Managing disconnected investigations

A method performed by one or more computing devices at a base location, the one or more computing devices operatively coupled to a base database, the method comprising:

• receiving a request to generate an initial set of change records for a disconnected investigation;
• in response to receiving the request to generate an initial set of change records for the disconnected investigation:
• determining a first logical clock value of a logical clock used to track changes made to the base database;
• determining a second logical clock value of the logical clock;
• determining, based on the first and second logical clock values, a first set of change records stored in the base database representing changes to the base database made after a first logical clock event corresponding to the first logical clock value and before a second logical clock event corresponding to the second logical clock value;
• assigning an identifier to the first set of change records;
• storing an association between the first change set identifier and the second logical clock value;
• storing the first set of change records in a first single file;
• obtaining, from a file produced by a computing device at a remote location at which the disconnected investigation is being conducted, an indication that the first set of change records was incorporated into a remote database at the remote location, the indication including the identifier of the first set of change records;
• receiving a request to generate an update set of changes records for the disconnected investigation;
• in response to receiving the request to generate an update set of change records for the disconnected investigation:
• determining, based on the identifier of the first set of change records in the obtained indication and the stored first association, the second logical clock value;
• determining a third logical clock value of the logical clock;
• determining, based on the second and third logical clock values, a second set of change records stored in the base database representing changes to the base database made after the second logical clock event corresponding to the second logical clock value and before a third logical clock event corresponding to the third logical clock value;
• assigning an identifier to the second set of change records;
• storing a second association between the identifier of the second set of change records and the third logical clock value;
• storing the second set of change records in a second single file;
• wherein the method is performed without any network communication between the one or more computing devices at the base location and the computing device at the remote location.