Start with the source
Check what is available, how it can be accessed and where the output will go. The right method depends on the device and the examination.
← The Acorn overview
The Acorn workspace and app directory
The forensic desktop and application directory
See how The Acorn Home organises the workspace, then choose an application by the source you have or the task you need to complete.
The forensic operating system
The desktop, launcher and case workspace
The Acorn is the Linux workspace. Home helps you find a tool; Workbench gives case review its working context. Move into a specialist application when the record or question calls for it.
View full screen
Choose the next task
Browse, image, recover or inspect a particular record type. Follow the application guide for the expected inputs, useful output and limits.
Keep the context
Retain source references, settings and notes so that another examiner can check the result and understand unresolved points.
Inside The Acorn Home
The complete Home launcher
The native Home screen groups 53 launcher entries across seven stages. Those entries include apps, setup helpers and shortcuts. The directory below focuses on 49 forensic apps and workflow tools.
Scroll through the complete screen, or open it at full size. The screenshot includes the original launcher utilities; the website’s forensic directory omits Hardware Readiness, State Lens, Capability Matrix and OS Guard.
Enlarge the complete Home screen
This is an unaltered native interface capture, not evidence that every launcher completed a test. App guides distinguish reviewed results, setup views and work still in development.
The forensic app catalogue
Browse the forensic applications
Browse all 49 forensic apps and workflow tools. Filter by task or choose Core for the nine starting points featured on the homepage.
49 forensic apps and workflow tools
Device ManagerIdentify a device and inspect its protection state
Check the connected device, its partitions and any mounts before choosing an action. The selected USB device is reported as read-only. That state is useful context, not independent proof that every write attempt would be blocked.
Native device-state inspection
View full screen
Forensic ImagerChoose the source and destination before imaging
Check the disk inventory, select the source and choose a separate destination. The Imager screen brings those settings together before acquisition. The screenshot shows setup, not a completed imaging job.
Acquisition setup shown
View full screen
Cloud & Remote CollectorSet the account, collection scope and destination
The profile editor shows a local mailbox export package and a case folder. Check the scope before using a provider-export route. The displayed profile was not saved, validated or used to collect data.
Provider-export setup shown
View full screen
Partition RecoveryFind a volume after its partition entry is lost
The training image has no partition table, but its FAT16 volume survives. The scanner finds that volume at byte offset 1048576. Selected files recovered from it match their reference hashes.
Constructed test example
View full screen
Live Disk MapCheck the map from a completed copy
The map shows a completed 33 MiB file-to-file GNU ddrescue copy. All bytes were copied and the source and destination hashes match. This test did not use a failing physical drive.
Constructed test example
View full screen
Mount Image (read-only)Review read-only access settings before mounting
The dialog identifies a disk-image file and its FAT16 partition. Review the source information and access controls before choosing a mount action. This capture did not mount or unlock the image.
Read-only access options shown
View full screen
Virtual BootReview an image before attempting a virtual boot
Choose the source image, memory allocation and temporary copy-on-write location. These settings prepare a boot attempt; the screenshot does not show a running virtual machine. The selected FAT16 test image contains no installed operating system.
Boot configuration shown
View full screen
Log2TimelineSet the source, parsers and time zones
Review the source folder, parser choices and output settings before processing a timeline. Extraction and display time zones have separate controls. This setup capture did not run log2timeline or psort.
Processing options shown
View full screen
Forensic NavigatorRead an examiner’s report beside its source files
Navigator previews a Case Notes PDF beside the event-log export and reference files used for the work. The PDF is an examiner-produced report, not a document recovered from the investigated computer.
Public training example
View full screen
Forensic WorkbenchExamine a recovered photograph with its file records
A recovered photograph is worth more when you can check where it came from. In this public Narcos teaching example, Workbench puts the photograph beside its file records. The image alone cannot identify the pictured substance.
