Designed in the UK
TARGETING LATE Q4 2026Release date and final specification to be confirmedJoin the launch list for the planned 10% offer
← The Acorn overview

The Acorn application guide

Text Lab

The example narrows a public DeepBlueCLI export to 71 PowerShell rule matches. Read each command beside its time, computer and event ID. A rule label is a review lead, not proof that a command completed.

Public training example

Filter a large event-log table to specific commands

Example input

  • Forensic text logs and CSV records, including a public PowerShell-related example.

Result or controls shown

  • Filtered tabular and text review views.
Text Lab: filter a large event-log table to specific commands in the training example. View full screen
A CSV filter selects 71 Potentially Malicious PwSh rule matches from a public DeepBlueCLI export. Each row retains its time, computer, event ID and command details.

Enlarge the screenshot to read the source records.

Examination steps

Steps to review in your evaluation

  1. Open the relevant table or text output.

  2. Filter the records while retaining event IDs, times and command context.

  3. Return to the underlying source before treating a match as a finding.

Related application guides

Forensic WorkbenchTimeline ViewerArtifact LabAll forensic apps

Start with your requirements

Request an application demo

Tell us the source type and task you want to examine. We can plan a demo using suitable training material. Do not send confidential evidence.

Zoom in, then scroll to inspect the detail.

Open full-resolution image ↗

A useful first conversation

Let’s look at your workflow

Tell us what you examine, where you work and what you need to deliver.

Use the enquiry form to outline your role, intended use and potential order quantity. Do not send case material through a general enquiry.

Open the enquiry formEmail info@sqfr.uk

Your enquiry goes to the SQFR team. Please do not include passwords or case evidence.