Banker Daniel Workaro, owner of Master Bank, devised a scheme to completely eliminate traces of his WhatsApp correspondence. He wrote messages in phone notes, took screenshots, and sent them as single-view images. His goal was to ensure that the information remained nowhere.
However, this strategy failed because all data was preserved directly on his iPhone. Dr. Alvaro Machado Dias, a neurobiologist, professor at Unifesp, and columnist for Olhar Digital, stated in an interview with Olhar Digital News: 'He defended himself against the application, but ultimately fell into the clutches of his own phone.' He explained that when each note was created, a temporary PDF file containing the same text was generated in the Temp folder, which remained on the device.
Workaro was detained by the Federal Police, and his iPhone 17 Pro was seized. The expert examination revealed correspondences, including dialogues with Supreme Court Minister Alexander de Moraes. The case attracted national attention after Minister Andre Mendonça lifted the secrecy classification on the investigation.
Digital forensic examination does not read the phone; it creates a complete copy. As Alvaro explained, the device is isolated from the network to prevent remote data deletion. Then, specialized software—in the case of the Federal Police, Cellebrite—performs a full copy of all files. Subsequently, IPED, proprietary PF software, is used to index and systematize the huge volume of information, correlating time, entries, and files.
In the Workaro case, the report contains over 30 thousand logs and more than 40 thousand application usage records. The neurobiologist emphasized: 'It is this correlation, not any specific message, that determines or directs the conclusions.'
Dr. Alvaro's central point of analysis is that most people are unaware of the hidden layers of a smartphone. He stated: 'We tend to think that the phone is a system that operates solely based on notes—that what we record remains, and what is no longer recorded disappears. This is incorrect.' He added that beneath the user-visible level exist numerous layers necessary for the correct functioning of the technology.
The operating platform system records all actions regardless of the user's will: opened applications, screen time, automatic screenshots, temporary files created with every action. Alvaro noted that the examination could recover much more than assumed, and even desired it. For example, one could find out where a person was with meter accuracy, month by month; who they communicated with and for how long; who did not reply to them; what time they went to sleep; what they searched for on Google during a sleepless night; as well as messages they wrote but did not send.
Regarding the possibility of forging extracted messages, Dr. Alvaro was categorical: 'Authenticity is the most undisputed question of all. There is no dispute.' When a forensic copy is created, a hash is generated—a unique mathematical code. If even one character changes, the hash changes, and falsification will be immediately detected. He compared this to a 'mathematical fingerprint.'
The neurobiologist concluded with a warning that extends beyond the Workaro case. With the development of artificial intelligence (AI), conversations with chatbots like ChatGPT and Claude can also be requested by authorities, and such cases have already been documented. Alvaro warned that people sometimes use ChatGPT or Claude believing they are in a 'hidden box,' but AI also records information, and instances of this data being passed to the police have been observed.
In his opinion, the next step will be built-in AI models in phones themselves. He suggested that in the future, a user might say: 'I will not say anything confidential to Gemini because I do not want it to relate to Google.' However, if a person speaks to their phone's mini-model, this information is recorded just like the text files that became PDFs in Workaro's case.
