Hi, I'm Prof. Sarah Morris

About Me

I'm a Professor of Digital Forensics at the University of Southampton, and Deputy Head of School (Knowledge Exchange and Enterprise) for the School of Electronics and Computer Science. I hold a chair, in Digital Exploitation and Intelligence, though "the Chair" makes it sound grander than it is; it's a standard professorship, I just get to pick the wording on the certificate. In 2022 I founded a digital forensics lab called SherFox.

My PhD proved that thumbnail cache file fragments hiding in unallocated space are forensically valuable, a sentence that has ended more pub conversations than started them. (There's a whole page on the research itself if you want the properly academic version.)

"If we needed it and it didn't exist, we built it."

I'm a 2025 Churchill Fellow. My advisory and public-service roles (Home Office, NPCC, the House of Lords, that sort of thing) get their own page, since the list got long enough to need one.

Before Southampton, at Cranfield University, I secured the first NCSC/GCHQ-certified MSc in Digital Forensics (2017).

I'm an openly autistic academic and an active advocate for neurodivergent researchers in cyber security. Outside the lab: policy work, media commentary, and science-based stand-up comedy, writing and performing my own material.

Casework

I'm a practitioner as much as an academic, so the theory gets tested against real devices, real deadlines, and real courtrooms. Criminal, civil, employment, corporate, private, and media instructions, across multiple jurisdictions, and it covers a lot more ground than "document forensics" suggests.

Yes, I have forensically examined a washing machine. No, I will not stop bringing it up.

Research

My research begins from a deceptively simple problem: the devices that now hold the evidence of modern life were never designed to be examined. Operating systems, applications, and storage formats change constantly, often without documentation, and an investigator is routinely asked to recover reliable, defensible meaning from data that is fragmentary, proprietary, or actively obscured. My work is a sustained answer to that problem, pursued at the level where it actually has to be solved: the binary itself.

Much of it concerns acquisition and recovery: how evidence is faithfully obtained from a device in the first place, and how it can be reconstructed when it survives only in pieces. Document forensics, data recovery, acquisition approaches, and bespoke data formats all share a common concern with extracting structure and significance from incomplete or undocumented data, alongside a longstanding interest in file carving and digital archaeology. Where existing tools fall short, particularly against unusual or emerging formats, I build the methodology that doesn't yet exist.

Bytes alone are rarely the answer, though. A second strand moves from recovery to interpretation: what does recovered data actually mean within an investigation? That question gets harder as devices become interdependent, which is why current projects include the forensic contextual value of AI services and activity on mobile devices, smart wearable forensics, novel acquisition approaches, and IoT forensic chain reactions, where the state of one connected device cascades into the evidential picture of another.

Running through all of it: research should serve the people who depend on it. I'm an active practitioner as well as an academic, and the work is oriented explicitly toward supporting practitioners on the ground, not toward sitting quietly in a journal.

Advisory Roles

This list got long enough that lumping it into my bio stopped being fair to it, so it gets its own space.

Awards & recognition (20 total)

Media

I do a fair bit of media work, mostly turning "what does this evidence actually show" into something that isn't three hours of acronyms.

Wellbeing

Digital forensics involves looking at genuinely awful material, repeatedly, and our sector hasn't talked about that enough. My 2025 Churchill Fellowship looks at how other countries support the mental health of digital forensic practitioners, and brings back practical, compassionate recommendations for the UK.

Grounded in peer-reviewed research on trauma exposure among UK-based digital forensic investigators. Not a hunch.

Need to talk to someone right now?

My Lab: SherFox

27 people · 250+ combined years · 15 CPD courses · 7 home-built tools · one fictional investigation universe called Cyberly.

I founded SherFox in 2022, the University of Southampton's operational digital forensics laboratory. Most of us hold day jobs in active practice alongside the academic side. CPD courses, home-built tools (AURORA, SCOUT, ReviewBox, SpectrumAcquire, SignalSentinel, BOB, The Lattice), and a fair amount of cheese jokes, all live here.

Downloads

Three brochures, because apparently one was never going to cover it. All viewable here, or grab your own copy.

Preview not loading on your phone? The download button opens it directly.

Find Me

Further sources, every link I found while building this page:

Official pages

Research

Advisory & wellbeing

Media coverage

Roll again

Click the button below for a fact.