Kevin Ripa

Kevin serves as president of The Grayson Group of Companies, which consists of Computer Evidence Recovery, Pro Data Recovery Inc., and J.S. Kramer & Associates, Inc. He provides investigative services to various levels of law enforcement, Fortune 500 companies, and the legal community. He is past president of the Alberta Association of Private Investigators and a former member of the Canadian Department of National Defence, where he served in both foreign and domestic postings. Kevin is a 25-year digital investigation veteran with hundreds of speaking and training engagements around the world.

More About Kevin


An investigator at heart, Kevin Ripa bought his first computer as a tool for writing reports for his private investigation agency. As he worked through typical user issues, the "why" of what was going wrong in his machine kept him up at night. So Kevin turned his investigative skills toward his computer and quickly became fascinated by the world inside of it. Now a 25-year veteran of the digital investigations field, Kevin's enthusiasm has not waned: "IT security and digital forensics still inspire me every day, and I can't wait to wake up in the morning and get to work!"

Kevin has assisted in many complex cyber-forensics and hacking response investigations around the world. He's a sought-after resource for his expertise in information technology investigations and frequently serves as an expert witness. In one memorable case, Kevin had a client charged with a heinous crime and facing significant jail time. "There was no question that the contraband material was on his computer, but our investigation proved conclusively that he could not have placed the material on the computer, nor was the computer even in his custody when the material was downloaded and viewed," explains Kevin. "In fact, the material had been placed on his computer inadvertently by his accusers, without them knowing that they had done it."

Back when he was a student, Kevin had chosen SANS because of the caliber of the instruction. Today he is a SANS instructor for SEC301: Intro to Information Security, SEC401: Security Essentials Bootcamp Style, and FOR500: Windows Forensic Analysis. He is also teaches and is the co-author of the FOR498: Battlefield Forensics & Data Acquisition course.

"I teach because I love to share knowledge, and I teach for SANS because it is the best of the best," Kevin explains." I am really fortunate that SANS appreciates my knowledge and allows me the opportunity to pass it on. I love teaching security and DFIR, because it's like talking about my hobby. And when a student's light bulbs come on, it makes it even more worthwhile."

Kevin's teaching philosophy is that the instructor is there for the students, not the other way around. "If my students do not 'get' something by the end of the section, or day, or course, it is me that has failed as an instructor," he says. Kevin sees it as his duty to make the information understandable to each one of his students, and he wants his students to walk away from his classes reinvigorated about the field they have chosen and feeling they can make an actionable difference in the security of their enterprise. He also strives to remind them that humility is vital for career success.

Qualifications Summary

Get to Know Kevin Ripa


  • GIAC Advisory Board
  • Certified Cellular Master Repair Technician Level III
  • Certified Data Recovery Professional
  • Hacking Exploits Investigation Specialist
  • Advanced Lab Data Recovery Specialist
  • Advanced Microsoft Windows Forensics
  • Email Tracing Specialist
  • Internet Investigation Specialist
  • GIAC Information Security Fundamentals (GISF)
  • GIAC Certified Forensic Examiner (GCFE)
  • GIAC Certified Forensic Analyst (GCFA)
  • GIAC Security Essentials Certification (GSEC)
  • EnCase Certified Examiner
  • Licensed Private Investigations Agency and Agent
  • Certified Ethical Hacker v.6



3MinMax series

SANS @MIC Talk - Accessing Data in the Cloud, May 2020

Understanding Encryption, April 2020

Head in the Clouds, March 2020

From Seizure to Actionable Intelligence in 90 Minutes or Less, May 2019

The Magic of Raw Data Carving, April 2018

Real-world Pentesting – It’s About Bringing Value, not Being l33t & Deeper Dive Digital Forensics, March 2018