Areas of expertise

Background

Sarah graduated with a BSc in Computer Science from the University of Nottingham in 2006 and obtained her PhD from Cranfield University in 2013 for her thesis An Investigation into the identification, reassembly and evidential value of thumbnail cache file fragments identified in unallocated space.

Current activities

Dr Sarah Morris is a lecturer at the Centre for Forensic Computing and Security. Her research interests include:
  • file fragment identification and reassembly
  • contextual analysis
  • virtual environments
  • thumbnail caches
  • legal aspects of digital forensics.

Sarah teaches on several of the post-graduate modules on the PgCert, PgDip and MSc in Forensic Computing, including:
  • Digital Crime and Investigation
  • Forensic Computing Foundations
  • Internet Forensics
  • Network Forensics
  • Programming for Digital Forensics.
She also manages the modules on:
  • Advanced Forensics
  • Forensic Computing Using Linux.
Sarah  supervises MSc research projects and also looks after the student and teaching computer laboratories within the Centre for Forensic Computing.

Having spent time previously teaching secondary school level information and communications technology, Sarah has developed a passion for sharing her interest in computers with children. This has led to Sarah becoming actively involved with educational charity STEMnet and the Computing at School Working Group. Sarah visits schools and universities to talk about forensic computing and has developed several murder mystery based one day short courses for children to teach them the basics of forensic computing and computer privacy.

Publications

Conference Papers

  • Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.