Managing disconnected investigations

摘要

A system and a method enable an information analyst to use a stand-alone computer-based investigation application to conduct a disconnected investigation on shared database data in a remote location where network access to a shared data repository of the system might be only periodically available, unreliable, or non-existent. In addition, the system and method enable the disconnected investigation to incrementally incorporate ongoing updates made to the shared repository of data, and to periodically publish interim or final results of the disconnected investigation to the shared data repository. A disconnected investigation can be conducted entirely at the disconnected investigation location without having any network connectivity to the shared repository of data.

主权项

1. A method comprising:
at a base installation that is disconnected from a disconnected installation: determining a first plurality of data objects satisfying data object selection criteria; determining a first plurality of change records in a database that are associated with the first plurality of data objects; wherein each change record of the first plurality of change records corresponds to a change in the database to one of the first plurality of data objects; wherein each change record of the first plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred; assigning a first change set identifier to the first plurality of change records; and storing the first plurality of change records and the first change set identifier in one or more first files; after storing the first plurality of change records and the first change set identifier in the one or more first files:
determining a second plurality of data objects satisfying the data object selection criteria;wherein the second plurality of data objects is the same as the first plurality of data objects;determining a second plurality of change records in the database that are associated with the second plurality of data objects;wherein each change record of the second plurality of change records corresponds to a change in the database to one of the second plurality of data objects;wherein each change record of the second plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;wherein the logical clock values associated in the database with the first plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that all changes in the database corresponding to the second plurality of change records occurred after all changes in the database corresponding to the first plurality of change records;assigning a second change set identifier to the second plurality of change records; andstoring the second plurality of change records and the second change set identifier in one or more second files.