Forensic software development
Co-Founder of The Acorn Forensic Operating System
Alistair Ewing is a co-founder and director of Squirrel Forensics Ltd, the company behind The Acorn. He has helped develop this portable Linux-based digital forensics and incident response operating system.
Product development and independent casework remain distinct · Methods are selected for the case and evidence available
A complete investigation environment
Designed around the forensic workflow
The Acorn is designed as a complete forensic operating system, not a single forensic application. Its desktop, evidence-device controls, acquisition routes, Forensic Workbench and focused applications are arranged to help an examiner move from source identification and preservation through analysis and reviewable output.
The operating system groups more than 30 focused applications around areas such as acquisition, recovery, host artefacts, structured data, text, media, memory, network evidence, mobile collection and reporting. Each capability still has its own supported inputs, validation requirements and release boundary.
That distinction matters. A menu entry does not prove that every source, operating-system version or evidence format is supported. Current features and availability should be checked on the official Squirrel Forensics website.
Interface tour
Acquisition, examination and review in one environment
These screens use demonstration material to show how different parts of an investigation can be brought together. A visible tile or interface does not mean that every source, format or workflow has the same release status or validation boundary.
Check current availability. Product features, supported inputs and release status can change. Confirm the current position at sqfr.uk before relying on a particular workflow.
What the development perspective contributes
Forensic workflow informed by real evidence questions
Acquisition before interpretation
Source identity, authority, protection, collection method, verification and exceptions should be recorded before the resulting data is treated as evidence.
Tools with stated limits
Application output is a starting point for examiner review. Significant findings need source context, appropriate validation and a clear account of uncertainty.
Reviewable hand-off
Manifests, hashes where applicable, logs and structured outputs help another examiner or legal team understand what was done and what remains unresolved.
Evidence protection
Precise claims about source handling
Acorn includes fail-closed software write protection using the operating system block layer for supported connected storage. It must not be described as a physical hardware write blocker or as a guarantee that every source can never be changed.
The required source-handling method remains a case decision. An approved physical blocker, another validated acquisition route or a specialist environment may be more appropriate for a particular device, policy or instruction.
Independent instructions
The case determines the method
Product ownership does not determine the opinion or tool choice in Compute Forensics work. The questions, available evidence, source condition, proportionality, procedural requirements and limitations determine the methods used.
If Acorn is used, that use can be identified like any other relevant method or tool. If another validated route is better suited to the source or receiving party, it can be selected instead. The opinion must follow the evidence, including findings that do not support an instructing party.
Separate roles, clear boundaries
Software development is not a substitute for case-specific validation
Squirrel Forensics Ltd develops The Acorn. Compute Forensics provides independent professional services. The connection gives Alistair a practical software-development perspective, but it does not imply that every Compute Forensics instruction uses Acorn, that every product capability is suitable for every case, or that product development replaces documented examination and review.
For current product information, release status and enquiries about The Acorn itself, visit sqfr.uk. For an independent evidence instruction, start with the case question and the material available.
Start with the right route
Product enquiry or independent forensic instruction?
Use Squirrel Forensics for current Acorn product information. For independent casework, send only party names, the evidence question, deadline and a high-level source description until conflicts and suitability have been checked.