Zandra AI: AI DFIR that links the evidence

Core analytics & correlation

Cross-correlate evidence across many artifacts, including access attempts, data exfiltration and timeline reconstruction, far more efficiently.

Case & evidence management

• Enhanced case management: dedicated descriptions, metrics and document structures.
• Data export & auditing: download case data, export conversation archives and generate tagging logs for reporting and chain of custody.

Document tagging

• In-case labeling: label and categorize evidence inside a case for faster retrieval and reporting.
• Real-time tagging: classify artifacts by relevance, type, status or a custom team scheme as you work.

Malware triage

• Automated macro detection in macro-enabled documents (.docm) and spreadsheets (.xlsm).
• Indicator extraction of suspicious code blocks, URLs and domains.
• “Further Analysis Required” guidance with recommended manual steps when confidence is low, so critical flags are never overlooked.

Prompt library

• Shared library of reusable analysis prompts across the organization.
• AI-assisted search to find the right prompt fast.
• Curated management by Administrators and Managers, with bulk import and export.

Roles & access control

• Manager: user and case management with guardrails (cannot create or modify Administrators).
• Investigator: access limited to assigned cases, evidence and the AI assistant.
• Guest: clients see only their own data, run searches and tag documents for analysis or production.

How did you validate this?

We built more than 500 controlled data sets and forensic scenarios with known answers, covering memory dumps, email, deleted files, registry keys, mobile app usage, network and system logs, GPS data and more, then tested the technology’s ability to cross-correlate and analyze that data against the known answers.

What about data the tool does not parse?

Supported data types are documented. Zandra is not a parsing tool: parsing happens in a forensic tool first, and the data is provided in a compatible format. Data in accepted formats is understood for analysis.

Device evidence or synced data?

Data must be exported and normalized from the forensic tool, which separates sources before ingestion. Zandra then reviews sources such as iCloud, Google Drive, WhatsApp and OneDrive with metadata and correlation logic, using prompts like “Correlate file paths with sync client databases to confirm source device vs. synced copy.”

What anti-forensics examination was performed?

Zandra is not a forensic tool. It is an AI analytics tool that understands data from forensic sources.

Do other artifacts corroborate the findings?

The technology analyzes the data efficiently; corroborating the underlying data is the examiner’s responsibility.

Zandra prompt library

A built-in prompt library guides users through common investigative workflows.

Visual analytics: communication maps & timelines

Quickly map communication flows between individuals across multiple data sources.

Redaction tools

Remove sensitive information from text-based documents in Zandra’s output with a series of prompts.

Audit logs

Full tracking of user actions provides an audit log for evidence integrity.

Role-based access control (RBAC)

Limit access to specific cases or data so multiple investigators can work on the same Zandra server.