Managing disconnected investigations
View Patent ↗A system and a method enable an information analyst to use a stand-alone computer-based investigation application to conduct a disconnected investigation on shared database data in a remote location where network access to a shared data repository of the system might be only periodically available, unreliable, or non-existent. In addition, the system and method enable the disconnected investigation to incrementally incorporate ongoing updates made to the shared repository of data, and to periodically publish interim or final results of the disconnected investigation to the shared data repository. A disconnected investigation can be conducted entirely at the disconnected investigation location without having any network connectivity to the shared repository of data.
1. A method comprising:
at a base installation that is disconnected from a disconnected installation:
determining a first plurality of data objects satisfying data object selection criteria;
determining a first plurality of change records in a database that are associated with the first plurality of data objects;
wherein each change record of the first plurality of change records corresponds to a change in the database to one of the first plurality of data objects;
wherein each change record of the first plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
assigning a first change set identifier to the first plurality of change records; and
storing the first plurality of change records and the first change set identifier in one or more first files;
after storing the first plurality of change records and the first change set identifier in the one or more first files:
determining a second plurality of data objects satisfying the data object selection criteria;
wherein the second plurality of data objects is the same as the first plurality of data objects;
determining a second plurality of change records in the database that are associated with the second plurality of data objects;
wherein each change record of the second plurality of change records corresponds to a change in the database to one of the second plurality of data objects;
wherein each change record of the second plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
wherein the logical clock values associated in the database with the first plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that all changes in the database corresponding to the second plurality of change records occurred after all changes in the database corresponding to the first plurality of change records;
assigning a second change set identifier to the second plurality of change records; and
storing the second plurality of change records and the second change set identifier in one or more second files.
2. The method of claim 1 , wherein each data object in the first plurality of data objects is associated in the database with an identifier of the data object; and wherein the method further comprises:
at the base installation that is disconnected from the disconnected installation:
after assigning the first change set identifier to the first plurality of change records:
for each data object in the first plurality of data objects, storing in the database an association between the identifier of the data object and the first change set identifier.
3. The method of claim 1 , further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining an indication that the first plurality of change records has been incorporated into a database at the disconnected installation.
4. The method of claim 3 , further comprising:
at the base installation that is disconnected from the disconnected installation:
in response to obtaining the indication that the first plurality of change records has been incorporated into a database at the disconnected installation, storing in the database an association between an identifier of the disconnected installation and the first change set identifier, the stored association representing a last acknowledged change set by the disconnected installation.
5. The method of claim 1 , further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining a second set of one or more change records, the second set of one or more change records representing one or more changes to one or more data objects of the first plurality of data objects in a database at the disconnected investigation; and
storing a third set of one or more change records in the database at the base installation corresponding to the second set of one or more change records.
6. The method of claim 1 , further comprising:
at the disconnected installation that is disconnected from the base installation:
obtaining the one or more first files containing the first plurality of change records and the first change set identifier; and
creating a second plurality of change records in a database at the disconnected installation corresponding to the first plurality of change records.
7. A method comprising:
at a base installation that is disconnected from a disconnected installation:
determining a first plurality of data objects satisfying data object selection criteria;
determining a first plurality of change records in a database that are associated with the first plurality of data objects;
wherein each change record of the first plurality of change records corresponds to a change in the database to one of the first plurality of data objects;
wherein each change record of the first plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
assigning a first change set identifier to the first plurality of change records; and
storing the first plurality of change records and the first change set identifier in one or more first files;
after storing the first plurality of change records and the first change set identifier in the one or more first files:
determining a second plurality of data objects satisfying the data object selection criteria;
wherein the second plurality of data objects consists of the first plurality of data objects and a third plurality of data objects;
determining a second plurality of change records in the database that are associated with the second plurality of data objects;
wherein each change record of the second plurality of change records corresponds to a change in the database to one of the second plurality of data objects;
wherein each change record of the second plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
determining a third plurality of change records in the database that are associated with the third plurality of data objects;
wherein each change record of the third plurality of change records corresponds to a change in the database to one of the third plurality of data objects;
wherein each change record of the third plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
wherein the logical clock values associated in the database with the first plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that all changes in the database corresponding to the second plurality of change records occurred after all changes in the database corresponding to the first plurality of change records;
wherein the logical clock values associated in the database with the third plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that at least one change in the database corresponding to a change record in the third plurality of change records occurred before each and every change in the database corresponding to the second plurality of change records;
assigning a second change set identifier to the second plurality of change records; and
storing the second plurality of change records and the second change set identifier in one or more second files.
