MARAFORENSICS
Discuss a collection

BUILT FOR LAW ENFORCEMENT

Signal & WhatsApp.
iPhone & Android.

MARA’s acquisition and decryption workflow, made easy. Collect supported messaging data from an accessible phone, decrypt it locally, and get to the conversations in MARA Analyzer.

No full file system extraction required.

See an agency demo See the workflow

Signal + WhatsApp · Both platforms · Evidence stays local

MESSAGING EVIDENCE, MADE ACCESSIBLELOCAL ONLY
From the phone. To the conversation.Acquisition → decryption → local review.
Illustrative workflow. Supported sources and required key material apply.

COLLECT THIS DEVICE NOW

Acquisition to decryption.
Made easy.

Start in your agency’s portal. Create or select a matter, enter the case number, evidence ID, and examiner, then choose Collect This Device Now.

Internet is required to authorize the collection. The evidence stays on your agency’s storage; a saved completion receipt can synchronize later.

Follow the local workflow
SIGNAL + WHATSAPP WORKFLOWNo full file system required

01 / SIGNAL + WHATSAPP · IPHONE + ANDROID

Two apps.
Both platforms.

Connect an accessible iPhone or Android phone. Follow MARA’s device and app prompts to acquire the supported messaging sources.

The examiner controls acquisition. Evidence stays on agency storage.

Illustrative workflow and fictional records. Animation is not a collection speed estimate.

02 / ACQUIRE THE MESSAGING SOURCE

Get the source.
Skip the full file system.

MARA brings supported Signal and WhatsApp sources from the phone into a local collection, ready for decryption and processing.

No full file system extraction required. Source and key requirements still apply.

Illustrative workflow and fictional records. Animation is not a collection speed estimate.

03 / LOCAL DECRYPTION + PROCESSING

Encrypted sources in.
Readable messages out.

MARA Analyzer decrypts and parses supported Signal and WhatsApp sources locally. Review the available messages and attachments.

Required backup and key material apply. Evidence stays local.

Illustrative workflow and fictional records. Animation is not a collection speed estimate.

04 / FOLLOW THE CONVERSATION

The messages.
Ready for your examiner.

Review Signal and WhatsApp conversations and available attachments in Analyzer, alongside other supported phone records. Prepare reports and supported exports on your agency’s computer.

Agency-controlled files, review, and retention. No evidence uploads.

Illustrative workflow and fictional records. Animation is not a collection speed estimate.
Skip animation

THE MESSAGES THAT MATTER

Two messaging apps.
Both mobile platforms.

A focused path to Signal and WhatsApp evidence on iPhone and Android. Acquire supported sources, decrypt them locally, and review the available messages and attachments—without a full file system extraction.

Signal

iPhone + Android

Collect supported Signal data from iPhone and Android, then decrypt and review it locally in Analyzer with the required backup and key material.

WhatsApp

iPhone + Android

Collect supported WhatsApp data from iPhone and Android, including encrypted Android backup workflows. Process the source and review available conversations and attachments locally.

More context, when needed

Bring supported iMessage, SMS, Calls, and Contacts into the review alongside messaging-app evidence. Available categories depend on the phone and collection scope.

Designed for devices you can unlock and authorize. Available data depends on the device, app, source, and collection scope. MARA does not bypass a phone’s passcode or guarantee deleted-message recovery.

A CLEAR SEPARATION

Track the work.
Keep the evidence.

Law Enforcement accounts use a dedicated local-only policy. File uploads are blocked by the service as well as the app.

YOUR AGENCY’S STORAGE

Collection and analysis files

  • Phone collection output and messaging sources
  • Analyzer cases, reports, and exports
  • Attachments and diagnostic files

Your agency manages storage, access, retention, and backups.

MARA PORTAL

Operational records

  • Structured case inventory and device entries
  • Examiner and collection status
  • Licensing, credit balance, and completion receipts

No evidence, report, or attachment upload. No “upload later” option.

AN AGENCY LICENSE. NO MACHINE LIMIT.

Equip your team.
Plan for your volume.

Use MARA across your agency’s Windows computers. Collection credits are shared by the agency, with usage visible in the portal.

Install where your examiners work. You are licensing collection capacity, without a per-computer charge.

MARA LAW ENFORCEMENT

A license for your agency.

  • Unlimited agency machines
  • Local collection and MARA Analyzer review
  • Supported Signal and WhatsApp processing
  • Software updates and technical support
  • Portal case inventory and credit tracking
Discuss agency licensing

Talk with MARA about your team, collection volume, onboarding, and subscription requirements.

BEFORE YOU BEGIN

A few practical
details.

Do we need a full file system extraction?

No. MARA’s supported Signal and WhatsApp acquisition and decryption workflows on iPhone and Android do not require a full file system extraction. You need an accessible, authorized device and the source material required for that workflow, including any necessary backup password or recovery key.

Does a normal iPhone backup contain Signal?

No. An ordinary iPhone backup is not a Signal collection. MARA’s Signal workflow acquires supported Signal sources separately and brings them into local decryption and review.

Can we upload evidence, reports, or attachments?

No. Law Enforcement accounts cannot upload files to MARA, including evidence, reports, attachments, and diagnostic files. The portal holds structured operational records and licensing information.

What counts as a collection?

One credit is reserved when a collection is authorized and used when it completes successfully. Failed attempts do not consume a completed-collection credit; retrying the same completion receipt does not charge another credit.

Is this an offline tool or a standalone desktop license?

New collections start in the portal and need an internet connection for authorization. The app performs collection on your Windows computer, with evidence remaining local. A saved completion receipt can synchronize later.

Does the custodian have to remain present?

The workflow does not require a custodian-presence confirmation. Your investigator must have the necessary authority and be able to unlock the device and complete its authorization prompts.

Can another forensic tool open the output?

Compatibility depends on the collection format and the receiving tool. Open MARA Targeted packages in MARA Analyzer or Review first, then use supported exports. A targeted package is not a full phone image and is not promised as a direct input to every forensic suite.

Does MARA unlock phones or recover every message?

No. This workflow requires accessible devices and supported sources, plus any required backup passwords or recovery keys. Available history and attachments depend on the source. This does not bypass device security or guarantee deleted-message recovery or support for every app version.

LET’S TALK ABOUT YOUR AGENCY

See Signal & WhatsApp.
From phone to review.

See how your team can acquire, decrypt, and review supported messaging evidence from iPhone and Android while keeping the files on agency storage.

Request an agency demo

Email opens with “MARA Law Enforcement” in the subject.
Keep inquiries general. Do not send evidence, case facts, passcodes, or recovery keys.