We recover data, trace crypto and prove it in court.
Digital forensics, data recovery and incident investigation for companies, law firms, authorities and individuals in any country. Core specialty: crypto forensics and ransomware rescue, with a documented chain of custody from first contact to expert report.
[report] Questions answered · explicit degree of certainty · PT · EN · ES
24/7Ransomware and incident response
10Forensic service lines
SHA-256Integrity hash at every phase
3Expert report languages
Core Specialties
Crypto and ransomware: where digital evidence decides the case
Two areas where speed and technical rigour make the difference between losing everything and recovering, proving and holding someone accountable.
Crypto forensics
We trace blockchain transactions, identify the wallets and exchanges involved and turn the trail into admissible evidence.
I was scammed with cryptocurrency. Can anything be done?
Yes. We trace the funds to the destination wallets and exchanges and prepare the documentation for freezes, complaints and legal action.
I need to prove that I hold or held certain assets.
We issue proof-of-custody and source-of-funds reports for tax, banking or residency purposes.
I lost access to a wallet or a seed phrase.
We examine devices, backups and wallets to recover access whenever it is technically possible.
I deleted the wallet or the files holding the keys. Is everything lost?
Often not. Deleted files stay on the disk until they are overwritten. We recover wallets, keys and histories from the forensic image, without touching the original.
We contain the attack, identify the variant, recover the data and preserve the evidence for insurers, regulators and courts.
My systems have been encrypted. What do I do first?
Do not power off or reinstall anything. Contact us: we isolate the environment, preserve the evidence and assess the recovery options.
Can data be recovered without paying the ransom?
Often yes, from backups, flaws in the encryption or known keys. We assess each variant before any decision is taken.
I need to report the incident to regulators or my insurer.
We document the timeline, the entry vector and the affected data in the format GDPR, NIS2 and insurance policies require.
The attacker deleted files and backups. Can they still be recovered?
In many cases, yes. Deleted files remain on the disk until they are overwritten and are recovered from the forensic image while the evidence of the attack is preserved.
From recovering a damaged drive to testifying in court, DolutechAI performs every case with a certified team and its own laboratories in Europe and the United States.
Data Recovery
Hard drives, SSDs, RAID, servers and physically damaged media, plus deleted files that are still on the disk, recovered in a clean-room laboratory.
Device Forensic Analysis
Extraction and examination of computers, smartphones, tablets and messaging apps, with a report ready for the case file.
Crypto Forensics
Transaction tracing, identification of wallets and exchanges, and proof of custody of digital assets.
Expert Witness in Court
Technical opinions, answers to the parties’ questions and testimony at hearings, in plain language for judges and lawyers.
Source Code Forensics
Code comparison, authorship, software plagiarism and verification of what was actually delivered.
Data Leak and Espionage
Investigation of intentional leaks, insider misuse of access and industrial espionage.
Deepfake Forensics
Authenticity verification of video, audio and images and detection of AI manipulation.
Certified Data Destruction
Secure media sanitisation under NIST 800-88, with a certificate of destruction.
Electromagnetic Sweep (TSCM)
Detection of bugs, hidden cameras and tracking devices in offices, vehicles and homes.
Ransomware Rescue
Containment, variant identification, data recovery and preservation of the attack evidence.
Real Cases
Situations where digital forensics changes the outcome
Five common problems and how technical evidence resolves them.
01
Financial fraud
Transfers, payments or investments diverted through scams, phishing or unauthorised account access.
How we help
We reconstruct the flow of funds, identify who was involved and deliver the evidence ready for the complaint and for the bank.
02
Poorly signed contracts
Disputed digital signatures, documents altered after signing or contested proof of sending and receipt.
How we help
We analyse metadata, certificates and delivery logs to establish who signed, when and what was changed.
03
Proof of crypto custody for tax residency
Tax authorities or banks demand proof of the origin and ownership of digital assets.
How we help
We issue a proof-of-custody report with on-chain history, wallet ownership and source of funds.
04
Intellectual property disputes
Code, designs or databases copied by former employees, competitors or suppliers.
How we help
We compare versions, rebuild the timeline and prove authorship and copying with technical evidence.
05
Delivery that does not match the contract
Software or systems delivered without the features, quality or security that were contracted.
How we help
We examine what was delivered against what was agreed and substantiate the opinion for negotiation or litigation.
How We Work
The evidence reaches the case exactly as it left your hands
Every phase produces a dated record and a verification hash. Nothing is analysed on the original.
01
Intake and sealing
Delivery record, photographic log and numbered seal. For remote cases, guided and signed collection.
02
Forensic image
Bit-for-bit copy with a write blocker and SHA-256 hash of the original and the copy.
03
Analysis
Always on the copy, with validated tools and a documented methodology.
