Anyone who has sat with a large evidence dump knows the shape of the problem: extraction is the easy part, correlation is where humans burn out. Photos, call logs, multilingual audio, documents, chat exports, archives, and device dumps arrive together, and the investigator becomes the integration layer.
Mammon takes that workflow seriously. Drop in an archive and the pipeline classifies, processes, enriches, stores, analyzes, and indexes the contents locally. Vision, OCR, speech transcription, audio understanding, entity extraction, threat detection, face re-identification, voice clustering, and LLM enrichment all feed the same evidence database.
The useful part is the connection layer. Hybrid search combines keyword, semantic, and reranked results. Identity graphs link people across phone numbers, emails, names, faces, voices, and scripts. Label one face or entity and that context can propagate across the case. Armenian, Russian, Azerbaijani, and English evidence stays in its original form; transliteration is additive metadata, not a rewrite.
This is the forensic side of the same engineering instinct behind the offensive platforms: chain of custody matters, discretion matters, and the machine should do the tedious correlation so the analyst can do the thinking.