A method for capturing data packets comprising the steps of: connecting a capture appliance to a data communications path; capturing data communicated along the data communications path; replicating and annotating the captured data in a predetermined combination of volatile and non-volatile storage; aggregating the captured data and annotations in the volatile and non-volatile storage into a slot, wherein the data is aggregated into the slot by: creating the slot; and managing the slot based on an least recently used cache, wherein the least recently used cache maps the data in the slot to the non-volatile storage to create a cache image of the captured data across sectors of the non-volatile storage using striping and thereby allowing a controller simultaneously to write to a plurality of non-volatile storage devices, and wherein the aggregated data is annotated based on fixed time domain; storing the annotated aggregated data in a non-volatile storage using an infinitely journaled, write-once, hierarchical file system and indexing the data based on a set of predetermined characteristics that are useable to retrieve the data; incorporating a means of reconstructing any corrupted data to ensure data accuracy; and retrieving a portion of captured data from the stored slot, by: identifying a characteristic of the data to be retrieved; locating the slot containing data having the identified characteristics on the non-volatile storage; copying the data having the identified characteristics from the slot to the volatile storage using a least recently used algorithm to allocate space in the volatile storage; packaging the data having the identified characteristics to be accessible using predetermined access methods; and allowing a user to access the data having the identified characteristics. connecting a capture appliance to a data communications path; capturing data communicated along the data communications path; replicating and annotating the captured data in a predetermined combination of volatile and non-volatile storage; aggregating the captured data and annotations in the volatile and non-volatile storage into a slot, wherein the data is aggregated into the slot by: creating the slot; and managing the slot based on an least recently used cache, wherein the least recently used cache maps the data in the slot to the non-volatile storage to create a cache image of the captured data across sectors of the non-volatile storage using striping and thereby allowing a controller simultaneously to write to a plurality of non-volatile storage devices, and wherein the aggregated data is annotated based on fixed time domain; storing the annotated aggregated data in a non-volatile storage using an infinitely journaled, write-once, hierarchical file system and indexing the data based on a set of predetermined characteristics that are useable to retrieve the data; incorporating a means of reconstructing any corrupted data to ensure data accuracy; and creating the slot; and managing the slot based on an least recently used cache, wherein the least recently used cache maps the data in the slot to the non-volatile storage to create a cache image of the captured data across sectors of the non-volatile storage using striping and thereby allowing a controller simultaneously to write to a plurality of non-volatile storage devices, and wherein the aggregated data is annotated based on fixed time domain; storing the annotated aggregated data in a non-volatile storage using an infinitely journaled, write-once, hierarchical file system and indexing the data based on a set of predetermined characteristics that are useable to retrieve the data; incorporating a means of reconstructing any corrupted data to ensure data accuracy; and retrieving a portion of captured data from the stored slot, by: identifying a characteristic of the data to be retrieved; locating the slot containing data having the identified characteristics on the non-volatile storage; copying the data having the identified characteristics from the slot to the volatile storage using a least recently used algorithm to allocate space in the volatile storage; packaging the data having the identified characteristics to be accessible using predetermined access methods; and allowing a user to access the data having the identified characteristics. identifying a characteristic of the data to be retrieved; locating the slot containing data having the identified characteristics on the non-volatile storage; copying the data having the identified characteristics from the slot to the volatile storage using a least recently used algorithm to allocate space in the volatile storage; packaging the data having the identified characteristics to be accessible using predetermined access methods; and allowing a user to access the data having the identified characteristics.