Ransomware Incident Reconstruction: What Digital Evidence Can Actually Prove
When files are encrypted, the encryption event is usually the most visible part of the incident—not the beginning of it. By that point, an attacker may already have obtained access, used legitimate credentials, moved between systems, staged data and prepared an extortion demand. The defensible question is therefore not simply when were the files encrypted? […]
Cryptocurrency Ownership Disputes Across Borders: What Evidence Should Be Preserved Before Assets Move?
When cryptocurrency is allegedly moved without authority, the visible transaction is often the easiest part to find. The harder questions are usually off-chain: who accessed the exchange account, which device or session was used, whether a withdrawal was authorised, who controlled the destination wallet, and whether the records offered to prove those points are complete […]
Cloud Timestamps Are Not Events: Reconstructing Chronology from Digital Evidence
A cloud evidence set may contain several timestamps for what appears to be the same file or object. One may describe when a provider processed a request. Another may have been supplied by a client device. A third may have been created when an export or collection tool wrote the file to local storage. A […]
Brazil’s Electronic Voting System: What Digital Evidence Can—and Cannot—Establish
For disputes involving electronic voting, the central question is not simply whether a vulnerability exists. It is whether the available evidence can establish that the vulnerability was exploitable in the relevant environment, actually exploited during an election, and capable of changing a declared result. Those are different propositions. Treating them as interchangeable weakens both technical […]
From On-Chain Activity to Defensible Identity Attribution
Blockchain activity can be highly visible without being personally identifiable. A public ledger may show the movement of assets, the addresses involved, the timing of transactions and interactions with contracts. It does not, by itself, establish who controlled an address or what a person intended. For litigation lawyers and investigations professionals, the central issue is […]
Computação quântica e criptoativos: o que pode ser comprometido — e o que a forense precisa preservar
A possibilidade de uma computação quântica criptograficamente relevante, ou CRQC, introduz uma questão técnica que pode assumir importância em litígios, investigações patrimoniais e incidentes envolvendo ativos digitais: se uma assinatura ou uma chave for comprometida, o que exatamente isso permite concluir sobre autenticidade, controle e movimentação de ativos? A resposta depende de uma distinção fundamental. […]
What Non-Native Digital Artefacts Can—and Cannot—Establish
Screenshots, forwarded messages, PDFs, copied files and platform downloads often arrive in a case before the original device, native file or complete metadata is available. They may appear clear and persuasive. The practical question is what the artefact can reliably establish, what it cannot establish on its own, and what further acquisition or corroboration may […]
How to track cryptocurrencies and identify transaction beneficiaries.
First of all, it is necessary to understand what cryptocurrencies are. They are encrypted digital currencies to ensure their security, created through a process called mining, where users provide processing power to solve complex algorithms. The most popular cryptocurrencies include Bitcoin, Ethereum, and Litecoin. Why track cryptocurrency transactions?Tracking cryptocurrency transactions is important for several reasons, […]
