Ongoing Research Projects

Our active projects cover disk analysis, mobile evidence, cloud forensics, memory research and malware investigation. Each one starts from a problem investigators run into on real cases.

Where our research questions come from

Most of our research starts with a case that did not go as planned. An SSD that returned zeros where deleted files should have been. A drone whose flight log was in a format no tool could read. A server where the ransomware left nothing on disk and everything in memory. We turn these into research questions, test them in our labs and bring what we learn back into training.

Below are the areas where work is under way. We describe the kind of work in each area. Findings are shared through our publications as they are ready.

Storage and disk forensics

Modern storage is harder to examine than the old spinning disk. SSDs move data around for wear levelling and can wipe deleted blocks after a TRIM command, so what an examiner can recover depends on the drive, the controller and the time since deletion. RAID and NAS boxes add another layer, because the data is split across disks with settings the investigator may not know.

Recovery from NVMe and SATA SSDs
How wear levelling and TRIM affect deleted data
Rebuilding RAID and NAS volumes with unknown parameters
File carving methods for fragmented files
Spotting anti-forensics such as wiping tools and altered timestamps

Mobile, IoT and drones

Phones and connected devices change with every software update, so this work never stands still.

Locked device extraction
Studying lawful ways to acquire data from locked phones and what each method can and cannot reach.
IoT acquisition
How smart home devices, cameras and hubs store data, locally and in their companion apps and cloud accounts.
Drone logs and sensors
Reading flight logs, GPS tracks and sensor data from drones and checking them against other evidence.
Secure hardware behaviour
How trusted execution environments and Apple's Secure Enclave affect what data an examiner can get.

Memory and malware forensics

A lot of today's malware leaves very little on disk. The evidence lives in RAM, and it disappears when the machine is switched off. Our work here looks at how to capture memory well and how to read it, using frameworks such as Volatility 3 to rebuild what was running and when.

Building timelines from memory images
Detecting code injection and process hollowing
Finding encryption keys and other cryptographic material in memory
Tracing malware that changes its own code between infections

Network, cloud and virtual machines

Company data now sits on virtual machines and cloud services as often as on office PCs. We study what evidence a virtual machine leaves behind in its disk files, snapshots and memory, what the hypervisor itself records and how to rebuild sessions and files from captured traffic.

Extracting artefacts from virtual disks and snapshots
Models for analysing hypervisor evidence
Rebuilding files and sessions from packet captures

Other active areas

Video and CCTV
Decoding proprietary DVR formats, checking footage for tampering and testing deepfake detection.
Blockchain and cryptocurrency
Tracing funds across wallets and ledgers, transaction metadata and analysis of how flows link together.
AI and machine learning
Models that classify artefacts and score how alike two pieces of evidence are, with output a court can follow.
Forensic tool development
Parsers, decoders, automation and verification pipelines that grow out of the work above.