A sit down with Sarah Morris

From washing machines to smart watches; Digital Forensics at Cranfield University

Tell us about the Digital Forensics Unit

“I run the research, education and consultancy within digital forensics, so anything that involves a device that you want to find out what it’s been up to. 

“In the school of Defence and Security digital forensics has a number of uses from supporting the law enforcement in their day to day operations, providing intelligence for ongoing activities either in the military or police, providing that cutting-edge knowledge of how to work with devices, in particular research methods for working with them because they’re changing so often.

“Almost every investigation will involve digital equipment of some kind, in a murder case you might be analysing a mobile phone or smart watch or the laptop, right the way through to your more traditional computer crimes. It’s encompassed in the whole range of investigation.”

What are the biggest challenges in digital forensics and how has the discipline changed over time?

“It’s certainly becoming more complex and more diverse. When the unit started in 1998 you had mostly big computers with the odd floppy disc, but now we’re doing cases with washing machines, games consoles, cars, you name it, everything has got this digital component. Trying to learn all of that is impossible, we are learning on a bespoke, case by case basis.

“One of the biggest challenges is that whilst I don’t consider myself very old, even now I am struggling to keep up with the pace of technology, and the pace of what’s popular in terms of apps and things, and that can even present itself as a challenge when you’re doing case work.

“It’s a great challenge and it’s so much fun, the one thing it definitely does do for computing, is make it so much more fun than just focusing on these artefacts in their own way. Let’s take a recycle bin on a computer, if you study that from a software engineering point of view, it’s the thing that a user can delete to before it being deleted from the system, from a digital forensics point of view I can tell you what user put it in there, when they put it in there, where it came from…it’s that snooping/criminal aspect that makes it so much more fun to look at.”

Can you tell us about the washing machine case you were involved in?

“The washing machine case was a big case we worked on last year. It was a smart washing machine that you can control with a phone, it was an alibi in a case where the suspect had been up to something several miles away, when he was found, he claimed to be at home doing his washing. There was nobody else in the house, and there was no other evidence that could link him to being at the crime scene. The washing was definitely wet, that is all we knew.

“They wanted to know if you could tell if he had hit the button, or had he used his mobile phone. We ended up taking the washing machine apart, getting the data chip, re-boarding the data chip then looking. Unfortunately the washing machine was in its own language so we then had to work out what that language was and how to read it. From there we could tell that the button hadn’t been hit and it was definitely the mobile phone. Not only could we show that the phone was used to turn on the washing, we also proved that the phone was located right next to the crime scene, we were therefore able to prove him guilty.”

What are the other big areas in digital forensics that you are involved in?

“Almost every investigation will involve digital equipment of some kind. In a murder case you might be analysing a mobile phone or smart watch, laptop or virtual reality equipment, right the way through to your more traditional computer crimes such as hacking. It’s encompassed in the whole range of investigation.

“Smart watches have been coming up a lot more in cases, you see them in murders where the victim has had a smart watch on and they’ve looked at the heart rate and various other activity to see what their last movements were, and also you can use them for messages and things coming in, we’re looking at what kind of data you can get from a smart watch, how reliable is that data and how does it differ depending on the make and model.

How did you become an academic?

“I spent a couple of years as a secondary school teacher in Nottingham, teaching from 12 year olds right up to 18, and I loved teaching the sixth formers because we were doing all the technical computing stuff, and then eventually while looking for PhD’s I found one here in something completely different, but the head of digital forensics was on the interview panel and actually nabbed me in the interview, which I think is the most awkward situation I have been in. He was across the table and said ‘I have looked at your CV, you look like an excellent fit for digital forensics, you’ve done A levels in double maths, law and computing…that is digital forensics’ and then he said ‘I have got a PhD, which one would you prefer?’ I was sat in this interview desperately wanting the digital forensics one but not wanting to blow my chances of the one I was there for. I was told it was very obvious that I wanted the digital forensics PhD.

Whilst I was doing my PhD, I was taken on as a teaching assistant so I was helping with classes, helping prepare data and most importantly doing case work, I got to learn about the field as I studied, which really helped my PhD. After the PhD I was offered a position as a lecturer.”

What do you love most about your role?

“In the school of Defence and Security digital forensics has a number of uses from supporting the law enforcement in their day to day operations, providing intelligence for ongoing activities either in the military or police, so you’re providing that cutting-edge knowledge of how to work with devices, in particular research methods for working with them because they’re changing so often.

“No day is the same and that’s the best part of being an academic really, so some weeks will be teaching, when we’re not teaching we do a lot of research because the course requires a substantial amount of research to keep it up to date and keep it running just because of how quick things move. We also do case work, providing support and expertise to those practitioners who are doing the job.

Dr Sarah Morris is the Head of the Digital Forensics Unit Research Group, part of the Centre for Electronic Warfare, Information and Cyber. She is also the Course Director for MSc Digital Forensics / MSc Forensic Computing and module manager for 9 Digital Forensics Modules.