Managing disconnected investigations

• US 9,275,069 B1
• Filed: 07/17/2014
• Issued: 03/01/2016
• Est. Priority Date: 07/07/2010
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Garrod, John Kenneth, Scott, Jacob, Freeland, Carl
• Primary Examiner(s): Casanova, Jorge A
• Application Number:
  US14/334,232
• Time in Patent Office: 593 Days
• Field of Search: 707/648
• US Class Current: 1/1
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/1865 Transactional file systems
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations

Abstract

A system and method enable an information analyst to use a stand-alone computer-based investigation application to conduct a disconnected investigation on shared database data in a remote location where network access to a shared data repository of the system might be only periodically available, unreliable, or non-existent. In addition, the system and method enable the disconnected investigation to incrementally incorporate ongoing updates made to the shared repository of data, and to periodically publish interim or final results of the disconnected investigation to the shared data repository. A disconnected investigation can be conducted entirely at the disconnected investigation location without having any network connectivity to the shared repository of data.

Claims

1. A method for managing a disconnected investigation, the method comprising:

a base installation remote and disconnected from a disconnected installation at which the disconnected investigation is conducted, the base installation comprising;

one or more server computers;

a database hosted in a digital storage device on the one or more server computers, the database comprising a shared data repository and an investigation repository; and

a revisioning database hosted in the digital storage device on the one or more server computers;

at a first time;

the one or more server computers identifying, in the shared data repository, an initial set of data objects to be the subject of the disconnected investigation;

the one or more server computers identifying, in the revisioning database, an initial set of change records corresponding to the initial set of data objects;

the one or more server computers storing the initial set of change records and the initial set of data objects in one or more initial base files in the investigation repository;

at a second time that is after the first time;

the one or more server computers identifying, in the shared data repository, an update set of data objects to be the subject of the disconnected investigation, the update set of data objects comprising at least one data object not in the initial set of data objects and at least one data object in the initial set of data objects;

the one or more server computers identifying, in the revisioning database, an update set of change records corresponding to the update set of data objects, the update set of change records comprising at least one change record pertaining to a change to a data object in the initial set of data objects made in the shared data repository after the first time but before the second time;

the one or more server computers storing the update set of change records and the update set of data objects in one or more update base files in the investigation repository.

2. The method of claim 1, further comprising:

at the first time;

the one or more server computers obtaining investigation subject criteria in the form of a query and/or a filter;

the one or more server computers applying the investigation subject criteria to the shared data repository to identify the initial set of data objects;

at the second time;

the one or more server computers applying the investigation subject criteria to the shared data repository to identify the update set of data objects.

3. The method of claim 1, wherein the update set of change records do not include any change records pertaining to changes to the initial set of data objects made in the shared data repository before the first time.

4. The method of claim 1, further comprising:

the one or more server computers maintaining, in the database, an investigation-change set relation that identifies what change sets have been generated for which disconnected investigations and when those change sets were generated by associating disconnected investigation identifiers, change set identifiers, and logical clock values.

5. The method of claim 1, further comprising:

the one or more server computers maintaining, in the database, a change set-data object relation that identifies which data objects were selected for inclusion in which change sets by associating change set identifiers and data object identifiers.

6. The method of claim 1, wherein the one or more initial base files and the one or more update base files are physically transported to the remote disconnected installation at which the disconnected investigation is conducted on a portable data storage device.

7. The method of claim 1, further comprising:

at a third time that is after the first time but before the second time;

the one or more server computers obtaining one or more disconnected investigation files comprising one or more change records reflecting changes made to one or more of the initial set of data objects in a database at the remote disconnected installation as part of the disconnected investigation; and

the one or more server computers updating the data objects in the shared data repository based on at least some of the change records in the one or more disconnected investigation files.

8. The method of claim 1, wherein the one or more initial base files comprise a plurality of private key encrypted database data identifiers for assigning to data object changes made in a database at the remote disconnected installation as part of the disconnected investigation.

