Contact Dr Sarah Morris
Areas of expertise
2018 - Present: Senior Lecturer in Digital Forensics, Digital Forensics Unit
2016 - Present: Head of Group and Course Director within the Digital Forensics Unit, Centre for Electronic Warfare, Information, and Cyber
2012 - 2018: Lecturer in Digital Forensics, Digital Forensics Unit,
2008 - 2012: PhD Student and Teaching Assistant within the Digital Forensics Unit (previously known as the Centre for Forensic Computing). PhD Thesis "An Investigation into the Identification, Reconstruction, and Evidential Value of Thumbnail Cache File Fragments in Unallocated Space"
2006 - 2008: Teaching and Outreach. Teaching ICT and Computing to pupils aged 12 - 18.
2006: BSc (Hons) 2:1 Computer Science, University of Nottingham. Dissertation focused on creating Marmalade, a Darwinian trained Neural Network for playing Texas Hold'em
Sarah has been nominated for the Student Led Teaching Awards every year since she became a lecturer in 2012. Sarah won the Technology Enhanced Learning Champion Award in 2015, the Outstanding Teaching Award in 2017, and the Outstanding Teaching Award, and Sensational Supervisor Award in 2018
Sarah is the Head of the Digital Forensics Unit Research Group part of the Centre for Electronic Warfare, Information and Cyber. She is also the Course Director for MSc Digital Forensics / MSc Forensic Computing and module manager for 9 Digital Forensics Modules. Having only just formally taken over leading the Digital Forensics course in 2016, she took the MSc through a major course review and successfully obtained full GCHQ accreditation – making the Cranfield Digital Forensics course the first Digital Forensics MSc to gain the full accreditation. Sarah is currently organising a 21st Anniversary conference for 2019 to celebrate 21 years of Digital Forensics Education at Cranfield University.
Her research interests include:
- Data recovery
- File fragment identification and reassembly
- Contextual analysis in Digital Forensics
- Digital Forensic research (Including: virtual environments, thumbnail caches, and document analysis)
- Legal aspects of computing and digital forensics.
Sarah is casework active, focusing on Data Recovery casework, but also performs Digital Forensic Analysis and Consultancy including ISO accreditation reviewers for organisations on request.
Sarah teaches on all the Digital Forensic specific MSc Modules which can also be taken as short courses. She also teaches on the module Investigation and Evidence Collection which is taught across the Forensic Programme, and various modules on MSc Information Capability Management. Sarah regularly partakes in community outreach, most notably by leading a one-day forensic computing course for students aged 12-18 entitled “The case of the stolen artwork”, which is delivered to various schools across the UK. She designed this course for children to teach them about the importance of being safe online. She does this by showing them the forensic evidence left by using devices such as smart phones.
Sarah oversees the running of all the facilities within the Digital Forensics Unit, which include 4 bespoke Digital Forensics Labs and an Interactive Crime Scene Room. She is assisted by Melissa Hadgkiss, who manages the daily operation of the facilities.
Sarah has given multiple interviews across TV, radio, and print formats. In 2018 she gave oral evidence at the House of Lords as part of a Select Committee enquiry into Forensic Science.
- Various Private Clients for Data Recovery & Digital Forensic Analysis
- Law Enforcement
Articles In Journals
- Buckley O, Hodges D, Hadgkiss M & Morris S (2017) Keystroke Inference using Smartphone Kinematics. In: 5th International Conference on Human Aspects of Information Security, Privacy and Trust (HCI International 2017), Vancouver, 9-14 July 2017.
- Evans C, West R, Gartner N, Barton W, Al Amri S & Morris S (2016) Enhancing Analysis and Research note taking in digital forensics using video capture software. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Frewin C & Morris S (2016) Forensic Implications of the Intel Compute Stick. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Hadgkiss M & Morris S (2016) Forensic Artefacts Found Whilst Using Pokemon Go On A iOS Device. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Mustafa Z, Nobles P, Maddison-Warren A & Morris S (2016) Investigating the Cloud: Amazon EC2 Client. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Seba G & Morris S (2016) Analysis and recovery of Android Wear geo-location forensic artefacts using Google Fit. In: 5th International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2016), Shrivenham, 14-15 September 2016.
- Morris S & Chivers H (2011) An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache. In: 1st International Conference on Cybercrime, Security and Digital Forensics, 2011, University of Strathclyde, Glasgow, Scotland, 27-28 June 2011.
- Morris S & Chivers H (2010) A comparative study of the structure and behaviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). In: 4th International Conference on Cybercrime Forensics Education & Training, Canterbury, 2 September 2010.