Public training example · earlier interface
View full screen
MFT ViewerCompare file records and their stored timestamps
Six Master File Table (MFT) records refer to a manifesto-named document or shortcut in the public Lone Wolf scenario. Compare the two creation-time sets in the selected Box Sync record. A difference alone does not prove timestamp tampering.
Public training example
View full screen
USN Journal ViewerFollow a temporary file through a rename sequence
Three adjacent update sequence number (USN) journal records link a temporary filename to The Cloudy Manifesto.docx. They share file reference 135991. That link helps examine a save sequence, but it does not establish the document’s author or contents.
Public training example
View full screen
Event Log ViewerRead encoded PowerShell beside the source event
Eighteen rule matches flag archive-decoding commands in public training logs. The selected view puts the encoded command beside a decoded gzip script fragment. Review the source event and repeated matches before counting distinct actions.
Public training example
View full screen
Registry AnalyserReview registered software and application paths
The public Lone Wolf example lists 24 registered programs, with available versions and installation dates. Application-path entries add context. These records can guide further checks, but registration alone does not prove that software ran.
Public training example
View full screen
SRUM ViewerCheck recorded network usage by an application
The selected ssh.exe row records 46,905,311 bytes sent. It is one of 28 Cygwin network records imported from a training fixture. A byte count can guide further work, but it cannot identify which files were transferred.
Public training example
View full screen
Shortcut ViewerSeparate a shortcut’s history from its target metadata
Two public shortcuts retain target paths, command arguments and authoring-machine details. The selected Nero link also stores a volume serial and target timestamps. Keep those embedded values separate from the shortcut file’s own timestamps.
Public training example
View full screen
Plist ViewerRead the settings in a macOS LaunchAgent
Expand a property list to inspect its label, program arguments and launch conditions. The example uses a constructed LaunchAgent. These settings describe a proposed action; they do not prove that a script ran.
Constructed test example
View full screen
Timeline ViewerInvestigate an audit-log clearing event
An audit log has been cleared. Filtering 226 public training rows reveals two timestamp entries for Windows Security Event 1102. They describe one event, not two actions. Check the recorded account and surrounding activity before explaining the clearing.
Public training example
View full screen
Artifact LabParse Scheduled Task and Prefetch artefacts
Three constructed Scheduled Task XML files produce a per-artefact CSV. Public Prefetch files provide a separate test. Inspect the returned records and diagnostics; a successful stage label does not establish that every parser result is complete.
Constructed test example
View full screen
Artefact GuideFind Windows sources for an examination plan
Look up a Windows artefact, its usual location and the questions it may help answer. The guide links sources to relevant tools. It is a reference catalogue, not an evidence-processing application.
Reference guide
View full screen
Identity LabDistinguish account records from secret unlocking
The interface separates account-hash extraction from password-assisted unlocking. Check which source files and valid key material the task needs. No account extraction, secret recovery or device unlocking was completed for this example.
Reference interface
View full screen
Sticky Notes DecoderRead notes from a Windows Sticky Notes store
Eight generated notes describe handovers, document staging and incident-review reminders. Inspect their text and recorded times in the decoder. A note can show what was written, not whether a proposed action happened.
Constructed test example
View full screen
Android CollectorPlan an authorised Android collection
Set up a logical collection through Android Debug Bridge (ADB). What you can collect depends on the handset, its authorisation state and Android version. The example shows the controls, not a connected phone.
Collection controls shown
View full screen
Apple Mobile LabChoose the input and parser for mobile records
Start with material you already hold and choose how to parse it. This screen shows input and parser controls. It does not show an Apple device extraction.
Input and parser controls shown
View full screen
Unified Log AnalyserReview sign-ins, downloads and an inbox-rule change
Thirty-one constructed Microsoft 365 audit records show failed sign-ins, file downloads and an inbox-rule change. Compare the selected finding with the source events. These training results do not establish a real account compromise.
Constructed test example
View full screen
Browsing HistoryReview recorded visits to firearm marketplaces
A category filter picks out 65 firearm-marketplace records from the public Lone Wolf training data. Review the page titles, recorded times and source URLs together. A visit alone does not show a purchase or identify the user.
