The Investigation Data Model
Case management for investigations and due diligence is fundamentally different from standard project management or help desk ticketing. An investigation case file needs to hold:
- Subject profiles — individuals and entities under investigation, with all known attributes (identifiers, addresses, roles, associations).
- Evidence records — documents, communications, financial records, public filings, media — each linked to the subjects and to each other.
- Relationship maps — how subjects connect to each other, to assets, to events, and to third parties.
- Timeline entries — chronological events with source attribution, building the narrative of what happened and when.
- Investigation notes — analyst observations, hypotheses, leads to follow, and conclusions — distinct from raw evidence.
Offline case management software organizes all of these elements in a structured database rather than as loose files in a folder hierarchy. The relationships between elements are explicit and queryable, not implicit in folder names.
Why Offline Matters for Investigations
1. The Investigation Itself Is Sensitive
The existence of an investigation — let alone its contents — can be market-moving, reputation-damaging, or legally privileged. Storing case files on a cloud server means the cloud provider's systems have access to the data. For a law firm conducting a privileged internal investigation or a private equity firm doing pre-announcement due diligence, this is unacceptable.
2. Evidence Integrity
When evidence documents are stored locally, the chain of custody is straightforward: the files are on a drive you control, with file system timestamps and database audit logs that you own. Cloud storage introduces additional custodians and complicates evidentiary foundation if the investigation ever leads to legal proceedings.
3. Multi-Jurisdiction Compliance
Investigations often span multiple countries with conflicting data handling requirements. Some jurisdictions require data to remain within national borders. Others restrict cross-border transfer of personal data. A locally installed case management system can be deployed in-country to satisfy localization requirements, with remote access provided over VPN for approved personnel.
4. Air-Gapped Investigations
For the most sensitive matters, the case management system can run on a machine that is never connected to any network — a true air-gapped deployment. Data enters via USB or local network transfer to a dedicated machine, and analysis happens entirely offline. ONS Data Terminal supports this deployment model because it has no cloud dependency whatsoever.
The Local Case Management Workflow
- Case creation: Open a new case, define the scope and subjects.
- Data ingestion: Import documents, public records, and evidence into the local database. Documents are stored as files on the local filesystem with metadata in the database.
- Entity building: Create profiles for each person, company, and asset involved. Link entities to documents and to each other.
- Relationship mapping: Build the connection graph — who knows whom, who owns what, which entities are linked through which intermediaries.
- Timeline construction: Place events on a chronological timeline with source references.
- Analysis and reporting: Query the database, explore the graph, generate reports — all running against local data with no network dependency.
- Archiving: When the case is closed, the entire case database can be exported, archived, and stored according to your retention policy.
ONS Data Terminal for Case Management
ONS Data Terminal provides the entity management, document storage, relationship graph, and timeline features needed for investigation case management — all running locally on your hardware. It uses PostgreSQL for structured data and the local filesystem for document storage, giving you full ownership of every byte of case data.