Forensic experts challenge Moraes’ explanation on alleged Vorcaro messages, citing data extraction inconsistencies
Forensic computing specialists, investigators, and law enforcement officials have identified significant inconsistencies in Supreme Court Justice Alexandre de Moraes’ explanation regarding alleged message exchanges with banker Daniel Vorcaro. The controversy stems from messages purportedly sent on November 17, 2025, the day Vorcaro was first arrested.
Justice Moraes, in a statement released on December 6, 2025, denied sending messages to Vorcaro, asserting that prints found on the banker’s phone were “linked to folders of other people” within his contact list. This, Moraes argued, indicated the messages were not directed to him.
However, experts consulted on the matter unanimously contend that the technical organization of files post-extraction from a mobile device does not automatically determine a message’s intended recipient, directly refuting the minister’s defense.
Forensic analysis methods questioned
Digital forensics programs, like the Federal Police’s IPED (Indexer and Processor of Digital Evidence), reorganize extracted data based on technical parameters crucial for preserving evidence integrity, a process known as the chain of custody. This procedure often results in files being grouped by technical criteria rather than user-defined associations.
Antonielle Freitas, a specialist in digital law and data protection, emphasizes that forensic analysis does not replicate a user’s everyday interaction with their device. Instead, data is examined as raw databases, files, and metadata stored in memory. Experts utilize forensic tools to reconstruct conversations, link messages to contacts, and establish a timeline of events.
Moraes’ defense hinges on digital file organization
Justice Moraes explicitly stated that “The message and the respective contact are in the same folder on the computer of the person who made the prints (Vorcaro).” This assertion forms the core of his defense, suggesting a direct link between the message prints and other contacts.
According to his statement, this digital linkage “demonstrates that the messages (prints) are linked to other telephone contacts on Daniel Vorcaro’s computer, never to Minister Alexandre de Moraes.” This explanation aims to dissociate him from the alleged communications.
His defense implies that the grouping of files in specific folders is indicative of their intended recipient or context, a premise that digital forensics experts are now challenging.
Experts highlight technical complexities in data extraction
The method by which digital forensic tools organize data extracted from mobile phones fundamentally differs from how a user perceives their device. During extraction, software generates a unique “digital signature” for each file, known as a hash—a sequence of numbers and letters created by a mathematical algorithm. This hash acts as a file’s fingerprint, enabling verification of its integrity against any alterations.
To structure these vast amounts of data, the system often uses the initial characters of this hash code to create subfolders where files are stored. Consequently, files that are entirely unrelated in content or context might end up grouped within the same folder simply because their unique hash codes happen to start with identical letters or numbers. Antonielle Freitas underscores that this technical organization prioritizes convenience and evidence integrity over reflecting personal or communicational relationships between files, meaning the mere presence of files together in a folder does not imply a direct link. Amanda Silva Santos, a criminal lawyer, adds that identifying a message recipient typically relies on more robust evidence, such as conversation logs, file metadata, or data extracted directly from the messaging application’s database.
Evidence shows varied file grouping
The retrieved files themselves offer examples that support the experts’ interpretations regarding file organization. One screenshot taken by Vorcaro on the day of his arrest, for instance, was found stored in the same folder as the contact for Senator Irajá (PSD-TO).
Another similar print appeared in a different folder, grouped alongside the contact of lawyer Viviane Barci, who is the wife of Justice Alexandre de Moraes. These instances illustrate how files with distinct connections can be technically grouped in the same directory based on algorithms rather than personal relationships.
Criminal defense attorney Amanda Silva Santos reiterates that simply finding files within the same folder after data extraction is insufficient to conclude direct communication between the mentioned individuals. She notes that in forensic practice, it is common for unrelated files to be grouped in the same directory due to the technical criteria used by cell phone systems or analysis software.
Alleged message strategy by Vorcaro revealed
The messages central to the controversy were reportedly composed by Vorcaro in his phone’s notepad. These notes were then converted into screenshots, which were subsequently sent via messaging applications utilizing a view-once feature, designed to make content disappear after it is viewed by the recipient.
Despite the ephemeral nature of the sent messages, the original screenshots remained stored within the device’s photo gallery. These images included standard names, such as “IMG_2788,” and crucially, bore timestamps indicating their creation on November 17, 2025.
Investigators were able to recover these images from the device’s image library. The presence of these dated screenshots has been vital for reconstructing a partial sequence of actions performed on the banker’s phone.
This method provided a persistent digital trail, allowing for the recovery and analysis of the content despite the use of disappearing message features.
Chronology of the alleged exchanges
The alleged message exchange began on November 17, 2025, the day Daniel Vorcaro was taken into custody by the Federal Police as part of the Banco Master investigation. According to reports, the conversation started in the morning, with Vorcaro expressing concern that the case was “leaking” to the press.
He reportedly described the leak as “terrible” but suggested it could be “a hook to enter the process circuit.” Prior to Fictor Holding Financeira’s announcement of its purchase of Banco Master, Vorcaro allegedly sent a message stating, “I made a rush here to try and save. Did what I could, will announce part of the transaction.” When Moraes reportedly did not reply, Vorcaro followed up with “Any news? Did you get news or block it?”
At 5:22 PM, Vorcaro allegedly messaged Moraes asking, “Did you manage to block it?” Moraes reportedly responded at 5:31 PM with view-once messages. Later that evening, after 8:00 PM, Vorcaro again sought updates, to which Moraes allegedly replied with two messages at 8:21 PM and 8:23 PM. The last message from Vorcaro to the minister was at 8:48 PM, with Vorcaro’s arrest occurring around 10:00 PM that same day.
Media maintains stance on message authenticity
Following the Supreme Court’s statement denying the messages, the newspaper that originally broke the story reaffirmed its published information. The publication clarified that the messages attributed to Vorcaro and Justice Moraes were extracted from the banker’s cell phone through a technical analysis conducted by the Federal Police.
The report stressed that the material accessed did not rely merely on comparing timings between Vorcaro’s notes and his sent messages. It was obtained from a specialized forensic software extraction, allowing simultaneous visualization of the WhatsApp screen and the view-once files sent in the conversation. The newspaper confirmed that the minister’s name and number appeared in the message display and had been verified, with the number obscured in published prints for privacy. Moraes’ contact reportedly responded with view-once images and approval emojis.
Alexandre de Moraes, Daniel Vorcaro, forensic analysis, digital evidence, message inconsistencies
