Contact Dr Sarah Morris
Areas of expertise
- Computing, Simulation & Modelling
2018 - Present: Senior Lecturer in Digital Investigation, Digital Investigation Unit
2016 - Present: Head of Group and Course Director within the Digital Forensics Unit, Centre for Electronic Warfare, Information, and Cyber
Previously Sarah has completed a PhD in Digital Forensics, and a BSc (Hons) in Computer Science. Sarah has also run the Digital Forensic laboratories for over 12 years.
Sarah is the Head of the Digital Investigation Unit, part of the Centre for Electronic Warfare, Information and Cyber. She is also the Course Director for MSc Digital Forensics. Having only just formally taken over leading the Digital Forensics course in 2016, she took the MSc through a major course review and successfully obtained full GCHQ accreditation – making the Cranfield Digital Forensics course the first Digital Forensics MSc to gain the full accreditation.
Her interests include:
- Data recovery
- File fragment identification and reassembly
- Contextual analysis in Digital Forensics
- Legal aspects of computing and digital forensics.
Sarah is casework active, focusing on Digital Investigation casework, but also performs complex data/document recovery, and general consultancy including ISO accreditation reviewers for organisations on request. She has worked on both civil and criminal investigations across a wide sphere of devices and operations. Her most famous case involved the recovery of data from a smart washing machine.
Sarah is a well known Digital Investigation practitioner and academic. She has given multiple interviews across TV, radio, and print formats. Her media engagements have included: BBC World Service, BBC Radio 4, HR Knowledge Bank, The Engineer, and BCS Now.
Sarah gave oral evidence at the House of Lords as part of a Select Committee enquiry into Forensic Science (2018). In 2018 she was also the only academic shortlisted for the Women in Defence Awards. Sarah has also won 4 teaching awards in her time at Cranfield University.
- Various Private Clients for Data Recovery & Digital Forensic Analysis
- Covert Digital Investigation and Incident Response Requests
- Law Enforcement
- Civil Investigations
Articles In Journals
- David A, Morris S & Appleby-Thomas G. (2020) A two-stage model for social network investigations in digital forensics, Journal of Digital Forensics, Security and Law, 15 (August) Article No. 1.
- Ashawa MA & Morris S (2019) Analysis of Android malware detection techniques: a systematic review, International Journal of Cyber-Security and Digital Forensics, 8 (3) 177-187.
- Ashawa MA & Morris S (2019) Host-based detection and analysis of Android malware: implication for privilege exploitation, International Journal for Information Security Research, 9 (2) 871-880.
- Hadgkiss M, Morris S & Paget S (2019) Sifting through the ashes: Amazon Fire TV stick acquisition and analysis, Digital Investigation, 28 (March) 112-118.
- Buckley O, Hodges D, Hadgkiss M & Morris S (2017) Keystroke Inference using Smartphone Kinematics. In: 5th International Conference on Human Aspects of Information Security, Privacy and Trust (HCI International 2017), Vancouver, 9-14 July 2017.
- Evans C, West R, Gartner N, Barton W, Al Amri S & Morris S (2016) Enhancing Analysis and Research note taking in digital forensics using video capture software. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Frewin C & Morris S (2016) Forensic Implications of the Intel Compute Stick. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Hadgkiss M & Morris S (2016) Forensic Artefacts Found Whilst Using Pokemon Go On A iOS Device. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Mustafa Z, Nobles P, Maddison-Warren A & Morris S (2016) Investigating the Cloud: Amazon EC2 Client. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Seba G & Morris S (2016) Analysis and recovery of Android Wear geo-location forensic artefacts using Google Fit. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Morris S & Chivers H (2011) An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache. In: 1st International Conference on Cybercrime, Security and Digital Forensics, 2011, University of Strathclyde, Glasgow, Scotland, 27-28 June 2011.
- Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.