Keep the source and method together
Identify the exhibit, review its protection state and record the acquisition route. Retain the working-copy identifiers and verification information so the examination can be traced back to the seized source.
For police digital-evidence teams
A seized laptop.
A clearer next step.
Work from a seized computer towards the questions that matter: what happened, which records support it and what needs further examination. Acorn connects acquisition, focused review and examiner handover.
Planned release Q1 2027 · Explore the workflow and check build support.
View full screen
Law enforcement
From a seized device to a question you can answer
A laptop recovered during an investigation may hold messages, browsing records, documents and deleted material. The useful starting point is the allegation and relevant period, not an indiscriminate search through every file.
Acorn is the forensic operating system; Workbench brings supported evidence, processing and review into a case. An examiner can inspect a record, follow it back to its source and retain the context behind a finding. For a unit evaluating the workflow, those steps should be demonstrated on known material, using the build and equipment proposed for use.
Find a useful line of enquiry
Focus on a relevant date, document or account. Compare the records around it and identify which questions can be answered from the supplied evidence.
Make the finding reviewable
Carry the selected record, source reference and relevant processing notes into the handover. Show what was examined, what the record supports and which remaining question needs another source or examiner.
EXAMPLE WORKFLOW
Seized laptop: reconstructing a suspected online fraud
Example workflow: a laptop is seized in an investigation involving fraudulent sales. The examiner is asked to review a defined period for relevant browser activity, documents and deleted receipts.
Preserve the laptop and define the review
Record the exhibit and its condition, agree the scope and use an appropriate acquisition route. Keep the original source protected while working on the preserved copy.
Connect the relevant records
Inspect browser visits and related files, then review surviving deleted material where useful. Compare timestamps and source paths to build a sequence that can be checked against the allegation.
Report the finding and the next question
Select the relevant records and retain their source references, processing details and any coverage gaps. Explain what the laptop shows, what needs provider or account evidence and the next examination that would test the interpretation.
Illustrative scenario, not a reported police case. The screenshots use separate training sources. Browser activity alone does not establish a completed transaction or identify the user.
View full screenA useful evaluation
Bring the requirements that matter.
- Exhibit types and investigative questions
- Exact build, equipment and validation criteria
- Source references and processing coverage
- Review, escalation and investigator handover
Where does triage end and a full examination begin?
Set a question and an escalation point before starting. A focused review can identify a lead or answer a limited question. Widen the examination when a missing source, unexplained result or competing account could change the answer.
How do we assess the workflow for our unit?
Define test material and acceptance criteria, then record expected and observed results, the build, equipment and known limits. Repeat important checks and retain the record for your quality process. Buying software does not replace that validation.
What can we bring to a demonstration?
Bring a common exhibit type, an investigative question and the records you would expect to find in approved test material. Include the output your investigators and quality reviewers need, rather than only a list of features.
How should recovered files be assessed?
Check their structure, completeness and context. Recovery can lose original names or paths, so compare the recovered content with other available records before drawing a conclusion.
The planned 2027 bundle
Take the workspace with you.
The proposed portable bundle pairs Acorn with a workstation, USB-C-powered screen, mini keyboard, mouse and carry bag.
Working specification: 24 GB RAM, AMD Ryzen 9 or Intel Core i9, and a 1 TB PCIe SSD. Final components and compatibility are still being selected.
Explore the planned bundle ↗COMING SOON · Q1 2027
Target RRP under £3,000 GBP
Provisional specification and price target. Final VAT treatment, delivery, licence terms and availability will be confirmed before orders open.
Notify me + 10% launch offer ↗No deposit or pre-order is taken here.
Start with your requirements
Bring a question from your unit
We can plan a demonstration around a typical exhibit, the decisions your examiners make and the handover your investigators need.
About the screenshots and illustrations
Application screens are selected from the September 2026 Acorn screenshot pack. Captions distinguish native setup views, constructed training records and public-corpus results. They are not private client cases, and a displayed control does not establish that every operation was completed.
Relevant public sources include DeepBlueCLI training event logs and Plaso test data. Check the relevant source terms before redistributing an underlying dataset.
Workspace scenes and sector mascot variants are generated illustrations. They do not show actual police, judicial, military or university deployments or endorsements. The original Squirrel Forensics identity is retained.