Digital forensics · Evidence certification
Digital evidence certification for court
We extract the evidence directly from the device or the source, calculate its digital fingerprint (hash) and deliver it in an expert report that a lawyer can file in the proceedings as it stands. ISO/IEC 27037-certified laboratory in Elche and court expert no. 02714.
- Cellebrite UFED
- ISO/IEC 27037
- Expert no. 02714
- Elche · Alicante · all of Spain
Updated on 27 September 2026
What we certify
One page per type of evidence
Each type of evidence is extracted, preserved and certified differently. Choose yours.
Complete conversations with voice notes and images, extracted from the phone, not screenshotted.
View page No-obligation quote EmailHeaders, SPF/DKIM, origin tracing and spoofing detection.
View page No-obligation quote Mobile phoneFull extraction of the phone: messages, calls, photos, locations and deleted data.
View page No-obligation quote Hard drives and computersCloning with a write blocker, recovery of deleted files and an activity timeline.
View page No-obligation quote Social media and websitesPosts, profiles, ads, reviews and online shops, with a verifiable date.
View page No-obligation quote Audio and voice notesOriginals with metadata and hash; signs of cuts or splicing.
View page No-obligation quote Photos and documentsAuthorship, creation and modification dates, signs of tampering.
View page Another kind of evidence? Tell us what it is and we will tell you whether it can be certified. Ask usWhy certify
A screenshot gets challenged. A forensic extraction does not.
A screenshot shows what is on the screen, with no metadata and no way of proving it has not been edited. Certification extracts the original, seals it with a SHA-256 hash and documents each step in a signed record: if the other side challenges it, the expert explains it and confirms it in court.
- Extraction of the original, not of a copy or a screenshot
- SHA-256 hash of each item, proving that nothing has changed
- Acquisition record with date, method and tool
- Chain of custody to ISO/IEC 27037, through to trial
Common cases
When our clients need it
- Family proceedings: custody, maintenance, breaches of court orders
- Dismissals and workplace harassment
- Threats, defamation and online harassment
- Scams via WhatsApp, Bizum or email
- Claims against suppliers and customers
- Counter-expert report on evidence submitted by the other side
Exhibit · In-house software
A chain of custody nobody can rewrite
Exhibit is the software we built in our laboratory to keep custody of every piece of evidence. Every receipt, acquisition or transfer is recorded as a hash-chained event: if a single record were altered, the chain would no longer verify. That is how we defend the admissibility of the evidence in court.
- An immutable reference for every case, item and piece of evidence, never reused
- An append-only log chained with SHA-256: corrections are added, never deleted
- A SHA-256 fingerprint of every piece of evidence at acquisition, and integrity re-verification
- Seals, participants and locations recorded as ISO/IEC 27037 requires
- A chain-of-custody report per case, ready to file in the proceedings
Certifications and accreditations
What each certification means for your case
Certifications audited by third parties and currently in force. The certificates are provided with every report.
Your evidence is kept under controls certified by a third party. Cert. SI-1001/23 (Applus+) · valid until 14/12/2026.
View certificate (PDF) ISO/IEC 27037:2016 Chain of custodyThe standard that sets out how to identify, acquire and preserve digital evidence. Cert. DED-0001/24 (Applus+) · valid until 22/02/2027.
View certificate (PDF) ENS · High category Public sectorSpain's National Security Framework (Esquema Nacional de Seguridad) at its most demanding level: it qualifies us to work with public bodies and courts. Cert. ENS-0793/25 (Applus+) · valid until 21/02/2027.
View certificate (PDF)An expert report that is filed in the proceedings and confirmed in court.
Forensic laboratory
Beyond certification
Phones and computers: recover what was deleted, reconstruct what happened and when.
View page Court Expert and counter-expert reportsParty expert report and methodological review of the opposing side's report.
View page Companies Incident response (DFIR)Contain the incident without destroying the evidence.
View pageReferences
Expert work without client names
For confidentiality reasons we do not publish cases. We do say where and for whom we work: law firms and procuradores (court representatives), footwear and textiles, manufacturing, advisory firms, clinics, public administration and private individuals.
- We confirm our reports in court, in person or by videoconference
- Very fast response from the first contact, with urgent reports within 72 hours
- Complex cases: intrusions, data leaks, damaged devices, counter-reports
How it works
From the first message to the signed report
-
01
Triage and quote
Tell us what evidence you need and what for. Fixed quote and guidance on preserving it.
-
02
Acquisition
At the Elche laboratory or at your premises. In most cases the device is returned the same day.
-
03
Analysis
Verification of integrity and authenticity, context and timeline.
-
04
Report and testimony
Delivery of the signed report and availability to confirm it in court.
What you receive
A report your lawyer can file without changes
- Expert report in PDF, electronically signed
- Acquisition record with date, method and tool
- Annex of SHA-256 hashes for each item
- Forensic copy kept in custody
- Expert testimony at the hearing, if we are summoned
Where we work
Elche, Alicante. Testimony before any court in Spain.
Each city has its own page with its courts, how we work there and the questions we are asked locally.
Home of our laboratory, at Elx Parque Empresarial · about 10 minutes from the Palacio de Justicia (courthouse).
View page Alicante IT expert witness in Alicante: digital forensics and evidence certification26 km from our laboratory in Elche · about 25–30 minutes by road.
View pageFrequently asked questions
Before you instruct us
Does it still work if the conversation or file has been deleted?
Often, yes. A forensic extraction recovers deleted records that a screenshot would never show. The first thing to do is stop using the device.
Can I email you the screenshots?
They help us assess the case, but not to certify it: certification is carried out on the original, on the device or at the source, so that we can prove it has not been altered.
Do I need the other person's permission?
Not to certify content you have received or taken part in: it is extracted from your own device or account. How to use it in the proceedings is for your lawyer to assess.
Do you work directly with my lawyer?
Yes. The lawyer can commission the certification and receives the report in the format filed in the proceedings, with a single point of contact through to the hearing.
How much does it cost and how long does it take?
Certifying a WhatsApp conversation costs 450 € + VAT. Other evidence depends on its type and volume: after triage we give you a fixed written quote, with no obligation. Lead time: one week for a standard case and 72 hours if there is a court deadline.
What sets a certified laboratory apart from an independent expert?
ISO/IEC 27001 and ISO/IEC 27037 certification requires audited procedures for custody, access and traceability. If the evidence is challenged, the method is documented and can be verified by a third party.
What should I avoid doing before I contact you?
Do not delete messages or files, reinstall apps, restore backups or forward the content to anyone. If the evidence is on a phone, switch it to aeroplane mode and stop using it.
Can you come to my company, or to a court outside the province?
Yes. We travel to companies for on-site acquisitions and give testimony before any court in Spain, in person or by videoconference where the court allows it. Travel arrangements are agreed with you in the quote.
We serve Elche, Alicante, Murcia, Valencia and the whole of Spain.
Carrer Santiago Ramon y Cajal, 41 · Modulo 1, planta 1, local 13
03203 Elche · +34 965 56 38 00
Accreditation no. 02714, methodology and courtroom experience.
View page
