soon)