COMING SOON · Q1 2027 Planned releaseGet notified + 10% launch offer ↗
Illustrative Acorn workspace for defence & field work

For authorised defence investigations and training

A field collection.
A laboratory-ready handover.

Explore a portable forensic workspace for authorised defence investigations and training. Plan the acquisition, equipment and records together, so the laboratory receives the evidence and its context.

Explore the workflow

Planned release Q1 2027 · Explore the workflow and check build support.

The Acorn Forensic Imager with its disk inventory populated. This interface view shows source selection, not a completed acquisition or a defence deployment. View full screen
The Acorn Forensic Imager with its disk inventory populated. This interface view shows source selection, not a completed acquisition or a defence deployment.
Defence & field work Sleuthy sector illustration

Defence & field work

The working conditions shape the method

A team working away from its main facility may need to preserve a storage device before a specialist can examine it. Limited connectivity, uncertain media condition and a short working window make preparation important.

Acorn provides a forensic operating environment rather than a guarantee about the equipment around it. Plan a trial using the exact computer, boot route, adapters and media proposed for the task. The useful result is a tested acquisition and handover method for that configuration, with the remaining constraints recorded.

Test the whole kit as a system

Check the computer, build, display, adapters, source media and destination storage together. Include power, usable capacity and update arrangements, so the trial reflects the conditions the team expects.

Keep source handling clear

Review the device identity and protection state, select the approved acquisition route and retain the record. Document a change in source condition or scope when it occurs.

Prove the handover in an exercise

Give a second examiner the preserved copy and agreed records. Check whether they can verify the acquisition, identify the source and understand the work left for the laboratory.

EXAMPLE WORKFLOW

Training exercise: collection at a temporary field workspace

An authorised team must preserve a storage device at a temporary location and hand it to a laboratory. The exercise uses owned training media and assumes no reliable internet connection.

  1. Prepare before the exercise

    Agree the authorised task, handling rules and acquisition scope. Test a known build with the intended hardware, adapters and media, including operation without connectivity, power arrangements and destination capacity.

  2. Collect and review the acquisition record

    Identify the source and destination, use the approved method and review the recorded result. Keep unexpected encryption, read errors or incomplete coverage in the handover notes.

  3. Transfer evidence and context together

    Package the working copy and records under the agreed procedure. Give the laboratory the source identifiers, verification information, collection limits and questions for examination.

Proposed training workflow, not a claim of military deployment or security approval. Equipment and software suitability require the organisation's own assessment.

Network Workbench examining a public Plaso packet capture from July 2013. Its historical conversations illustrate review tools, not operational defence traffic or a finding of malicious activity. View full screen
Network Workbench examining a public Plaso packet capture from July 2013. Its historical conversations illustrate review tools, not operational defence traffic or a finding of malicious activity.

A useful evaluation

Bring the requirements that matter.

  • Authorised task and local approval requirements
  • Exact hardware, build, adapters and media
  • Offline trial, power and update arrangements
  • A repeatable acquisition and laboratory handover
Explore the focused applications ↗
Which parts can run without an internet connection?

Trial the intended local-evidence workflow without connectivity and record any blocked steps. Include software preparation, licence requirements, optional lookups and updates in the plan; a successful connected demonstration does not establish an offline deployment.

What security approval is supplied?

No military or classified-use approval is claimed. Your security and procurement teams must assess the system against the intended information, environment and handling rules.

Is the proposed kit a ruggedised field system?

The portable concept is not an environmental rating. Discuss transport, temperature, physical protection and power requirements separately when selecting hardware.

How should we test the handover?

Have another examiner receive only the preserved copy and agreed records. Ask them to verify it, identify the collection limits and continue the task. Use the gaps they find to improve the team's procedure before operational consideration.

The planned 2027 bundle

Take the workspace with you.

The proposed portable bundle pairs Acorn with a workstation, USB-C-powered screen, mini keyboard, mouse and carry bag.

Working specification: 24 GB RAM, AMD Ryzen 9 or Intel Core i9, and a 1 TB PCIe SSD. Final components and compatibility are still being selected.

Explore the planned bundle ↗

COMING SOON · Q1 2027

Target RRP under £3,000 GBP

Provisional specification and price target. Final VAT treatment, delivery, licence terms and availability will be confirmed before orders open.

Notify me + 10% launch offer ↗

No deposit or pre-order is taken here.

Start with your requirements

Plan a field-to-laboratory demonstration

Describe the proposed equipment, working conditions and handover. We can help define a practical evaluation, without implying deployment approval.

About the screenshots and illustrations

Application screens are selected from the September 2026 Acorn screenshot pack. Captions distinguish native setup views, constructed training records and public-corpus results. They are not private client cases, and a displayed control does not establish that every operation was completed.

Relevant public sources include DeepBlueCLI training event logs and Plaso test data. Check the relevant source terms before redistributing an underlying dataset.

Workspace scenes and sector mascot variants are generated illustrations. They do not show actual police, judicial, military or university deployments or endorsements. The original Squirrel Forensics identity is retained.

Zoom in, then scroll to inspect the detail.

Open full-resolution image ↗

A useful first conversation

Let’s look at your workflow.

Tell us what you examine, where you work and what you need to deliver.

Use the enquiry form to outline your role, intended use and potential order quantity. Do not send case material through a general enquiry.

Your enquiry goes to the SQFR team. Please do not include passwords or case evidence.