About

The examiner behind the evidence.

Ryan Purita is the principal examiner at Sherlock Forensics in Vancouver BC. He holds CISSP-ISSAP and ISSMP certifications and has over 20 years of experience in digital forensics and cybersecurity. He is a court-qualified expert witness in computer forensics across multiple Canadian jurisdictions.

Principal Examiner

Ryan Purita, CISSP-ISSAP, ISSMP

Ryan Purita founded Sherlock Forensics in 2006 and has served as its principal digital forensic examiner for over two decades. He has conducted thousands of forensic examinations spanning criminal prosecution, criminal defence, civil litigation, corporate fraud and regulatory compliance.

Ryan has been a Certified Information Systems Security Professional (CISSP) since 2002 and holds the ISSAP (Information Systems Security Architecture Professional) and ISSMP (Information Systems Security Management Professional) concentrations. He is co-author of No Hiding Place in Cyberspace with David Crear of Borden Ladner Gervais LLP.

His forensic findings have been admitted as evidence in BC Supreme Court, BC Provincial Court and Newfoundland Provincial Court. He has been qualified as an expert witness in computer forensics and security in each of these jurisdictions. For case details see the expert witness page.

Training & Credentials

Certifications that withstand cross-examination

Ryan's credentials are validated through rigorous examination and decades of continuous professional development. These certifications are regularly tested under cross-examination in court.

CISSP

Certified Information Systems Security Professional

Issued by (ISC)². Held since 2002. Eight domains of security architecture, engineering and risk management.

ISSAP

Information Systems Security Architecture Professional

Advanced (ISC)² concentration in security architecture and design.

ISSMP

Information Systems Security Management Professional

Advanced (ISC)² concentration in security management and leadership.

BCIT

Advanced Specialty Certificate in Forensic Investigations

Completed with Distinction at the British Columbia Institute of Technology.

EnCase

EnCase Forensic Training

Guidance Software (now OpenText) certified training in EnCase forensic examination.

AccessData

AccessData FTK Training

Certified training in Forensic Toolkit (FTK) analysis and evidence processing.

Mobile

Mobile Forensics

Specialized training in mobile device forensic acquisition and analysis.

CCNA

Cisco Certified Network Associate

Cisco certification in networking fundamentals and network exploit analysis.

Security Work

Penetration testing, compliance and vulnerability research

Alongside the forensic practice, Sherlock Forensics tests, audits and defends systems for organizations across Canada. Penetration testing joined the service portfolio in 2010 and incident response has run 24/7 since 2018.

Penetration testing

Network, web application, API and cloud penetration testing following PTES and OWASP methodologies. Internal tests run through ShadowTap, a preconfigured device shipped to your office that tunnels back to our testing environment. See the internal penetration testing methodology.

Compliance auditing

Penetration tests mapped to the controls your auditor checks: SOC 2 Trust Services Criteria, PCI DSS 4.0 Requirement 11.4, CMMC readiness against NIST SP 800-171 and one engagement mapped across SOC 2, PCI DSS, ISO 27001 and PIPEDA. For teams shipping code written with Copilot, Claude or ChatGPT, an AI code security audit finds hallucinated packages, hardcoded secrets and injection flaws before production.

Vulnerability discovery

Sherlock Forensics Labs does original vulnerability research and reports what it finds through coordinated disclosure with a 90-day window. The status of every finding lives on the public Disclosure Tracker, and full technical detail publishes there when each window closes. The lab's hands-on workflow also drives the Sherlock EoP Auditor, a Windows local privilege escalation scanner with early access open.

Incident and zero-day response

24/7 incident response for ransomware, business email compromise and network intrusions, following NIST SP 800-61. Retainer clients get a guaranteed SLA and an annual penetration test. When a critical exploit drops, zero-day emergency response starts with an assessment under a 4-hour SLA.

Sherlock Forensics works remotely by phone and Google Meet. When a computer cannot be shipped, we come on site to image it.

Tools we build. The same casework produces the Sherlock Forensics tool catalog, from the PST Viewer and Android Acquirer to the iPhone and iPad Analyzer and the Sherlock EoP Auditor. See every tool on the forensic tools page.

Recognition

Awards and nominations

Canada's Top 40 Under 40
Nominated three times (2004, 2005 and 2008) for national leadership and achievement.
Business in Vancouver 40 Under 40
Two-time honouree recognizing business leadership in British Columbia.
Canadian IT Hero Nominee
Nominated by the Information Technology Association of Canada (ITAC) in 2005.

Expert Witness

Court-qualified in computer forensics and security

Ryan Purita has been qualified as an expert witness in BC Supreme Court, BC Provincial Court and Newfoundland Provincial Court. He has testified in matters involving computer forensics, digital security, mobile forensics and internet infrastructure for both prosecution and defence.

View Case History

Public Profile

Media and speaking

Ryan has appeared as a cybersecurity expert on CBC Marketplace (three appearances), Global National with Kevin Newman, CTV and Breakfast Television. His analysis has been quoted in the Globe and Mail, National Post, Vancouver Sun and dozens of other publications.