Public training example
View full screen
File Recovery CarverRecover PDF content after a quick format
A quick format left four PDF structures in an owned FAT16 training image. Recovery Carver found them in free space. The recovered files were then checked against the originals, including where each PDF ended.
Constructed test example
View full screen
Data ExplorerQuery recorded visits to cloud-service pages
A read-only SQL query groups visits in the public Lone Wolf Chrome History database. Compare the ten largest matching title groups and their recorded times. A browser visit does not prove account ownership or a completed upload.
Public training example
View full screen
Text LabFilter a large event-log table to specific commands
The example narrows a public DeepBlueCLI export to 71 PowerShell rule matches. Read each command beside its time, computer and event ID. A rule label is a review lead, not proof that a command completed.
Public training example
View full screen
PCAP AnalyserReview extracted objects and network leads
A 23-packet training capture produced HTTP objects, password-adjacent strings and a timing-based beaconing candidate. Inspect those leads against the packets. Readable TLS server names do not mean the encrypted content was recovered.
Constructed test example
View full screen
Hash & Keyword ManagerCheck a file against a named reference list
A SHA-256 lookup matches a public training shortcut against a registered list. Check the algorithm, reference set and label beside the match. Matching bytes do not establish who used the file or whether it is safe.
Public training example
View full screen
Forensic BrowserRun a focused action on Windows Prefetch files
The example processes three unmodified public Prefetch files and retains the native output and counts. Review those results within the evidence workspace. It does not demonstrate Tor, live capture or network browsing.
Public training example
View full screen
AV Quarantine LabInspect the result of a container-decoding test
An inert, constructed input was decoded using a generic XOR-FF transformation. Compare the original and derived hashes before examining the output. This test does not establish support for a particular antivirus vendor’s quarantine format.
Constructed test example
View full screen
Malware TriageReview static file leads in an exported report
An inert training file produced three automated leads and native HTML and PDF reports. Follow each lead back to the known input and hash. Nothing was executed, and a lack of antivirus matches does not prove a file is safe.
Constructed test example
View full screen
Document Threat LabInspect a document’s package without opening it in Office
The test invoice is a constructed DOCX with one external hyperlink and no VBA macro. Inspect the package paths and extracted strings without running the document. Ordinary XML namespace strings are not threats simply because they match a rule.
Constructed test example
View full screen
Filth FinderUse filename and text hits to prioritise review
The training exercise returns three filename keyword hits and two database-string hits. Inspect each match before deciding what needs a closer look. No image-content classification was run.
Constructed test example
View full screen
Memory WorkbenchPrepare a memory image for examination
The setup screen selects a public Windows memory image for review. Check the source and intended analysis method before running it. No analysis engine was run for this capture, so it contains no recovered process or network findings.
Memory analysis setup shown
View full screen
Network WorkbenchInspect conversations in a saved packet capture
A public capture from July 2013 contains 1,434 packets, 14 IPv4 conversations and 16 endpoints. Review its network summary, then inspect the DNS and HTTP records. The example is historical traffic, not a live interception.
Public training example
View full screen
Net SentinelInspect hosts and objects from an offline capture
The training capture was parsed offline into host, site and object-review tables. Inspect those observations alongside the native PDF output. No live capture or interception was started.
Constructed test example
View full screen
GeoExif MapperCompare the coordinates and times stored in photographs
Four training photographs have assigned GPS coordinates at real landmarks. Read their EXIF metadata beside the map and timeline. The connecting lines and point-to-point distances do not reconstruct a person’s journey.
Constructed test example
View full screen
Cell Site AnalyserCompare call records on a timeline and map
Twelve fictional call-detail records form this training example. Compare their order and assigned cell locations. The map does not show measured coverage or prove that a person travelled between the points.
Constructed test example
View full screen
AV AnalyserCheck a recording against known sound and silence
A spectrogram plots sound frequency over time. Here, a ten-second test recording contains two tones and a known two-second silence. Compare the plot with those known sounds and review the exported results.
