Designed in the UKSquirrel Forensics
A UK-designed forensic workspace, shaped around the work of protecting, finding and explaining digital evidence.
From practical experience
We started with scripts and a personal incident-response toolkit. Finding a separate tool for each task was slow, and hashes and keywords were kept in different places. The Acorn grew out of that practical problem.
We want you to reach the relevant record without losing its source or case context. You should also be able to show a colleague how you reached a finding.
Squirrel Forensics was founded by digital forensics and cybersecurity professionals. Co-founders Chris Booth and Alistair Ewing bring the product and examination perspectives together.
We build for forensic practitioners, incident-response teams and education. A portable environment can make the same working methods useful at the bench, in a training room or on site.
The planned release is late Q4 2026. Final hardware, licence terms and availability will be confirmed before orders open.
People behind the platform
Chris Booth and Alistair Ewing co-founded Squirrel Forensics to make a prepared, portable forensic workspace more accessible.
Co-founder
Chris helps shape The Acorn as a practical product. His focus includes the portable workstation and how smaller teams can bring it into their forensic work.
Work with investigators, corporate teams and trainers informs the approach. The aim is to let teams handle several tasks on one prepared system, while keeping specialist tools where needed.
Chris on LinkedIn ↗
Co-founder · forensic practitioner
Alistair brings more than 16 years in digital forensics and incident response. His experience includes 120+ independent instructions and 70+ cyber-breach investigations as a managing consultant or technical lead across Europe, the Middle East and Africa.
His work spans expert evidence, recovery, electronic disclosure and corporate investigations. He also builds tools and scripts to answer case-specific questions, bringing that examiner’s perspective into The Acorn.
Alistair on LinkedIn ↗What matters to us
A forensic tool should help you inspect the evidence, not hide the reasoning behind a result.
Check the source and the protection method before acting. Keep the acquisition and examination records available for review.
Use known inputs, repeatable checks and recorded settings. Distinguish what the tool shows from what the examiner concludes.
Provide clear guides and examples for practitioners, students and trainers. Make the support boundary visible.