Piloted in practical teaching
The Acorn has been piloted within University of Staffordshire's Computing Department and used by students during practical Digital Forensic Investigation master's work.
For lecturers, students and training providers
Practical digital forensics for universities
The Acorn gives universities a portable forensic environment for practical teaching. Students can protect and acquire evidence, recover files, inspect records and explain how they reached their findings.
Local evidence analysis can run offline. Remote sessions, cloud collection and online lookups need network access.
Targeting late Q4 2026 · Explore the workflow and check build support.
View full screen
University of Staffordshire collaboration
Developed through practical university experience
Since March 2026, Squirrel Forensics has been working closely with University of Staffordshire's Computing Department to explore how The Acorn can support practical digital forensics education.
The collaboration has provided valuable insight into teaching requirements, student workflows and the practical use of The Acorn within a university environment.
University experience informing development
Feedback and experience from the pilot have helped Squirrel Forensics refine The Acorn and continue to inform its development for practical digital forensics teaching.
Teaching experience with the pilot
Squirrel Forensics kindly let us use a pilot device for teaching purposes under an NDA on our Digital Forensics Investigation award during Semester 1 and Semester 2 of academic year 25/26. The students contributed with their views about the device and their feedback is included below.
The Acorn proved to be a versatile device, portable and easy to set up with a HDMI screen/USB screen and mouse. The Linux environment took little time for the students to get used to and Linux formed part of the curriculum.
The Acorn is password protected and is stand alone in that it doesn’t have to be connected to the University internal network or the internet. For the pilot we had one device available, each of the students could use it with their own folder on the device for saving investigative results.
The Acorn software has a comprehensive range of forensic open-source tools provided via a Menu of tools.
During our pilot a development of workflows that the students could use emerged, for a particular forensic task a recommended tool or tools was suggested. This is indicative of the breadth and depth of the toolkit available on The Acorn.
We found The Acorn augmented our Forensic lab as it provided specialised tools and reporting facilities including screen shot facility with either a Digital Forensics (DF) or Digital Investigative (DI) focus which proved useful for student assignment submission.
In summary, The Acorn provides practical exposure to digital forensic procedures, for example, the inbuilt software write blocker was invaluable in practically showing the importance of data curation.
This testimonial relates to the pilot version of The Acorn used during the 2025/26 academic year. The current version of The Acorn Forensic OS presented on this website has since been further developed and differs from the pilot device and software described above. The University of Staffordshire will be using the latest version during the 2026/27 academic year.
Why it works for teaching
Teach more than which button to press
A successful practical is about more than operating an application. Students need to recognise the evidence source, inspect the records and decide whether those records answer the question.
The Acorn connects a forensic operating environment, the Forensic Workbench for case review and focused applications for individual artefacts. Lecturers can link exercises to learning outcomes. Students compare source material and explain how it supports their findings.
Connect the workflow to the learning outcome
Start with the forensic decision students need to understand, then choose the evidence and workflow. Connect acquisition and examination to the conclusion they must justify.
Make the practical repeatable
Use a known teaching dataset, expected records and a reset procedure. Keep the build and settings with the exercise so differences between results can be examined.
Teach students to justify their findings
Ask students to separate the evidence from their interpretation. Their report should explain the method, supporting records and limits to someone who did not watch the practical.
What students can learn
Develop practical skills across the forensic process
Build connected practicals around your modules, from protecting a source to explaining a finding. Choose the evidence types and workflows that suit the learning outcome.
Protect and acquire evidence
Inspect connected devices, protect source evidence and plan forensic or logical acquisitions. Record hashes and case details.
Try in a practical
Explain how you would confirm the source, destination and protection state before acquisition.
Recover and examine files
Identify recoverable deleted files and assess the results. Keep each file connected to its source and note any missing content.
Try in a practical
Compare a recovered file with a known original. Separate a usable preview from a complete recovery.
Examine host and system artefacts
Use file-system and host records to investigate activity. Check what each record can establish and where its limits lie.
Try in a practical
Compare two artefacts that record the same activity. Explain any difference in their timestamps.
Review structured data and timelines
Filter browser records and other structured data. Trace selected entries to their source and reconstruct relevant activity.
Try in a practical
Choose a time period, retain the source-row references and explain what the selected records leave out.
Investigate memory, networks and suspect files
Introduce memory review, saved network traffic and suspicious-file examination. Match each exercise to the supplied edition’s tested tools and inputs.
Try in a practical
Use controlled teaching material. Distinguish a setup screen, a review lead and a verified result.
Interpret and report findings
Compare results, retain provenance and document the method. Explain how the evidence supports a conclusion and what remains uncertain.
Try in a practical
Ask a classmate to follow your report back to the source. Note what they need to repeat the work.
Illustrative case workflow
A website visit is not an upload: can the class prove the difference?
A tutor supplies a resettable training image, a browser database and a separate account-log extract. The exercise asks whether a fictional student uploaded a document. Each group must build an answer from the records, not from a suggestive filename.
Give groups a known starting point
Keep the teaching image, expected hashes and tutor answer key. Students record the build and inputs, protect the source and identify the supplied browser records and their time zone.
Compare two versions of the story
One dataset contains only a visit to a file-sharing site. A second adds an account event for an upload. Students trace each finding to the original row and explain what the additional source changes.
Exchange and challenge the reports
Ask another group to reproduce the timeline and test an alternative explanation. Mark the source references, reasoning and limitations as well as the technical output. Discuss the institution’s class size and teaching needs for a bespoke setup.
Fictional scenario for evaluating the workflow. Any genuine application captures use separate training material.
View full screen
Follow the evidence, not the assumption
Open a record to see the next check.
Only browser history is supplied
A visit establishes recorded browsing activity, not a completed upload. What further source would answer the question?
An account event is added
Check the event meaning, account, file reference and time. Explain whether it supports the transfer claimed in the exercise.
Two groups disagree
Compare inputs, time-zone settings, parser versions and selected rows. The exercise should make differences explainable.
Planned portable teaching bundle
Bring a forensic workspace into the classroom
Build a teaching setup around the equipment your institution already has. We can discuss suitable monitors, keyboards, mice and connections alongside the portable workstation.
Target specification: 24 GB RAM, AMD Ryzen Embedded, 6 cores / 12 threads, and a 1 TB PCIe SSD. Final components and compatibility are still being selected.
Tell us your class sizes, modules, existing equipment and support needs. We will discuss a bespoke configuration and quotation for your institution.
Images show earlier hardware. Final components, ports and compatibility remain subject to confirmation. Check display connections and USB-C video and power support against the supplied model.
Explore the planned workstation
Start with your requirements
Build practical digital forensics into your teaching
Tell us about your modules, class sizes and practical objectives. We can discuss relevant workflows, application coverage and a bespoke setup and quotation for your institution.