The Acorn application guide

Workflow Coach

Use a Windows dead-box checklist to plan preservation, hashing, triage and reporting. The checklist prompts the examiner; it does not validate the chosen method. Linked-tool launches were not tested in this example.

Teaching checklist

Plan the steps of a Windows examination

Example input

A Windows dead-box examination checklist in the teaching interface.

Result or controls shown

A structured teaching and planning checklist.

The built-in Windows examination checklist sets out preservation, hashing, triage and reporting steps. An examiner can select a step and open its linked tool where available.

Enlarge the screenshot to read the source records.

Examination steps

Steps to review in your evaluation

Start with source preservation and the scope of the exercise.
Work through the hashing, triage and review prompts against the supplied evidence.
Record what was checked and adapt the method to the actual question and limitations.

Related application guides

Start with your requirements

Request an application demo

Tell us the source type and task you want to examine. We can plan a demo using suitable training material. Do not send confidential evidence.