Illustration of The Acorn workstation for DFIR teams.

For incident responders and cyber investigators

Your forensic workspace, local and connected

Collect and triage locally, follow an incident through the records, or connect to your cloud investigation workstation. One portable Linux environment for the office and the field.

Explore the workflow

Targeting late Q4 2026 · Explore the workflow and check build support.

Event Log Viewer examining encoded PowerShell in public DeepBlueCLI training logs. Rule matches and decoded text are review leads, not proof that the commands completed.

Sleuthy for DFIR teams, wearing a black rock-music baseball cap

Local evidence. Remote compute.

Access a Windows cloud workstation from The Acorn

Collect and review evidence locally with The Acorn. When you need Windows tools, use Remmina to connect to an approved cloud workstation.

Connect to Windows

Remmina uses Remote Desktop Protocol (RDP) to display and control Windows from Linux. Windows applications run on the remote machine. Collection and supported review stay local on The Acorn.

Transfer working copies

Send authorised copies to the agreed evidence store using SFTP, which transfers files over SSH. Check the received file hashes. Opening a remote desktop does not automatically upload your evidence.

Choose your cloud host

Use an approved Windows virtual machine on AWS, Azure or Google Cloud. Connect through your organisation's private connection, VPN or gateway. Check the Windows licence and connection method first.

Connection and evidence-handling checklist

Windows and cloud access: Windows Server and licensed Windows 11 deployments have different requirements. Services such as Azure Virtual Desktop, Windows 365 and Amazon WorkSpaces are not interchangeable with a direct Remmina RDP connection.
Access controls: Check the server identity. Allow clipboard sharing and drive redirection only where the task requires them.
Case data: Agree the cloud region, storage, retention and session-recording policy. Transfer only the authorised working copies.
Network and cost: Local analysis can stay offline. Remote sessions and SFTP need network access. Cloud resources may still incur charges after you disconnect.

The diagram shows a connection layout, not a bundled cloud service or a tested deployment. Read the cloud Windows guide for DFIR teams.

Microsoft Windows 11 desktop with the Start menu open, shown inside an illustrated Remmina window on The Acorn desktop. — Microsoft Windows 11 shown in an illustrated Acorn connection layout, not a live cloud session. **Used with permission from Microsoft.** Screenshot source · Screenshot-use terms. Windows and cloud services are licensed separately; no endorsement is implied.

digital forensics and incident response (DFIR) teams

Investigate an account incident

A changed invoice or an unexpected forwarding rule may be the first sign of an account incident. Relevant evidence may be held in messages, mailbox exports, sign-in records and the user's computer.

Preserve the required sources, then choose a question to investigate. Use focused applications to review supported account and device records. Bring findings into Workbench when the case needs a wider review.

Start with a question

Choose the account, device and period to review. Identify the available records and what they can answer, without overlooking material that still needs to be preserved.

Check the source record

Compare a suspicious rule, command or timestamp with the original record and surrounding activity. Examine more material when a finding or gap calls for it.

Establish what happened

Distinguish account access, message changes, downloads and network activity. Compare supporting records before drawing conclusions about the incident or possible data loss.

Illustrative case workflow

An invoice changed. Was the mailbox used to divert payment?

An invoice in a genuine supplier email thread contains new bank details. The supplier denies changing them. The response team is authorised to preserve the messages, Microsoft 365 audit exports and the finance laptop.

Preserve the records
Agree the accounts and dates. Keep original messages, headers, sign-in records and audit exports with their collection details. Coordinate evidence preservation with the team securing the affected accounts.
Compare the findings
Compare rule changes, message activity and sign-ins with the altered invoice. Check the laptop for the document and related browser records. Note time zones, missing logs and source references.
Use remote tools when needed
Keep local triage on The Acorn. Use Remmina for approved Windows cloud tools when needed. Transfer authorised working copies separately and verify their hashes before remote examination.

Fictional scenario for evaluating the workflow. Any genuine application captures use separate training material.

Unified Log Analyser reviewing 31 constructed AuditData records, including sign-in failures, downloads and a rule change. These genuine rule outputs are not independent proof of compromise or exfiltration.

Follow the evidence, not the assumption

Open a record to see the next check.

An inbox rule changed

Check its conditions, destination and audit record. A rule change alone does not establish which messages were forwarded.

A sign-in looks unfamiliar

Compare known travel, VPN use, device records and other events. Location or IP reputation alone is not proof of an attacker.

The bank details differ

Preserve both versions and their messages. Distinguish the document change, account access and any confirmed financial loss.

A useful evaluation

Plan your evaluation

Incident question and preservation scope
Available records, time period and time zone
Criteria for further collection or deeper review
Source-linked technical and incident-management outputs

Explore the focused applications

How do we move from triage into a deeper examination?

Start with a defined question and the relevant records. Note what was not examined. Broaden the review when a finding, gap or alternative explanation warrants it. Triage does not cover the whole incident.

Can a download or forwarding entry establish data loss?

Not on its own. Check what the event records, then compare it with available provider, recipient or network evidence before deciding what left the environment.

Can the account examples be reviewed offline?

Yes. The example uses constructed records stored locally on the workstation. Live collection and optional online checks are separate tasks that need suitable access and a network connection.

What is the best starting point for a demonstration?

Bring an incident question, representative test records and an expected result. We can walk through collection, review and the next checks. Measure the work involved in your own test; this is not a general speed benchmark.

The planned portable bundle

Take the workspace with you

The proposed portable bundle pairs The Acorn with a workstation, USB-C-powered screen, mini keyboard, mouse and carry bag.

Target specification: 24 GB RAM, AMD Ryzen Embedded, 6 cores / 12 threads, and a 1 TB PCIe SSD. Final components and compatibility are still being selected.

Explore the planned bundle

TARGETING LATE Q4 2026

Pricing to be confirmed before launch

Provisional specification. Final VAT treatment, delivery, licence terms and availability will be confirmed before orders open.

Notify me + 10% launch offer

No deposit or pre-order is taken here.

Start with your requirements

Walk through an account incident with us

Bring an incident question and your usual evidence sources. We can show a focused starting point and the decisions that would lead to deeper work.