Acorn questions, answered.

The Acorn is a portable Linux forensic operating system with acquisition, examination and reporting tools brought into one workspace. The planned workstation bundle pairs that environment with portable hardware. The software, hardware and included capabilities should be confirmed for the edition you choose.

SQFR is Squirrel Forensics, the company behind the product. Acorn Forensic OS is the Linux-based examination environment. Workbench is its case-based workspace for supported evidence, processing and review. Focused applications provide routes into particular tasks and evidence types.

The current target is Q1 2027. That is a release target, not a guaranteed delivery date. The screens show development builds and documented examples; final availability and the capabilities included in each edition will be confirmed before orders are taken for the new bundle.

The provisional specification is an AMD Ryzen 9 or Intel Core i9 system, 24 GB RAM and a 1 TB PCIe SSD, with a USB-C display, mini keyboard, mouse and carry bag. Exact processor generation, models and final contents are still to be confirmed. Please treat this as a proposed configuration, not a shipping specification.

The target RRP for the proposed bundle is under £3,000. This is an indicative target, not a fixed quotation. Final pricing, VAT treatment, delivery, included software, licence terms and support will be stated clearly before purchase. The planned bundle is not currently available to order.

A 10% launch offer is planned. Eligibility, applicable products, the discount basis, dates and exclusions are still to be confirmed. You can request launch updates now. SQFR reviews each request; submitting the form does not automatically enrol you, reserve a unit or apply a discount.

Not yet. The planned Q1 2027 bundle is not available to order and we are not taking deposits for it. Contact and launch-update forms send a real request to info@sqfr.uk for the team to review. They do not process a purchase or automatically add you to a mailing list. Final pricing, availability and terms will be confirmed before orders open.

Yes, contact SQFR with the task you need to perform, the source formats and the output you need. Team size, hardware constraints and teaching requirements are helpful too. Start with a description or agreed test material; do not send client evidence or credentials in a general enquiry.

No. It is a connected environment for supported tasks, not a promise to replace every specialist capability. Use a demonstration and your own validation to decide where it fits. Keep established methods, independent checks and other tools where the evidence or your procedures require them.

Many demonstrated workflows analyse local evidence and write local outputs. Connectivity requirements still vary: downloads, updates, online lookups, some maps and provider services may need access. Discuss the exact workflow and deployment requirements rather than assuming every component works offline or is approved for an isolated environment.

The sector pages describe intended workflows, not official approval, accreditation or a guarantee of admissibility. Suitability depends on the evidence, the method and your organisation's validation and security requirements. A mascot, report logo or software-generated hash does not establish certification.

Choose a specific exchange or comparison: the same source image, an exported record set or a selected finding. Check formats, versions and source references in both workflows. Do not assume a competitor's native case can be imported, a Windows application runs inside Acorn or a direct integration exists without a demonstrated supported route.

Agree one task, representative authorised test material and acceptance criteria. Record the build, hardware, method, expected result and observed result. Complete the review and handover, including a second examiner where useful. Use the recorded benefits, gaps and support questions to decide whether the workflow fits your organisation.

Rerun relevant known test cases and compare the new results with the recorded expectations. Review changed fields, unsupported inputs and release notes, then decide whether local procedures or training need updating. Retain that assessment as part of your own validation and change-control process.

Acquisition captures an authorised source into an evidence image or selected collection. Parsing reads records inside available evidence and presents their structure. Being able to image a device does not mean every file system, encrypted volume or application record on it can be understood.

The technical guide separates documented routes from example-tested results and open gaps. Browser-extraction examples cover several Windows, Linux and Apple file systems and common disk-image containers. Those results apply to the stated workflow, not every Acorn app. Check your exact source, format version and required output before relying on a route.

Example-tested means a documented example produced the stated result. Documented workflow means a route is described but this review does not establish a completed test for your source. In development marks a stated unfinished feature. Not verified means the evidence is insufficient or a known support gap remains; it does not automatically mean development is under way.

Device Manager exposes device state and supported read-only access controls. The platform uses software protection through the Linux block layer, not a hardware write blocker. Check the source and destination before work, record the method, and use any hardware protection and validation required by your procedure.

Only where there is a supported route and the necessary lawful access, credentials or keys. Encryption type, version and source condition matter. A password field or recognised container is not proof of successful unlocking. Some documented routes report locked volumes without opening them, and no universal decryption is promised.

There are recovery and carving workflows, with documented examples and clear limits. Success depends on what remains, the file structure, fragmentation and overwriting. A file that opens is not necessarily complete or byte-identical. Compare it with an independent reference where possible and retain warnings about partial or uncertain results.

Acorn Forensic Actions uses the selected item's structure and context to offer relevant routes. A folder menu can offer Artefact Lens, rapid triage, a directory inventory and an intelligence report. The available actions depend on the selection; seeing an action in the menu is not proof that it will process every variant successfully.

Artefact Lens explains why a selection was recognised, identifies relevant companion files and suggests a suitable parser. Its file-manager view is for inspection; parsing that creates case outputs is handed to Workbench. The contextual intelligence-report option is a separate action. Neither route turns recognition alone into a forensic finding.

The demonstrated outputs include application PDFs, review notes, CSV and TSV tables and structured recovery records. The exact choices and fields vary by tool. Keep the source reference, settings and any incomplete or unsupported results with the output. Not every screen exports every format, and an exported report is not a substitute for the examiner's reasoning.

No. A matching rule, a byte count, a shortcut or a location tag may help direct the examination, but each needs context and corroboration. Acorn's role is to make the records and their limits reviewable. The examiner remains responsible for distinguishing an observation from an inference or conclusion.

A preserved image and the scope of its examination are separate matters. A focused review can answer an initial question without running every available process. Record its limits and go deeper when a finding, missing source or alternative explanation requires it; absence from a triage result is not proof of absence from the evidence.

Check the source identifier, original file or record reference and the method behind the output. Retain settings, tool or build versions and relevant warnings alongside it. Available references vary by application, so use a demonstration to follow one real output back to its source and identify any manual documentation needed.

The demonstrated local workflows do not require evidence to be sent to SQFR for analysis. Any deliberately selected network service has its own requirements and data handling to review. If support needs a sample, agree a safe, authorised route first. Never send confidential evidence or access credentials through a general contact form.

That is a key intended use. Public or constructed datasets let students examine records, compare interpretations and explain limitations in a repeatable practical. Academic licensing, class size, instructor support and deployment arrangements still need to be agreed. Example lesson plans are not accredited courses or claims of university endorsement.

The selected examples use documented public teaching material, constructed records or native setup views. Captions identify the type of example and important limits. A menu or setup screen demonstrates the interface; it does not show a completed acquisition, a successful unlock or proof that every listed feature was tested.

Final edition terms, licence duration, permitted use, updates and support arrangements are still to be confirmed for the proposed release. Third-party components may have separate conditions. Ask for these details in the quotation; do not assume unlimited users, perpetual upgrades or a guaranteed response time from a screenshot or feature list.