SQUIRRELFORENSICSDesigned in the UK
For lecturers, students and training providers
Turn acquisition, artefact review and recovery into practical lessons with a known starting point. Students can use real forensic interfaces, test a hypothesis and show how they reached an answer.
Planned release Q1 2027 · Explore the workflow and check build support.
View full screen
Education & training
A strong practical is more than a successful button click. Students need to recognise the source, inspect records and decide whether a finding answers the question. Known teaching data gives the instructor something concrete against which to assess that reasoning.
Acorn provides the forensic operating environment, with Workbench for case review and focused apps for individual artefacts. Map a practical to a learning outcome: preserving a source, explaining a timestamp, comparing parsers or reporting a bounded finding. A repeatable dataset and clear marking criteria matter more than the number of applications a student opens.
Choose the forensic decision students should understand, then select the relevant workflow. Separate acquisition, parsing and interpretation so a successful operation is not mistaken for a justified conclusion.
Keep a verified teaching master, expected records and a reset procedure. Record the software build and exercise settings so a difference between student results can be investigated rather than guessed at.
Ask students to identify the source record, justify the conclusion and propose a further check. Their report should make sense to someone who did not watch the practical.
EXAMPLE WORKFLOW
Students receive a constructed browser History database and a short brief about a document. Their task is to investigate a possible transfer and explain what the records can establish.
Provide the same verified dataset, software build and collection note. State the learning outcome, then ask students to identify the database, record types and period before proposing an explanation.
Filter the visits and inspect a relevant period in the timeline. Follow selected entries back to their source rows, compare stored and displayed times and record the steps used.
Ask students to distinguish a visit from a transfer, cite the supporting source rows and propose a corroborating source. Use peer review and a short marking guide to assess reasoning, reproducibility and recognition of missing evidence.
Suggested teaching exercise using constructed data, not an accredited course or a claim of university endorsement.
View full screenA proposed 90-minute practical
Give students a known training dataset and an examination question. Record source hashes, scope and time-zone assumptions.
Review a timeline and a second artefact source. Ask students to identify an observation, an inference and a gap.
Exchange findings, check source references and discuss alternative explanations. Assess reasoning, not the number of alerts.
Suggested lesson structure, not an accredited course or a claim of a completed institutional deployment.
A useful evaluation
Yes, an instructor can vary the question and expected explanation. An introductory group might interpret one artefact; an advanced group could compare sources or parsers and review another student's method. Map the exercise to your own curriculum and assessment.
Discuss class size, equipment, required applications, academic licence terms and support. The proposed new system targets Q1 2027; confirm the edition and timetable before making it essential to a module.
Keep a verified teaching master and issue working copies. Record the build, settings, expected records and reset steps. After an update, rerun the practical before class and note any changed results or instructions.
Check the licence of each public corpus before distributing it. For your own constructed material, record ownership and provenance and remove any unintended personal information.
The planned 2027 bundle
The proposed portable bundle pairs Acorn with a workstation, USB-C-powered screen, mini keyboard, mouse and carry bag.
Working specification: 24 GB RAM, AMD Ryzen 9 or Intel Core i9, and a 1 TB PCIe SSD. Final components and compatibility are still being selected.
Explore the planned bundle ↗COMING SOON · Q1 2027
Provisional specification and price target. Final VAT treatment, delivery, licence terms and availability will be confirmed before orders open.
Notify me + 10% launch offer ↗No deposit or pre-order is taken here.
Start with your requirements
Tell us the concept you want students to understand. We can explore a demonstration, suitable evidence and the proposed academic setup.
Application screens are selected from the September 2026 Acorn screenshot pack. Captions distinguish native setup views, constructed training records and public-corpus results. They are not private client cases, and a displayed control does not establish that every operation was completed.
Relevant public sources include DeepBlueCLI training event logs and Plaso test data. Check the relevant source terms before redistributing an underlying dataset.
Workspace scenes and sector mascot variants are generated illustrations. They do not show actual police, judicial, military or university deployments or endorsements. The original Squirrel Forensics identity is retained.
