A storage system in a high capacity network, the system comprising: a network monitoring device having a network interface card coupled to a high capacity network and configured to capture data packets from the network to provide raw captured packets; a first data repository configured to store the raw captured packets; a second data repository configured to store metadata associated with the raw data packets stored in the first data repository, the metadata information comprising contextual information about the raw captured data packets; a third data repository configured to store timestamp indexed data associated with the raw data packets stored in the first data repository and configured to store timestamp indexed data associated with the metadata stored in the second data repository; a fourth data repository configured to store data flow information associated with the raw data packets stored in the first data repository, the data flow information comprising a respective flow identifier, flow ID, for each of a plurality of flows of data packets; and a storage engine coupled to the first, second, third and fourth data repositories (124, 128, 126, 130), the storage engine configured to: receive packet search criteria, the packet search criteria specifying at least a first time range; retrieve data flow information associated with the packet search criteria from the fourth data repository, the retrieving of the data flow information comprising retrieving one or more flow IDs for one or more flows of data packets in the first time range, wherein the retrieved data flow information is associated with a second time range based on start and end timestamps for the one or more flows, and wherein the second time range is narrower than the first time range; retrieve metadata information associated with the second time range from the second data repository using corresponding timestamp indexed data stored in the third data repository; and retrieve raw captured data packets associated with the retrieved metadata from the first data repository using corresponding timestamp indexed data stored in the third data repository. a network monitoring device having a network interface card coupled to a high capacity network and configured to capture data packets from the network to provide raw captured packets; a first data repository configured to store the raw captured packets; a second data repository configured to store metadata associated with the raw data packets stored in the first data repository, the metadata information comprising contextual information about the raw captured data packets; a third data repository configured to store timestamp indexed data associated with the raw data packets stored in the first data repository and configured to store timestamp indexed data associated with the metadata stored in the second data repository; a fourth data repository configured to store data flow information associated with the raw data packets stored in the first data repository, the data flow information comprising a respective flow identifier, flow ID, for each of a plurality of flows of data packets; and a storage engine coupled to the first, second, third and fourth data repositories (124, 128, 126, 130), the storage engine configured to: receive packet search criteria, the packet search criteria specifying at least a first time range; retrieve data flow information associated with the packet search criteria from the fourth data repository, the retrieving of the data flow information comprising retrieving one or more flow IDs for one or more flows of data packets in the first time range, wherein the retrieved data flow information is associated with a second time range based on start and end timestamps for the one or more flows, and wherein the second time range is narrower than the first time range; retrieve metadata information associated with the second time range from the second data repository using corresponding timestamp indexed data stored in the third data repository; and retrieve raw captured data packets associated with the retrieved metadata from the first data repository using corresponding timestamp indexed data stored in the third data repository. receive packet search criteria, the packet search criteria specifying at least a first time range; retrieve data flow information associated with the packet search criteria from the fourth data repository, the retrieving of the data flow information comprising retrieving one or more flow IDs for one or more flows of data packets in the first time range, wherein the retrieved data flow information is associated with a second time range based on start and end timestamps for the one or more flows, and wherein the second time range is narrower than the first time range; retrieve metadata information associated with the second time range from the second data repository using corresponding timestamp indexed data stored in the third data repository; and retrieve raw captured data packets associated with the retrieved metadata from the first data repository using corresponding timestamp indexed data stored in the third data repository.