An analysis apparatus comprising: a dispatcher that is configured to be communicably connected to an analysis target device that is configured to perform operational processing by use of a processor and a memory unit, which is communicably connected to the processor to acquire data being transmitted and received between the processor and the memory unit, and to generate collection target data for reproducing at least part of a state of the operational processing in the analysis target device by duplicating the data acquired; a data mapper that is configured to assign, to one or more areas included in the collection target data, tag information for identifying the area by referring to mapping data that includes a relation between the areas and the tag information; a data writer that is configured to save the one or more areas into a first high-speed storage device with a specific storage capacity, in accordance with a first policy defining, by use of the tag information, a procedure of saving the collection target data into the first storage device, and to save saved data that indicates a relation between the tag information, save-target data that are included in the one or more areas assigned with the tag information, and record timing information, into the first storage device, the record timing information indicating a timing when the saved data is recorded, wherein the data mapper is configured to assign the tag information with respect to the one or more areas included in the collection target data, by using the mapping data including a relation between the areas and the tag information, further comprising a second storage device having a larger storage capacity than the first storage device, characterized by that the data writer is configured to save the saved data being saved in the first storage device into the second storage device, in accordance with a second policy defining a procedure of saving the saved data saved in the first storage device into the second storage device. a dispatcher that is configured to be communicably connected to an analysis target device that is configured to perform operational processing by use of a processor and a memory unit, which is communicably connected to the processor to acquire data being transmitted and received between the processor and the memory unit, and to generate collection target data for reproducing at least part of a state of the operational processing in the analysis target device by duplicating the data acquired; a data mapper that is configured to assign, to one or more areas included in the collection target data, tag information for identifying the area by referring to mapping data that includes a relation between the areas and the tag information; a data writer that is configured to save the one or more areas into a first high-speed storage device with a specific storage capacity, in accordance with a first policy defining, by use of the tag information, a procedure of saving the collection target data into the first storage device, and to save saved data that indicates a relation between the tag information, save-target data that are included in the one or more areas assigned with the tag information, and record timing information, into the first storage device, the record timing information indicating a timing when the saved data is recorded, wherein the data mapper is configured to assign the tag information with respect to the one or more areas included in the collection target data, by using the mapping data including a relation between the areas and the tag information, further comprising a second storage device having a larger storage capacity than the first storage device, characterized by that the data writer is configured to save the saved data being saved in the first storage device into the second storage device, in accordance with a second policy defining a procedure of saving the saved data saved in the first storage device into the second storage device.