8. The method of claim 7 , wherein each change record of the first plurality of change records includes an identifier of the one data object in the first plurality of data objects that was created, edited, or deleted by the change in the database corresponding to the change record.
9. The method of claim 7 , wherein the first plurality of change records includes more than one change record for more than one change in the database to the same data object in the first plurality of data objects.
10. The method of claim 7 , wherein each data object in the first plurality of data objects is associated in the database with an identifier of the data object; and wherein the method further comprises:
at the base installation that is disconnected from the disconnected installation:
after assigning the first change set identifier to the first plurality of change records:
for each data object in the first plurality of data objects, storing in the database an association between the identifier of the data object and the first change set identifier.
11. The method of claim 7 , further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining an indication that the first plurality of change records has been incorporated into a database at the disconnected installation.
12. The method of claim 11 , further comprising:
at the base installation that is disconnected from the disconnected installation:
in response to obtaining the indication that the first plurality of change records has been incorporated into a database at the disconnected installation, storing in the database an association between an identifier of the disconnected installation and the first change set identifier, the stored association representing a last acknowledged change set by the disconnected installation.
13. The method of claim 7 , further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining a second set of one or more change records, the second set of one or more change records representing one or more changes to one or more data objects of the first plurality of data objects in a database at the disconnected investigation; and
storing a third set of one or more change records in the database at the base installation corresponding to the second set of one or more change records.
14. The method of claim 7 , further comprising:
at the disconnected installation that is disconnected from the base installation:
obtaining the one or more first files containing the first plurality of change records and the first change set identifier; and
creating a second plurality of change records in a database at the disconnected installation corresponding to the first plurality of change records.
15. One or more non-transitory computer-readable media storing instructions which, when executed by one or more computing devices, cause performance of a method comprising:
at a base installation that is disconnected from a disconnected installation:
determining a first plurality of data objects satisfying data object selection criteria;
determining a first plurality of change records in a database that are associated with the first plurality of data objects;
wherein each change record of the first plurality of change records corresponds to a change in the database to one of the first plurality of data objects;
wherein each change record of the first plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
assigning a first change set identifier to the first plurality of change records; and
storing the first plurality of change records and the first change set identifier in one or more first files;
after storing the first plurality of change records and the first change set identifier in the one or more first files:
determining a second plurality of data objects satisfying the data object selection criteria;
wherein the second plurality of data objects is the same as the first plurality of data objects;
determining a second plurality of change records in the database that are associated with the second plurality of data objects;
wherein each change record of the second plurality of change records corresponds to a change in the database to one of the second plurality of data objects;
wherein each change record of the second plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
wherein the logical clock values associated in the database with the first plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that all changes in the database corresponding to the second plurality of change records occurred after all changes in the database corresponding to the first plurality of change records;
assigning a second change set identifier to the second plurality of change records; and
storing the second plurality of change records and the second change set identifier in one or more second files.
16. The media of claim 15 , wherein each data object in the first plurality of data objects is associated in the database with an identifier of the data object; and wherein the method further comprises:
at the base installation that is disconnected from the disconnected installation:
after assigning the first change set identifier to the first plurality of change records:
for each data object in the first plurality of data objects, storing in the database an association between the identifier of the data object and the first change set identifier.
17. The media of claim 15 , the method further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining an indication that the first plurality of change records has been incorporated into a database at the disconnected installation.
18. The media of claim 17 , the method further comprising:
at the base installation that is disconnected from the disconnected installation:
in response to obtaining the indication that the first plurality of change records has been incorporated into a database at the disconnected installation, storing in the database an association between an identifier of the disconnected installation and the first change set identifier, the stored association representing a last acknowledged change set by the disconnected installation.
19. The media of claim 15 , the method further comprising:
at the base installation that is disconnected from the disconnected installation:
obtaining a second set of one or more change records, the second set of one or more change records representing one or more changes to one or more data objects of the first plurality of data objects in a database at the disconnected investigation; and
storing a third set of one or more change records in the database at the base installation corresponding to the second set of one or more change records.