04
Expert report
Answers to the questions, with attached evidence and an explicit degree of certainty.
05
Delivery
Sealed return of the media and availability to testify at the hearing.
In active incidents, containment comes before formal intake, without ever compromising the preservation of evidence.
Deliverable
What you receive: an expert report that withstands cross-examination
Written for decision makers, with the technical depth the case requires.
digital-forensics-expert-reportPDF · DOCX
Identification of the case, the requester and the experts
Questions and scope of the examination
Methodology, tools and standards applied
Chain of custody with hashes and dated records
Findings with attached, reproducible evidence
Conclusions with an explicit degree of certainty
Plain-language summary for decision makers
Annexes: images, logs, on-chain extracts and screenshots
Court-ready
Structured to be filed with the case and defended at the hearing by the experts who sign it.
In three languages
Portuguese, English or Spanish, with the legal terminology appropriate to the jurisdiction of the case.
Explained to decision makers
A clear summary for judges, lawyers, executives and insurers, without losing technical rigour.
Who It Is For
Public entities and private clients
The same methodology and the same confidentiality, adapted to the context of each requester.
Public entities and authorities
Independent forensics for criminal investigation, supervision and public administration.
Prosecutors and courts
Law enforcement agencies
Central and local public administration
Regulators and supervisory bodies
Examination of seized media and technical support to investigations
Companies, lawyers and individuals
Technical evidence for litigation, incidents, audits and business decisions.
Victims of crypto scams and theft
Law firms and legal departments
Companies hit by ransomware or data leaks
Insurers and cyber claims adjusters
Accountants, tax advisors and family offices
Individuals with damaged devices or lost data
Commitments and Certifications
Impartiality, confidentiality and integrity of evidence
The principles that govern every case, from first contact to the last hearing.
Impartiality
Technical examinations, substantiated conclusions and an explicit degree of certainty, even when the result does not favour the requester.
Confidentiality
Non-disclosure agreement, restricted-access laboratories and data processing under the GDPR.
Integrity of evidence
Documented chain of custody and hash verification at every phase, with a dated record of each action.
Availability
24/7 response to active incidents and experts available to testify at hearings.
Certified team
Experts holding EXIN ISMP (ISO/IEC 27001) and EXIN PDP data protection certifications, with a methodology aligned with ISO/IEC 27037.
No conflict of interest
We check for conflicts before accepting each case and decline when independence cannot be guaranteed.
Frequently Asked Questions
Digital Forensics FAQ
What is crypto forensics?
It is the technical analysis of blockchain transactions to trace funds, identify wallets and exchanges and produce admissible evidence. We use it in scams, thefts, ownership disputes and proof of custody for tax purposes.
Can stolen cryptocurrency be recovered?
Not always, but it is often possible to trace the funds to an exchange or a service that cooperates with authorities. We prepare the technical documentation for freeze requests, complaints and legal action, and we tell you frankly what the odds are in your case.
I have been hit by ransomware. What should I do first?
Do not power off, do not reinstall and do not pay before talking to us. We isolate the environment, preserve the evidence, identify the variant and assess the recovery options, including backups and known decryptors.
Are the expert reports valid in court?
The reports follow a documented methodology with a chain of custody and a hash at every phase, and are signed by experts available to testify. They have been used in proceedings in Portugal, Spain, Brazil and the United States. Final admissibility always depends on the court and the jurisdiction, so we work together with your lawyer.
Do you act as expert witnesses at hearings?
Yes. We testify at hearings, answer the parties’ questions and explain the technical evidence in plain language, in person or by video conference.
What is the chain of custody and why does it matter?
It is the documented record of who had access to the evidence, when and what they did. Without it, the other party can claim the evidence was altered. Every phase of our process produces a dated record and a verification hash.
Which devices and media do you examine?
Computers, servers, hard drives and SSDs, RAID, smartphones and tablets, USB sticks and memory cards, CCTV and DVR recorders, hardware wallets and exchange accounts. Physically damaged media are handled in a clean room.
Do you work remotely and in other countries?
Yes. Most crypto forensics, ransomware response and code analysis is done remotely. When physical media must be examined, we arrange sealed collection or shipment to our nearest laboratory, in Europe or the United States.
How long does it take and how much does it cost?
It depends on the type of evidence, the volume of data and the urgency. Active incidents receive an immediate response. After the initial conversation we present a fixed quote, with no obligation, and deadlines defined per phase.
How do you guarantee confidentiality?
Every case is governed by a non-disclosure agreement. The laboratories have restricted access, data is processed under the GDPR and is destroyed or returned in a certified manner at the end of the case.
Digital Forensics · Chain of Custody
Every case starts with a confidential conversation.
Tell us what happened. We will tell you what can be recovered, proven and presented.
