MARA ANALYZER

Evidence, in working context.

MARA Analyzer is a dedicated workspace for examining collected evidence, reviewing available records, and preparing supported outputs.

Discuss MARA Analyzer All MARA technology

MARA Analyzer · synthetic case

MARA Analyzer evidence review workspace showing a synthetic case

A CLOSER LOOK

Follow the evidence.

From reviewing a conversation to understanding its source. Two short looks inside the Analyzer workflow.

REVIEW & SELECT

The records that matter.

Move from the case overview into messages, select relevant records, and prepare the agreed output.

MARA Analyzer overview of a synthetic demonstration case — Start with the evidence overview.Actual overview + illustrative interaction · sample data

	Time	From / To	Message
✓	09:12	Alex MorganSam Taylor	Is the revised schedule ready?
✓	09:14	Sam TaylorAlex Morgan	Yes. I will send it this morning.
✓	09:18	Alex MorganSam Taylor	Please include the meeting notes.
✓	09:21	Sam TaylorAlex Morgan	The notes are in the project folder.
✓	09:24	Alex MorganSam Taylor	Thanks. I will review them today.

Still preview. The sequence shows the overview, message review, record selection, and export preparation.

KNOW THE SOURCE

A device. Its details. Its context.

Open a device from the case overview to inspect the recorded device details, evidence source, and processing status.

Analyzer case overview with three synthetic evidence sources, including an iOS device — Start with the evidence sources.Actual application captures · animated presentation · synthetic case

Actual Analyzer device details panel for a fictional review phone. Includes platform, model, OS version, account, evidence source, and Ready status. — Start with the evidence sources.Actual application captures · animated presentation · synthetic case

Still preview. Open the iOS source to review the recorded device information and its evidence status.

View the device details at full size

PLAIN-ENGLISH EVIDENCE

Make sense of
the record.

Unfamiliar artifact? Start with a clear explanation.

Analyzer puts plain-English explanations alongside the evidence: what a record means, why it may matter, and what it cannot establish on its own.

Recognized artifacts receive source-specific interpretations. Other records receive a cautious explanation of the available information.

Open Details for the explanation, its source basis, and its limits.Illustrated walkthrough based on Analyzer’s interface · Fictional records

Read the walkthrough

Open KnowledgeC under Location & Activity.
Select the record with /device/isLocked and value 0.
Read the Plain-language Interpretation column: “The device recorded a transition to the unlocked state.”
Open Details → Meaning for What this means, forensic significance, limitations, and additional source interpretation. This record alone does not identify who used the device or why.

Explanations support evidence review. They do not replace examiner judgment.

MARA ANALYZER

The evidence.
In working context.

MARA Analyzer provides a dedicated workspace for examining collected evidence, reviewing available records, and preparing supported outputs.

The views below come from the working application with a synthetic demonstration case. They show the evidence workspace at a useful scale, with full-size images available for a closer look.

Acquisition, substantive examination, and the final evidence handoff serve different needs. The Analyzer product and managed analysis services are discussed separately from a remote collection engagement.

INSIDE THE APPLICATION

See the working evidence workspace.

Select a real application view from the same synthetic R17 case, or open an image at full size for a closer look.

Case overview Evidence records

Case overview — MARA Analyzer R17 · a real application view populated with synthetic evidence. Sources, available record counts, and review activity share one workspace. — **Case overview**MARA Analyzer R17 · a real application view populated with synthetic evidence. Sources, available record counts, and review activity share one workspace.
Full-size image (opens in a new tab)

Evidence records — The same R17 synthetic case, opened in the artifacts workspace. A real application capture; the sample case contains 273 records across three sources. — **Evidence records**The same R17 synthetic case, opened in the artifacts workspace. A real application capture; the sample case contains 273 records across three sources.
Full-size image (opens in a new tab)

REPORTING & DELIVERY

Review it in MARA.
Take it where it needs to go.

Tell us who needs to read the material and how they will use it. We’ll discuss the supported output, what it contains, and the handoff for the relevant release.

Review first. Then agree the output.

Analyzer views show a working synthetic case. Supported outputs and any reporting or analysis service are discussed separately for the receiving team’s needs.

For a legal reviewer

A readable supported export helps a recipient review the material it contains. It does not turn collected records into an investigative findings report.

For a forensic or discovery team

Bring the receiving team’s format and workflow requirements into the discussion before output is prepared.

A CLEAR BOUNDARY

Review is a stage.
Findings are another.

The workspace helps examine available records. Substantive findings reports, expert testimony, and any prepared case viewer are separate conversations agreed for the engagement.

WHATSAPP IN MARA ANALYZER

Two WhatsApp workflows.
One review workspace.

MARA Analyzer supports both native WhatsApp chat exports and decryption of supported WhatsApp databases from Android extractions, with the appropriate key. Bring either source into the same workspace to review conversations and prepare supported exports for downstream processing.

FROM AN ANDROID EXTRACTION

Encrypted backup.
Reviewable conversations.

When an Android extraction contains a supported encrypted WhatsApp database, supply the appropriate key. MARA decrypts and validates the database, then brings available messages into Analyzer.

