A method is disclosed for extracting a data packet including metadata and useful data from a datastream. The metadata and useful data are stored in a first and second memory area, with an association being maintained. A transaction number is formed based upon a signature of the data packet. The useful data or partially reconstructed network sessions may be searched for at least one search term, and at least one successful search may be recorded in the metadata. If the data packet is currently not being processed, the associated useful data may be read from the buffer store and a flag may be set in the metadata which indicates that this data packet is now being processed. If all the metadata and the useful data from a network session have been read and the search for the search term was successful, the network session is then reconstructed.