A computer investigation system and method organizes information in a hive. Information in a target device is parsed by a processor, and facts and links are extracted from the data. The processor identifies the fact type for each identified fact, and further generates a fact ID for the fact. The information for the fact is stored in the hive in a fact table associated with the fact type. The processor also identifies the link type for each identified link, and further generates a link ID for the link. The information for the link ID is stored in the hive in a link table associated with the identified link type. A query language that is adapted to work with the hive allows querying of data stored in the hive.