Dr Chris Hargreaves
Lecturer
Location: Shrivenham campus
E: c.j.hargreaves@cranfield.ac.uk
T: +44 (0)1793 785993
Department of Engineering and Applied Science
Current activities
Dr Chris Hargreaves is a lecturer at the Centre for Forensic Computing and Security, focusing on developing the research profile of the group. His PhD was titled “Assessing the Reliability of Digital Evidence from Live Investigations Involving Encryption”, and therefore many of the research topics of interest are in that area. Research interests are broad and include, live investigations, encryption, memory acquisition and analysis, forensic computing research techniques, Internet history reconstruction, footprints of live tools, malware and future challenges for forensic computing.
Chris writes a monthly article for Forensic Focus, and has presented to the Wiltshire BCS on the topic of Forensic Computing Research. He is co-investigator on the EPSRC funded project ‘Making Sense’ and is currently supervising Anne David during her PhD studies of artefacts left though communication using the Internet.
Chris also currently teaches on Programming for Practitioners, Advanced Forensics, Linux Forensics and Project Skills.
Background
Cranfield University, 2006 – 2009, PhD, “Assessing the Reliability of Digital Evidence from Live Investigations Involving Encryption”.
University of Glamorgan, 2005 – 2006, MSc Information Security and Computer Crime.
University of Bristol, 1999 - 2002, BSc Computer Science.
Selected publications
Chivers, H. & Hargreaves, C. (2011) Forensic data recovery from the Windows Search Database, Digital Investigation Volume 7, Issue 3-4, p.114-126
Patterson, J. & Hargreaves, C. (2011) Automated Identification and Reconstruction of YouTube Video Access, Proceedings from 5th Cybercrime Forensics Education and Training, Canterbury Christchurch University, Canterbury, UK
Hargreaves, C. & Chivers, H. (2010) A Virtualisation Based Forensic Computing Research Tool, Proceedings from 4th Cybercrime Forensics Education and Training, Canterbury Christchurch University, Canterbury, UK
Hargreaves, C. & Chivers, H. (2010) Detecting Hidden Encrypted Volumes. Proceedings from 11th Conference on Communications and Multimedia Security. Upper Austria University of Applied Sciences, Linz, Austria. [link]
Rabaiotti, J. & Hargreaves, C. (2010) Using a Software Exploit to Image RAM on an Embedded System. Digital Investigation. Volume 6, Issues 3-4, Pages 95-103, [link] see also New Scientist article.
Hargreaves, C. (2009) Establishing Context When Investigating a Suspect’s Internet Usage. Proceedings from 3rd Cybercrime Forensics Education & Training. Canterbury Christ Church University, Canterbury, UK.
Hargreaves, C., Chivers, H. & Titheridge D., (2008) Windows Vista and Digital Investigations. Digital Investigation, Volume 5, Issue 1-2, Pages 34-48 [link]
Hargreaves, C. & Chivers, H. (2008) Avoiding Live Imaging of Large Encrypted Volumes by Recovering Keys from Memory. Proceedings from 3rd Advances in Computer Security and Forensics. Liverpool John Moores University, Liverpool, UK.
Hargreaves, C. & Chivers, H. (2008). Recovery of Encryption Keys from Memory Using a Linear Scan. International Workshop on Digital Forensics (WSDF’08) as part of The Third International Conference on Availability, Reliability and Security (ARES 2008), Technical University of Catalonia, Barcelona, Spain [link]
Hargreaves, C. & Chivers, H. (2007). Potential Impacts of Windows Vista on Digital Investigations. Proceedings from 2nd Advances in Computer Security and Forensics, Liverpool John Moores University, Liverpool, UK [link]
Hargreaves, C. (2007). Live Forensics and Encryption. (Poster Presentation) Annual Presentations by Britain’s Early-Stage Researchers in Science, Engineering, Medicine and Technology, House of Commons, London, UK
Hargreaves, C., Chivers, H. & Sutherland, I. (2006). A PDA Based Live Forensic Tool. Proceedings from 1st Advances in Computer Security and Forensics, Liverpool John Moores University, Liverpool, UK
