The Acorn questions, answered

The Acorn is a portable Linux forensic operating system. It brings acquisition, examination and reporting tools into one workspace. The planned bundle adds a physical workstation and portable accessories. Confirm the software and hardware included in the edition you choose.

SQFR is Squirrel Forensics, the company behind The Acorn. The forensic operating system provides the working environment. Workbench organises supported evidence for case review. Other applications handle specific records and tasks.

Yes. Tell us the task, source formats and output you need. Include any hardware or teaching constraints. We can agree suitable test material for a demo. Do not send client evidence or credentials in a general enquiry.

No. Use a demo and your own validation to decide where it fits. Keep specialist tools and independent checks where your evidence or procedures require them.

Local evidence analysis runs on the workstation. Remote sessions and cloud collection need network access. Downloads, updates, online lookups and some maps may also need a connection. Check the exact workflow before planning an isolated deployment.

No certification, accreditation or official approval is claimed. The sector pages describe intended uses. Your organisation must assess the method, evidence and security requirements. Neither a report logo nor a file hash guarantees admissibility.

Compare a defined result from the same source image or exported records. Check formats, versions and source references in both workflows. Native case import, direct integrations and local Windows application support must be confirmed for the specific route.

Agree one task, authorised test material and a result you can check. Record the build, hardware, settings and observed output. Have another examiner review the handover where useful. Use the results and remaining gaps to assess suitability.

Rerun your relevant test cases and compare the results with their known answers. Read the release notes and inspect changed fields or unsupported inputs. Record any changes needed to your procedure or teaching material.

The menu offers actions based on the selected item. A folder can offer Artefact Lens, triage, a directory inventory and an intelligence report. Check the selected source and build: a menu entry does not establish support for every variant.

Artefact Lens explains how an item was recognised, lists relevant companion files and suggests a parser. Its file-manager view is for inspection. Parsing that creates case outputs goes through Workbench. The intelligence report is a separate action, not a result of recognition alone.

Examples include application PDFs, case notes, CSV and TSV tables, and recovery records. Formats and fields vary by application. Keep the source references, settings and warnings with each output. The report still needs the examiner’s explanation.

No. A rule match, byte count or location tag can guide the next check, but it needs context. The examiner must distinguish what the record shows from what they infer or conclude.

Preserving an image and examining it are separate tasks. A focused review may answer the first question without running every process. Record its limits and go deeper when findings or gaps require it. A missed triage hit does not prove absence from the evidence.

Check the source identifier, file or record reference, and method behind the output. Retain settings, versions and warnings. References vary by application. During a demo, follow one result back to its source and note any manual documentation needed.

Education is an intended use. Public or constructed datasets let students compare findings with known records. Academic licences, class size, support and deployment must be agreed. Example lesson plans are not accredited courses or university endorsements.

No. The selected examples use public teaching material, constructed records or setup screens. Captions identify the source type. A setup screen shows controls, not a completed acquisition or successful unlock.

Edition terms, licence duration, updates and support are still to be confirmed. Third-party components may have separate terms. Ask for these details in the quotation. Do not assume unlimited users, perpetual upgrades or a guaranteed response time.