Contact Dr Sarah Morris
- Tel: +44 (0) 1793 785776
- Email: s.l.morris@cranfield.ac.uk
- Twitter: @cranfielddiu
- ORCID
Areas of expertise
- Computing, Simulation & Modelling
Background
2020 - Present: Head of the Digital Investigation Unit within Centre for Electronic Warfare, Information, and Cyber, Cranfield University
2018 - Present: Senior Lecturer in Digital Investigation, Centre for Electronic Warfare, Information, and Cyber, Cranfield University
2016 - 2020: Head of Digital Forensics Unit, and Course Director MSc Digital Forensics within the Centre for Electronic Warfare, Information, and Cyber, Cranfield University
Professional certification: Blacklight Certified Examiner, Autopsy Basics Hands-on, Forensic Computing Foundations (short course), Internet Forensics (Short Course), Legal Issues and Courtroom Skills (Short Course), Bond Solon Expert Witness Training, Advanced Forensic Computing (Short Course), Word Document Examination (Short Course)
Qualifications: PhD in Digital Forensics ("Establishing
the evidential value of thumbnail cache file fragments in unallocated space"), and a BSc (Hons) in Computer Science.
Sarah has also been responsible for the DIU laboratories since she joined Cranfield in 2008.
Current activities
Overview: With over 13 years of experience in complex technical digital investigations, Sarah is the Head of the Digital Investigation Unit, part of the Centre for Electronic Warfare, Information, and Cyber. Sarah is focused on Digital Investigation and exploitation, a field devoted to the digital analysis of a variety of digital devices for any investigative scenario. This includes (but is not limited to) digital forensics, incident response, intelligence operations, open-source intelligence, civil proceedings, and corporate investigations. Sarah is focused on binary level analysis where appropriate and has a broad and deep technical skillset.
Sarah has supervised over 65 MSc dissertations and 2 PhD students to completion. She has brought in over £500,000 of funding. Her academic and casework interests include Document Analysis, Data recovery, File fragment identification and reassembly, Contextual analysis in Digital investigations, Legal aspects of computing, and digital investigations.
Media: As a well-known Digital Investigation practitioner and academic, she has given many interviews across TV, radio, and print formats. Her media engagements have included: BBC Radio 4 (Facebook live and live radio event), BBC World Service, BBC Radio 4 pre-records, HR Knowledge Bank, The Engineer, and BCS Now. Sarah was also the academic chosen to provide her views on education for the digital forensic focused special issue of the Police Professional magazine in 2019. In 2020, Sarah worked with CNN on an exclusive investigation, providing document analysis for an exclusive Covid related story.
Casework: Sarah is casework active , focusing on Digital Investigations. She also performs complex data/document recovery and general consultancy, including ISO accreditation reviewers for organisations on request. She has worked on both civil and criminal investigations across a wide sphere of devices and operations. Sarah has worked with a variety of clients, including Civil, Criminal, Corporate, and Celebrity. Her most famous case involved the recovery of data from a smart washing machine.
Esteem: Sarah gave oral evidence at the House of Lords as part of a Select Committee inquiry into Forensic Science (2018). In 2018 she was also the only academic shortlisted for the Women in Defence Awards. Sarah has also won 4 teaching awards in her time at Cranfield University.
Education: From December 2015 until 2021, Sarah was the Course Director for MSc Digital Forensics, which is currently in Teachout. Having only just formally taken over leading the Digital Forensics course, she took the MSc through a major university course review and successfully obtained full GCHQ accreditation – making the Cranfield Digital Forensics course the first Digital Forensics MSc to gain the full accreditation. Sarah continually receives positive feedback for her teaching. She is responsible for many teaching innovations, including remote delivery of the digital investigation content and gamification of scenario-based teaching.
Working Groups: Sarah is active in the Cranfield University community and is a member of several working groups. These include Information Security, Remote Examinations, Digital Online Teaching at CDS, and the Cranfield Disability Network (Deputy Chair).
Clients
- Covert Digital Investigation and Incident Response Requests
- Law Enforcement
- Civil Investigations
- Corporate Clients
- Celebrity Clients
- Media Clients
- Various Private Clients for Data Recovery, Digital Investigation, and Digital Forensic Analysis
Publications
Articles In Journals
- Ashawa MA & Morris S (2021) Android Permission Classifier: a deep learning algorithmic framework based on protection and threat levels, Security and Privacy, 4 (5) Article No. e164.
- David A, Morris S & Appleby-Thomas G (2021) Social Media User Relationship Framework (SMURF), Journal of Digital Forensics, Security and Law, 16 Article No. 1.
- David A, Morris S & Appleby-Thomas G. (2020) A two-stage model for social network investigations in digital forensics, Journal of Digital Forensics, Security and Law, 15 (August) Article No. 1.
- Ashawa MA & Morris S (2019) Analysis of Android malware detection techniques: a systematic review, International Journal of Cyber-Security and Digital Forensics, 8 (3) 177-187.
- Ashawa MA & Morris S (2019) Host-based detection and analysis of Android malware: implication for privilege exploitation, International Journal for Information Security Research, 9 (2) 871-880.
- Hadgkiss M, Morris S & Paget S (2019) Sifting through the ashes: Amazon Fire TV stick acquisition and analysis, Digital Investigation, 28 (March) 112-118.
Conference Papers
- Buckley O, Hodges D, Hadgkiss M & Morris S (2017) Keystroke Inference using Smartphone Kinematics. In: 5th International Conference on Human Aspects of Information Security, Privacy and Trust (HCI International 2017), Vancouver, 9-14 July 2017.
- Evans C, West R, Gartner N, Barton W, Al Amri S & Morris S (2016) Enhancing Analysis and Research note taking in digital forensics using video capture software. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Frewin C & Morris S (2016) Forensic Implications of the Intel Compute Stick. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Hadgkiss M & Morris S (2016) Forensic Artefacts Found Whilst Using Pokemon Go On A iOS Device. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Mustafa Z, Nobles P, Maddison-Warren A & Morris S (2016) Investigating the Cloud: Amazon EC2 Client. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Seba G & Morris S (2016) Analysis and recovery of Android Wear geo-location forensic artefacts using Google Fit. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Morris S (2014) Continued development of a masters module on "forensic computing using Linux". In: 7th Cybercrime Forensics Education & Training, Canterbury Christ Church University, 10-11 July 2014.
- Frewin C & Morris S (2014) Forensic implications of portable operating systems. In: 7th Cybercrime Forensics Education & Training, Canterbury Christ Church University, 10-11 July 2014.
- Morris S & Chivers H (2013) Thumbnail cache file fragment identification using a Bayesian Network. In: Cyberforensics 2013, Cardiff University, 10-11 June 2013.
- Morris S & Chivers H (2011) An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache. In: 1st International Conference on Cybercrime, Security and Digital Forensics, 2011, University of Strathclyde, Glasgow, Scotland, 27-28 June 2011.
- Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.
