Acorn application guide
Artifact Lab
Choose the artefact that can address the question, then inspect what its parser actually returned. Artifact Lab's demonstrated task and Prefetch workflows support focused examination. A successful stage label is not a substitute for checking the output and its diagnostics.
Demonstrated on constructed training data
What does a focused Windows artefact parser return for this specific source?
Start with
- Constructed Scheduled Task XML and public Prefetch files demonstrated in the source material.
What you can take away
- Per-artefact CSV results and limitations for the demonstrated parsers.
View full screenOpen the screenshot and choose “View actual size” to read the records at their original resolution.
A practical starting point
How the workflow fits together.
Select the artefact action and a matching source, with a clear question to be answered.
Inspect the per-artefact rows alongside any diagnostics or limitations. Distinguish an extracted record from an error message placed in an output table.
Check material fields against the source or a suitable independent parser. Keep the exact input, method and observed result together in the examination record.
Evaluate the workflow
Questions worth bringing to a demonstration.
- For this particular input, does the output contain parsed records, diagnostics or both?
- Can the fields needed for my question be checked back against the source or another method?
- Which demonstrated output applies to this parser, rather than to an older or different combined reporting route?
Useful next steps
Start with your requirements
Bring a sample question.
Ask us to demonstrate this workflow with suitable public or constructed material. Do not send confidential evidence in an initial enquiry.
Planned for Q1 2027
Be first to hear. Save 10% at launch.
Request Acorn launch news and details of the planned 10% offer. No deposit or purchase commitment.
Launch-update requests go to the SQFR team for review. Final offer terms and product availability are still to be confirmed.
About the screenshots and illustrations
Application screens are selected from the September 2026 Acorn screenshot pack. Captions distinguish native setup views, constructed training records and public-corpus results. They are not private client cases, and a displayed control does not establish that every operation was completed.
Relevant public sources include DeepBlueCLI training event logs and Plaso test data. Check the relevant source terms before redistributing an underlying dataset.
Workspace scenes and sector mascot variants are generated illustrations. They do not show actual police, judicial, military or university deployments or endorsements. The original Squirrel Forensics identity is retained.