Rubén Planes LlinaresDigital forensics expert witness

Digital forensics expert witness in Barcelona

Forensic analysis of devices, communications and crypto assets. Expert reports with chain of custody and court testimony.

Member of AEPEJU (no. 1556). Barcelona and across Spain.

Scroll

Digital forensics

Messaging, social media, email and devices.

Business and employment
Dismissals, data leaks, unfair competition, misuse of company equipment.
WhatsApp and messaging
Authenticity of chats and voice notes, doctored screenshots. Logical and backup extraction. Telegram, Signal, iMessage.
Social media
TikTok, Instagram, Facebook, LinkedIn, X and YouTube. Preservation with SHA-256 hash and timestamp, account attribution, comparison.
Email
Headers, SPF, DKIM, DMARC and ARC. Authenticity, true origin and spoofing: phishing, CEO fraud, fake invoices.
Phones, computers and hard drives
Forensic imaging with hash verification. Recovery of deleted data where technically possible.
Files and documents
Metadata in photos, videos and PDFs. Real dates, edits, authorship.
Cyberharassment and impersonation
Fake profiles, threats, unauthorised account access. OSINT.
Rebuttal reports
Technical review of the opposing party's expert report.

Free 30-min consultation

Blockchain and crypto assets

Bitcoin, Ethereum and its L2s (Arbitrum, Optimism, Base), Starknet.

End-to-end tracing
Through bridges, swaps and mixers, with a stated degree of certainty, to the exchange where the court can request identity and a freeze.
Crypto scams
Fake brokers, romance investment scams, phishing and drainers. Report for the police complaint and for the request to the exchange.
DeFi hacks and exploits
Protocols, bridges and staking. Transaction-by-transaction reconstruction of the attack.
Smart contracts
Expert analysis of contracts on Ethereum, L2s and Starknet.
Locating and valuing crypto assets
Inheritance, divorce, insolvency and seizures. Wallets identified and valued at a given date.
Wallets and exchanges
Address attribution, transaction analysis and exchange statements.

Free 30-min consultation

Clear terms

Before we start, you know what it costs and when you will have it.

  • Free consultation30 minutes to see whether your case has forensic grounds.
  • Free quoteNo obligation, within 24 working hours.
  • Report in 7 daysFor standard cases. The deadline is set in writing.
  • Competitive pricesFixed quote, no small print.
  • Court testimonyQuoted from day one.
  • Across SpainIn person in Barcelona, remotely everywhere else.

Who signs the report

Rubén Planes Llinares.

  • Digital forensics expert witness, member of AEPEJU (no. 1556).
  • Collaborating expert for the private investigation agency Mac Detectives.
  • Blockchain data engineer at MigaLabs, an Ethereum research lab in Barcelona.
  • Merged contribution to the Ethereum Beacon API specification (PR #622).
  • I work and report in Spanish, Catalan, English and French.
Forensic Analysis of the KelpDAO rsETH Exploit and Cascade Effects on DeFi Lending Markets Co-author (MigaLabs, 2026). A forged cross-chain message released 116,500 rsETH (around $294M); 75,700 ETH left through Aave v3 and Compound v3 and ended up as 1,329 BTC via THORChain. Read the paper (PDF)

Method: UNE 71506, ISO/IEC 27037 and RFC 3227. Chain of custody, SHA-256 hashes and RFC 3161 timestamping.

How I work

Five steps, from the first message to the courtroom.

  1. You tell me about the case in a free 30-minute consultation.
  2. Fixed quote within 24 working hours.
  3. Preservation with chain of custody and hashing.
  4. Report in 7 days for standard cases.
  5. Court testimony, if needed.

Frequently asked questions

What people ask me most before hiring.

How much does a digital forensics expert cost in Barcelona?

It depends on the scope. I give you a fixed price before starting, free and with no obligation. Court testimony is quoted from day one.

Is a WhatsApp screenshot valid evidence?

A screenshot alone is easy to challenge. I check it against the phone or the backup, preserve the original with a hash and certify its integrity.

Can money lost in a crypto scam be recovered?

No honest expert can guarantee it. Tracing identifies the exchange where the funds end up, which allows the court to request the account holder's identity and a freeze.

How long until I get the report?

7 days for standard cases. If the case is longer, for example tracing with many hops, I tell you in the quote.

Party-appointed or court-appointed?

Both. I work for lawyers, companies and individuals across Spain, and I accept court appointments.

Tell me about your case

Free 30-minute consultation and a free quote within 24 working hours.

Do not include sensitive data. Case details are requested later through a secure channel.

Free consultation WhatsApp