9. A system for managing a disconnected investigation comprising:

a base installation comprising;

one or more server computers;

a database hosted in a digital storage device on the one or more server computers, the database comprising a shared data repository and an investigation repository; and

a revisioning database hosted in the digital storage device on the one or more server computers;

a disconnected installation remote and disconnected from the base installation comprising;

a computing device; and

a database hosted in a digital storage device on the computing device;

wherein the one or more server computers of the base installation are configured to perform at a first time;

identifying, in the shared data repository, an initial set of data objects to be the subject of the disconnected investigation,

identifying, in the revisioning database, an initial set of change records corresponding to the initial set of data objects, and

storing the initial set of change records and the initial set of data objects in one or more initial base files in the investigation repository;

wherein the computing device of the disconnected installation is configured to perform, at a second time that is after the first time, incorporating the initial set of change records from the one or more initial base files into the database at the disconnected installation;

wherein the computing device of the disconnected installation is configured to perform, at a third time that is after the second time, making one or more changes to one or more of the initial set of data objects in the database at the disconnected installation;

wherein the computing device of the disconnected installation is configured to perform at a fourth time that is after the third time;

identifying, in the database at the disconnected installation, a first update set of change records reflecting the one or more changes to one or more of the initial set of data objects made in the database at the disconnected installation at the third time, and

storing the first update set of change records in one or more disconnected investigation files;

wherein the one or more server computers of the base installation are configured to perform at a fifth time that is after the fourth time;

obtaining the one or more disconnected investigation files, and

updating the data objects in the shared data repository based on at least some of the first update set of change records in the one or more disconnected investigation files;

wherein the one or more server computers of the base installation are configured to perform at a sixth time that is after the fifth time;

identifying, in the shared data repository, an update set of data objects to be the subject of the disconnected investigation,

identifying, in the revisioning database, a second update set of change records for the update set of data objects, and

storing the second update set of change records and the update set of data objects in one or more update base files in the investigation repository.

10. The system of claim 9, wherein the update set of data objects comprises at least one data object not in the initial set of data objects and at least one data object in the initial set of data objects.

11. The system of claim 9, wherein the second update set of change records comprises at least one change record pertaining to a change to a data object in the initial set of data objects made in the shared data repository after the first time but before the sixth time.

12. The system of claim 9, wherein the one or more initial base files comprise a plurality of private key encrypted database data identifiers for assigning to data object changes made at the database at the disconnected installation, the plurality of private key encrypted database data identifiers generated by the one or more servers of the base installation at the first time.

13. The system of claim 9, wherein the one or more update base files comprise a plurality of private key encrypted database data identifiers for assigning to data object changes made at the database at the disconnected installation, the plurality of private key encrypted database data identifiers generated by the base investigation application logic at the fifth time.

14. A method for managing a disconnected investigation, the method comprising:

a disconnected installation remote and disconnected from a base installation, the disconnected installation comprising;

a computing device; and

a database hosted in a digital storage device on the computing device;

at a first time, the computing device incorporating into the database, from one or more initial base files generated at the base installation, an initial set of change records and an initial set of data objects that are the subject of the disconnected investigation;

at a second time that is after the first time, the computing device making in the database one or more changes to one or more of the initial set of data objects;

at a third time that is after the second time;

the computing device identifying, in the database, a first update set of change records reflecting the one or more changes to one or more of the initial set of data objects made in the database at the second time, and

the computing device storing the first update set of change records in one or more disconnected investigation files.

15. The method of claim 14, further comprising:

at a fourth time that is after the third time, the computing device incorporating, from one or more update base files into the, a second update set of change records and an update set of data objects that are the subject of the disconnected investigation, the one or more update base files generated at the base installation.

16. The method of claim 15, wherein the update set of data object comprises at least one data object not in the initial set of data objects and at least one data object in the initial set of data objects.

17. The method of claim 15, wherein the second update set of change records comprises at least one change record pertaining to a change to a data object in the initial set of data objects made in a shared data repository in a database hosted in a digital storage device on one or more server computers at the base installation.

18. The method of claim 14, wherein the one or more initial base files comprise a plurality of private key encrypted database data identifiers for assigning to data object changes made in the database at the disconnected installation, the plurality of private key encrypted database data identifiers generated by one or more server computers at the base installation.

19. The method of claim 18, wherein at least one of the first update set of change records comprises at least one of the plurality of private key encrypted database data identifiers.

20. The method of claim 14, wherein the one or more disconnected investigation files are capable of being physically transported to the remote base installation on a portable non-transitory computer-readable medium.