Constructed test example
View full screen
OSINT SearcherTry a local open-source intelligence query
This example runs two terms against local test material. It shows query handling with external providers disabled. It does not demonstrate a web search, dark-web coverage or discovery of someone’s leaked data.
Constructed test example
View full screen
IP ExtractorExtract addresses without losing their source and date
Four historical IP addresses from a published security advisory form this example. Extract them locally, then keep the advisory date and context with the results. Their presence on an old list does not establish current malicious activity.
Demonstrated in the recorded development build
View full screen
Endpoint Collector SetupPrepare an endpoint collector deployment
Review the service, administration and deployment settings before starting a collector. This is the Endpoint Collector Setup interface. No service was started and no agent package was exported for the example.
Deployment setup shown
View full screen
Remote ResponseDefine the response task before collection
Set the case and collection profile before a remote response. The example covers setup only: no agent was deployed, no remote connection was made and no evidence package was collected.
Collection setup shown
View full screen
Case NotesKeep the method and findings in a case note
Record the source, the work you did and the reasons for your conclusion. This example documents an event-log filter and exports a native PDF. Its hash identifies the export; it does not certify the conclusion.
Public training example
View full screen
Voice RecorderPrepare an audio note for the case record
The interface offers WAV recording and local transcription controls. Agree what the note should capture and how you will retain it. This example does not include a completed recording or transcript.
Recording controls shown
View full screen
Workflow CoachPlan the steps of a Windows examination
Use a Windows dead-box checklist to plan preservation, hashing, triage and reporting. The checklist prompts the examiner; it does not validate the chosen method. Linked-tool launches were not tested in this example.
Teaching checklist
View full screen
Check each guide’s example and the technical support guide for the relevant build, inputs and limits.
A working context
From a tool choice to an examination
A useful question narrows the next step: recover a deleted file, inspect a browser record, review an event or compare a time sequence. Keep observations separate from conclusions.
Read a co-founder’s practitioner perspective
Compute Forensics explains how The Acorn’s collection and review tools fit into evidence-led examination. SQFR handles The Acorn product demonstrations, software and workstation enquiries.
The Acorn at Compute Forensics ↗Start with your task
Practical forensic workflow guides
Working with a failing disk, planning a field kit or reviewing an incident? Choose the question you need to answer, then see the tools, checks and setup involved.
Difficult disks and encrypted sources
- How do you image a failing hard drive without losing sight of the evidence?
- Can an interrupted forensic acquisition resume from its bad-sector map?
- What should you check before imaging a disk that may be failing?
- How can you recover a lost partition without changing the evidence?
- How do you examine a BitLocker drive from Linux when you have the recovery key?
- How do you preserve and review a LUKS-encrypted disk?
Choosing a portable workstation
- What do you need for forensic imaging at a client’s premises?
- Is a compact forensic workstation enough for your workload?
- Which adapters do you need to image SATA and NVMe evidence?
- How do you build a usable imaging kit around a portable screen?
- What can a forensic field kit do without an internet connection?
- Would a second imaging workstation remove a bottleneck in your laboratory?
Source protection and acquisition records
- How does kernel-level write blocking protect an evidence device?
- What should “integrated write blocking” mean in a workstation quotation?
- How do you avoid confusing evidence disks with writable destinations?
- Should you choose E01 or RAW for a forensic image?
- What should accompany a forensic image besides its hash?
Incident response and remote Windows
- What should an incident-response workstation let you do on site?
- How can DFIR teams reach cloud Windows workstations from The Acorn?
- How should evidence reach a remote workstation without losing its source record?
- How can you review Microsoft 365 audit exports on a Linux workstation?
- Which records help explain an email-compromise payment fraud?
Teaching, independent work and handover
- How should a university choose a digital forensics teaching workstation?
- Can you run a forensic practical without a permanently dedicated laboratory?
- What should an institution include in a forensic software quotation request?
- What does an independent examiner need from a forensic workstation?
- What should travel with a forensic image collected in the field?