20. The media of claim 15 , the method further comprising:
at the disconnected installation that is disconnected from the base installation:
obtaining the one or more first files containing the first plurality of change records and the first change set identifier; and
creating a second plurality of change records in a database at the disconnected installation corresponding to the first plurality of change records.
21. One or more non-transitory computer-readable media storing instructions which, when executed by one or more computing devices, cause performance of a method comprising:
at a base installation that is disconnected from a disconnected installation:
determining a first plurality of data objects satisfying data object selection criteria;
determining a first plurality of change records in a database that are associated with the first plurality of data objects;
wherein each change record of the first plurality of change records corresponds to a change in the database to one of the first plurality of data objects;
wherein each change record of the first plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
assigning a first change set identifier to the first plurality of change records; and
storing the first plurality of change records and the first change set identifier in one or more first files;
after storing the first plurality of change records and the first change set identifier in the one or more first files:
determining a second plurality of data objects satisfying the data object selection criteria;
wherein the second plurality of data objects consists of the first plurality of data objects and a third plurality of data objects;
determining a second plurality of change records in the database that are associated with the second plurality of data objects;
wherein each change record of the second plurality of change records corresponds to a change in the database to one of the second plurality of data objects;
wherein each change record of the second plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
determining a third plurality of change records in the database that are associated with the third plurality of data objects;
wherein each change record of the third plurality of change records corresponds to a change in the database to one of the third plurality of data objects;
wherein each change record of the third plurality of change records is associated in the database with a logical clock value indicating an order in which the change in the database corresponding to the change record occurred;
wherein the logical clock values associated in the database with the first plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that all changes in the database corresponding to the second plurality of change records occurred after all changes in the database corresponding to the first plurality of change records;
wherein the logical clock values associated in the database with the third plurality of change records and the logical clock values associated in the database with the second plurality of change records indicates that at least one change in the database corresponding to a change record in the third plurality of change records occurred before each and every change in the database corresponding to the second plurality of change records;
assigning a second change set identifier to the second plurality of change records; and
storing the second plurality of change records and the second change set identifier in one or more second files.
22. The one or more non-transitory computer-readable media of claim 21 , wherein each change record of the first plurality of change records includes an identifier of the one data object in the first plurality of data objects that was created, edited, or deleted by the change in the database corresponding to the change record.
23. The one or more non-transitory computer-readable media of claim 21 , wherein the first plurality of change records includes more than one change record for more than one change in the database to the same data object in the first plurality of data objects.
24. The one or more non-transitory computer-readable media of claim 21 , wherein each data object in the first plurality of data objects is associated in the database with an identifier of the data object; and wherein the method further comprises:
at the base installation that is disconnected from the disconnected installation: after assigning the first change set identifier to the first plurality of change records: for each data object in the first plurality of data objects, storing in the database an association between the identifier of the data object and the first change set identifier.
25. The one or more non-transitory computer-readable media of claim 21 , the method further comprising:
at the base installation that is disconnected from the disconnected installation: obtaining an indication that the first plurality of change records has been incorporated into a database at the disconnected installation.
26. The one or more non-transitory computer-readable media of claim 25 , the method further comprising:
at the base installation that is disconnected from the disconnected installation:
in response to obtaining the indication that the first plurality of change records has been incorporated into a database at the disconnected installation, storing in the database an association between an identifier of the disconnected installation and the first change set identifier, the stored association representing a last acknowledged change set by the disconnected installation.
27. The one or more non-transitory computer-readable media of claim 21 , the method further comprising:
at the base installation that is disconnected from the disconnected installation: obtaining a second set of one or more change records, the second set of one or more
change records representing one or more changes to one or more data objects of the first plurality of data objects in a database at the disconnected investigation; and
storing a third set of one or more change records in the database at the base installation corresponding to the second set of one or more change records.
28. The one or more non-transitory computer-readable media of claim 21 , the method further comprising:
at the disconnected installation that is disconnected from the base installation:
obtaining the one or more first files containing the first plurality of change records and the first change set identifier; and
creating a second plurality of change records in a database at the disconnected installation corresponding to the first plurality of change records.