As far as I know, analyzing the block chain consists of tracing transactions to see if those transactions match up with what is believe to have happened. Example: If we hear that person A stole 5000 bitcoins then there must be a transfer of 5000 bitcoins somewhere in the blockchain, and since those transactions do not happen often, it should be easy to locate... I think.