System and method for generating, maintaining, and querying a database for computer investigations cross-reference to related application

A computer investigation system comprising:

• an examining machine having a hardware processor and an interface configured to receive a search query, the search query describing a filter, wherein the filter includes a plurality of conditions, wherein each of the conditions is enclosed in a gate ending with a particular punctuation mark;
• and
• a hardware data storage device communicatively coupled to the examining machine, the hardware data storage device storing a database having a plurality of tables;
• wherein the hardware processor is configured to execute the search query, and thereby access the tables stored in the hardware data storage device, wherein the tables store each piece of data as either a unique fact or a unique link, wherein all facts are stored at a same level and all facts are connected to other facts via one or more links, retrieve data from the tables stored in the hardware data storage device, search the data retrieved from the tables stored in the hardware data storage device, and identify a match for each of the conditions;
• and
• wherein the hardware processor is further configured to return search results in response to identifying the match for each of the conditions in the data retrieved from the tables stored in the hardware data storage device.

A computer program product for querying a database comprising tables stored in a hardware data storage device, the computer program product comprising a non-transitory computer-readable medium storing instructions executable by one or more hardware processors to cause the hardware processors to perform:

• receiving a search query describing a filter, wherein the filter includes a plurality of conditions, wherein each of the conditions is enclosed in a gate ending with a particular punctuation mark;
• processing, by the hardware processors, the search query, wherein in processing the search query, the hardware processors access the tables stored in the hardware data storage device, wherein the tables store each piece of data as either a unique fact or a unique link, wherein all facts are stored at a same level and all facts are connected to other facts via one or more links, retrieve data from the tables stored in the hardware data storage device, and search the data retrieved from the tables stored in a hardware data storage device for identifying a match for each of the conditions;
• and
• returning, by the hardware processors, search results in response to identifying the match for each of the conditions in the data retrieved from the tables stored in the hardware data storage device.