A compatible database and the correct examiner-supplied key are required. Original evidence stays unchanged.

Android extractionSupplied key

ANALYZERSYNTHETIC DEMONSTRATION

IMPORT EVIDENCE

Add an Android extraction.

Bring the collected source into the case.

ZIP

Android collection.zipExample Android evidence source

✓

Import Android extraction →

ANDROID COLLECTION · WHATSAPP

A message backup.
Waiting for its key.

msgstore.db.crypt15Encrypted

Encrypted WhatsApp database detected.

The original evidence remains unchanged.

Enter decryption key →

MARA / WHATSAPP EVIDENCE

Unlock WhatsApp messages

Connect the encrypted backup to its key.

SELECTED MESSAGE BACKUP

msgstore.db.crypt15

EXAMINER-SUPPLIED KEY

•••• •••• •••• ••••

Illustrative entry · no real key

Validate the database. Add its messages to this case.

Unlock messages →

DERIVED PROCESSING

Decrypt. Validate. Process.

Validating the decrypted database

WhatsApp processing0%

✓Decrypt database✓Validate output✓Parse messages

COMMUNICATIONS

✓ Ready for review

CONVERSATIONS

Project planningAlex Morgan, Sam Taylor

Site visitExample conversation

Project planningConversation view

Alex Morgan

Can we confirm the meeting for Thursday?

10:12

Sam Taylor

Thursday works. I’ve attached the agenda.

PDFAgenda.pdfIncluded attachment

10:14

✓

BEYOND THE CHAT WINDOW

Ready for the next
stage of review.

Review available messages in Analyzer and prepare supported outputs for the receiving team.

DBProcessed WhatsApp recordsConversations & available media

✓Processing documentationSource inputs & hashes retained

Output and receiving workflow are confirmed for the engagement.

Available messages, ready for conversation review.Illustrated workflow · Fictional data

FROM A CHAT EXPORT

A ZIP. A text file.
A working conversation.

Import native WhatsApp chat exports from iPhone or Android: ZIPs with included media, or text-only TXT files. MARA turns them into a derived dataset for conversation review and supported downstream processing.

Included media is associated where possible. Messages or attachments missing from the export cannot be recreated.

ZIP + mediaTXT transcript

ANALYZERSYNTHETIC DEMONSTRATION

IMPORT EVIDENCE

Convert WhatsApp Export

Choose the original chat exports and a device time zone.

ZIP

Project planning.zipChat transcript + included media

✓

TXT

Site visit.txtText-only chat transcript

✓

Device time zoneAmerica / New YorkOutputDerived WhatsApp dataset

✓ Load converted dataset into MARA when complete

Convert WhatsApp export →

ANDROID COLLECTION · WHATSAPP

A message backup.
Waiting for its key.

msgstore.db.crypt15Encrypted

Encrypted WhatsApp database detected.

The original evidence remains unchanged.

Enter decryption key →

MARA / WHATSAPP EVIDENCE

Unlock WhatsApp messages

Connect the encrypted backup to its key.

SELECTED MESSAGE BACKUP

msgstore.db.crypt15

EXAMINER-SUPPLIED KEY

•••• •••• •••• ••••

Illustrative entry · no real key

Validate the database. Add its messages to this case.

Unlock messages →

CHAT EXPORT CONVERSION

Bringing the chat into context.

Parsing exported conversations

Conversations & included media0%

✓Read transcripts✓Associate media✓Load into Analyzer

COMMUNICATIONS

✓ Ready for review

CONVERSATIONS

Project planningAlex Morgan, Sam Taylor

Site visitExample conversation

Project planningConversation view

Alex Morgan

Can we confirm the meeting for Thursday?

10:12

Sam Taylor

Thursday works. I’ve attached the agenda.

PDFAgenda.pdfIncluded attachment

10:14

✓

BEYOND THE CHAT WINDOW

Ready for the next
stage of review.

Keep the original exports, and take the derived dataset into supported downstream workflows.

DBDerived WhatsApp datasetConversations & available media

✓Processing documentationSource inputs & hashes retained

Output and receiving workflow are confirmed for the engagement.

Exported messages and included media, in a review workspace.Illustrated workflow · Fictional data

LET’S TALK ABOUT YOUR NEXT STEP

Discuss the next stage of review.

Tell us about your examination or reporting needs, and the team receiving the result.

Discuss MARA Analyzer

Please keep confidential case information out of the initial inquiry.

Evidence, in working context.

Follow the evidence.

The records that matter.

A device. Its details. Its context.

The evidence.In working context.

See the working evidence workspace.

Review it in MARA.Take it where it needs to go.

For a legal reviewer

For a forensic or discovery team

Review is a stage.Findings are another.

Encrypted backup. Reviewable conversations.

A ZIP. A text file. A working conversation.

Discuss the next stage of review.

The evidence.
In working context.

Review it in MARA.
Take it where it needs to go.

Review is a stage.
Findings are another.

Encrypted backup.
Reviewable conversations.

A ZIP. A text file.
A working conversation.