Dr Sarah Morris

Senior Lecturer in Digital Investigation

CDS ¿ Centre for Electronic Warfare, Information and Cyber ¿ Digital Investigation Unit

Contact Dr Sarah Morris

Tel: +44 (0) 1793 785776
Email: s.l.morris@cranfield.ac.uk
Twitter: @cranfielddiu
ORCID

Areas of expertise

Computing, Simulation & Modelling

Background

2020 - Present: Head of the Digital Investigation Unit within Centre for Electronic Warfare, Information, and Cyber, Cranfield University

2018 - Present: Senior Lecturer in Digital Investigation, Centre for Electronic Warfare, Information, and Cyber, Cranfield University

2016 - 2020: Head of Digital Forensics Unit, and Course Director MSc Digital Forensics within the Centre for Electronic Warfare, Information, and Cyber, Cranfield University

Professional certification: Blacklight Certified Examiner, Autopsy Basics Hands-on, Forensic Computing Foundations (short course), Internet Forensics (Short Course), Legal Issues and Courtroom Skills (Short Course), Bond Solon Expert Witness Training, Advanced Forensic Computing (Short Course), Word Document Examination (Short Course)

Qualifications: PhD in Digital Forensics ("Establishing the evidential value of thumbnail cache file fragments in unallocated space"), and a BSc (Hons) in Computer Science.

Sarah has also been responsible for the DIU laboratories since she joined Cranfield in 2008.

Current activities

Sarah is the Head of the Digital Investigation Unit, part of the Centre for Electronic Warfare, Information and Cyber. Sarah is focused on Digital Investigation. A field devoted to the digital analysis of a variety of digital devices for any investigative scenario. This includes (but not limited to) digital forensics, incident response, intelligence operations, open source intelligence, civil proceedings, and corporate investigations. Sarah is firmly focused on binary level analysis where appropriate, and has a broad and deep technical skillset.

As a well known Digital Investigation practitioner and academic, she has given multiple interviews across TV, radio, and print formats. Her media engagements have included: BBC Radio 4 (Facebook live and live radio event), BBC World Service, BBC Radio 4 pre-records, HR Knowledge Bank, The Engineer, and BCS Now. Sarah was also the academic chosen to provide her views on education for the digital forensic focused special issue of the Police Professional magazine in 2019. In 2020, Sarah worked with CNN on an exclusive investigation, providing document analysis for an exclusive Covid related story.

Sarah has supervised over 65 MSc dissertations and 2 PhD students to completion. She has brought in over £500,000 of funding. Her academic and casework interests include Document Analysis, Data recovery, File fragment identification and reassembly, Contextual analysis in Digital investigations, Legal aspects of computing and digital investigations.

Sarah is casework active, focusing on Digital Investigation casework, but also performs complex data/document recovery, and general consultancy including ISO accreditation reviewers for organisations on request. She has worked on both civil and criminal investigations across a wide sphere of devices and operations. Sarah has worked with a variety of clients including Civil, Criminal, Corporate and Celebrity. Her most famous case involved the recovery of data from a smart washing machine.

Sarah gave oral evidence at the House of Lords as part of a Select Committee enquiry into Forensic Science (2018). In 2018 she was also the only academic shortlisted for the Women in Defence Awards. Sarah has also won 4 teaching awards in her time at Cranfield University.

From 2016, Sarah has been the Course Director for MSc Digital Forensics, which is currently in teachout. Having only just formally taken over leading the Digital Forensics course, she took the MSc through a major university course review and also successfully obtained full GCHQ accreditation – making the Cranfield Digital Forensics course the first Digital Forensics MSc to gain the full accreditation.

Sarah is active in the Cranfield University community and is a member of a number of working groups: Information Security, Remote Examinations, Digital Online Teaching, Cranfield Disability Network (Deputy Chair).

Clients

Covert Digital Investigation and Incident Response Requests
Law Enforcement
Civil Investigations
Corporate Clients
Celebrity Clients
Various Private Clients for Data Recovery, Digital Investigation, and Digital Forensic Analysis

Articles In Journals

Ashawa MA & Morris S (2021) Android Permission Classifier: a deep learning algorithmic framework based on protection and threat levels, Security and Privacy, Available online 5 May 2021 Article No. e164.
David A, Morris S & Appleby-Thomas G (2021) Social Media User Relationship Framework (SMURF), Journal of Digital Forensics, Security and Law, 16 Article No. 1.
David A, Morris S & Appleby-Thomas G. (2020) A two-stage model for social network investigations in digital forensics, Journal of Digital Forensics, Security and Law, 15 (August) Article No. 1.
Ashawa MA & Morris S (2019) Analysis of Android malware detection techniques: a systematic review, International Journal of Cyber-Security and Digital Forensics, 8 (3) 177-187.
Ashawa MA & Morris S (2019) Host-based detection and analysis of Android malware: implication for privilege exploitation, International Journal for Information Security Research, 9 (2) 871-880.
Hadgkiss M, Morris S & Paget S (2019) Sifting through the ashes: Amazon Fire TV stick acquisition and analysis, Digital Investigation, 28 (March) 112-118.

Conference Papers

Buckley O, Hodges D, Hadgkiss M & Morris S (2017) Keystroke Inference using Smartphone Kinematics. In: 5th International Conference on Human Aspects of Information Security, Privacy and Trust (HCI International 2017), Vancouver, 9-14 July 2017.
Evans C, West R, Gartner N, Barton W, Al Amri S & Morris S (2016) Enhancing Analysis and Research note taking in digital forensics using video capture software. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
Frewin C & Morris S (2016) Forensic Implications of the Intel Compute Stick. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
Hadgkiss M & Morris S (2016) Forensic Artefacts Found Whilst Using Pokemon Go On A iOS Device. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
Mustafa Z, Nobles P, Maddison-Warren A & Morris S (2016) Investigating the Cloud: Amazon EC2 Client. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
Seba G & Morris S (2016) Analysis and recovery of Android Wear geo-location forensic artefacts using Google Fit. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
Morris S (2014) Continued development of a masters module on "forensic computing using Linux". In: 7th Cybercrime Forensics Education & Training, Canterbury Christ Church University, 10-11 July 2014.
Frewin C & Morris S (2014) Forensic implications of portable operating systems. In: 7th Cybercrime Forensics Education & Training, Canterbury Christ Church University, 10-11 July 2014.
Morris S & Chivers H (2013) Thumbnail cache file fragment identification using a Bayesian Network. In: Cyberforensics 2013, Cardiff University, 10-11 June 2013.
Morris S & Chivers H (2011) An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache. In: 1st International Conference on Cybercrime, Security and Digital Forensics, 2011, University of Strathclyde, Glasgow, Scotland, 27-28 June 2011.
Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.