He has presented at the Institute of Internal Auditors IT Conference in Orlando, the Security & Privacy Conference in Victoria and the Canadian Bar Association Criminal Subsection among other events.

Media Appearances Speaking & Conferences

History

Two decades of security and forensic work

2002
Ryan Purita earns CISSP certification from (ISC)². Begins work in digital forensics and information security.
2003
First national media appearances on Breakfast Television CityTV and City Pulse CityTV covering cybersecurity topics.
2004
Georgia Straight front cover feature on white-hat hackers. First Canada's Top 40 Under 40 nomination. Appearances on Global National and CBC Radio.
2005
CBC Marketplace debut ("Sc@mmed"). Canadian IT Hero nominee (ITAC). Globe and Mail Report on Business feature. Second Top 40 Under 40 nomination.
2006
Sherlock Forensics established in Vancouver BC. Featured speaker at IIA IT Conference in Orlando and Security & Privacy Conference in Victoria. Presenter at Techvibes Massive Technology Show at Science World Vancouver. First expert witness testimony (Canadian Metals v. Wiese, BCSC).
2007
Second CBC Marketplace appearance ("Can You Hack It?"). Expanded forensic capabilities to mobile devices.
2008
Third nomination for Canada's Top 40 Under 40. Expanded into civil litigation support and eDiscovery.
2010
Third CBC Marketplace appearance ("Who's Minding the Store?"). Penetration testing added to service portfolio.
2013
Expert witness testimony in Newfoundland Provincial Court (R v. Kelly and R v. Mills). Guest speaker at Canadian Bar Association Criminal Subsection.
2018
Expanded incident response to 24/7 operations.
2024
Added AI-generated deepfake detection and post-quantum encrypted memory forensics to service portfolio.
2026
20th anniversary. Two decades of digital forensics and cybersecurity practice. Sherlock Forensics Labs opens its public vulnerability Disclosure Tracker.

Standards & Frameworks

Aligned to recognised authorities

NIST
NIST Cybersecurity Framework (CSF 2.0) - Risk management and incident response alignment
NIST SP 800-86
Guide to Integrating Forensic Techniques into Incident Response
MITRE ATT&CK
MITRE ATT&CK Framework - Adversary tactics and techniques reference for threat modelling
(ISC)²
(ISC)² Cybersecurity Certifications - CISSP, ISSAP and ISSMP certification body
SANS / GIAC
SANS Digital Forensics and Incident Response - Training and certification body

Service Areas

Serving clients across Canada

Sherlock Forensics is headquartered in Vancouver with remote cybersecurity services available nationwide. We provide penetration testing, digital forensics and incident response to organizations in major Canadian cities.

We also provide specialized services for educational institutions, government agencies, logistics companies and manufacturing organizations.

FAQ

Frequently Asked Questions

Who founded Sherlock Forensics and when?
Ryan Purita founded Sherlock Forensics in 2006 in Vancouver, British Columbia. He has served as the firm's principal digital forensic examiner for over two decades, conducting thousands of forensic examinations spanning criminal prosecution, criminal defence, civil litigation and corporate fraud.
What certifications does the Sherlock Forensics team hold?
Our team holds CISSP (Certified Information Systems Security Professional) since 2002, ISSAP (Information Systems Security Architecture Professional) and ISSMP (Information Systems Security Management Professional) concentrations. Ryan also completed the BCIT Advanced Specialty Certificate in Forensic Investigations with Distinction and holds Cisco CCNA certification.
What industries does Sherlock Forensics serve?
Sherlock Forensics serves healthcare, fintech, SaaS, legal, real estate, construction, nonprofit, government and enterprise technology organizations. Each industry faces distinct threat profiles and compliance requirements. We tailor our assessment methodology to the specific threats targeting your sector.
What security work does Sherlock Forensics do?
Sherlock Forensics runs penetration testing (network, web application, cloud and internal via ShadowTap), compliance penetration testing for SOC 2, PCI DSS 4.0 and CMMC, AI code security audits and 24/7 incident and zero-day response. Sherlock Forensics Labs does original vulnerability research and reports findings through coordinated disclosure on its public Disclosure Tracker. All of it is delivered remotely by phone and Google Meet.
Has Ryan Purita been qualified as an expert witness in court?
Yes. Ryan Purita has been qualified as an expert witness in BC Supreme Court, BC Provincial Court and Newfoundland Provincial Court. He has testified in matters involving computer forensics, digital security, mobile forensics and internet infrastructure for both prosecution and defence.

Get Started

Ready to test your defences or secure your evidence?

Order a penetration test, security audit or forensic examination online. No calls required.

Since 20064.8/5 ratingCISSP-ISSAP, ISSMP certified
Order Online

Next Step

Engage our team

For penetration testing, incident response, forensic analysis or expert testimony, contact Ryan Purita and his team.

Contact Us Call 888.883.4550