Areas of expertise

Background


2016 - Present: Course Director and Digital Forensics Lead within the Digital Forensics Unit, Centre for Electronic Warfare, Information, and Cyber

2012 - Present: Lecturer in Digital Forensics, Digital Forensics Unit,

2008 - 2012: PhD Student and Teaching Assistant within the Digital Forensics Unit (previously known as the Centre for Forensic Computing). PhD Thesis "An Investigation into the Identification, Reconstruction, and Evidential Value of Thumbnail Cache File Fragments in Unallocated Space"

2006 - 2008: Teaching and Outreach. Teaching ICT and Computing to pupils aged 12 - 18.

2006: BSc (Hons) 2:1 Computer Science, University of Nottingham. Dissertation focused on creating Marmalade, a Darwinian trained Neural Network for playing Texas Hold'em

Sarah has been nominated for the Student Led Teaching Awards every year since she became a lecturer in 2012. Sarah won the Technology Enhanced Learning Champion Award in 2015, and the Outstanding Teaching Award in 2017.


Current activities


Sarah is the Course Director for MSc Digital Forensics / MSc Forensic Computing, in the Digital Forensics Unit, part of the Centre for Electronic Warfare, Information and Cyber. Having only just formally taken over leading the Digital Forensics course in 2016, she took the MSc through a major course review and successfully obtained full GCHQ accreditation – making the Cranfield Digital Forensics course the first Digital Forensics MSc to gain the full accreditation. Sarah is currently organising a 20th Anniversary conference for June 2018 to celebrate 20 years of Digital Forensics Education at Cranfield University. 

Her research interests include: 
  • Data recovery
  • File fragment identification and reassembly
  • Contextual analysis in Digital Forensics
  • Digital Forensic research (Including: virtual environments, thumbnail caches, and document analysis)
  • Legal aspects of computing and digital forensics.
Sarah is casework active, focusing on Data Recovery casework, but also performs Digital Forensic Analysis and Consultancy including ISO accreditation reviewers for organisations on request. 

Sarah teaches on all the Digital Forensic specific MSc Modules which can also be taken as short courses. She also teaches on the module Investigation and Evidence Collection which is taught across the Forensic Programme, and various modules on MSc Information Capability Management.  Sarah regularly partakes in community outreach, most notably by leading a one-day forensic computing course for students aged 12-18 entitled “The case of the stolen artwork”, which is delivered to various schools across the UK. She designed this course for children to teach them about the importance of being safe online. She does this by showing them the forensic evidence left by using devices such as smart phones.

Sarah oversees the running of all the facilities within the Digital Forensics Unit, which include 4 bespoke Digital Forensics Labs and an Interactive Crime Scene Room. She is assisted by Melissa Hadgkiss, an apprentice who manages the daily operation of the facilities. 
Sarah has co-supervised 1 PhD to completion and is currently supervising 2 PhD students. Sarah also supervises a number of Digital Forensic MSc Projects every year. She also acts as a Mentor both internally and externally as part of her outreach commitments. 


Clients


  • Various Private Clients for Data Recovery & Digital Forensic Analysis
  • Law Enforcement

Publications

Conference Papers

  • Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.