ok.. so we have an evidence hierarchy, but this not may map 1:1 to a db
schema (maybe its more optimal to change it slightly?)

well.. we need 2 db's.. a transaction log. and a knowledgebase.

PROCESS			: TABLE
	ID:		: KEY
	INODE		: INTEGER
	IMAGE_MD5	: MD5


FILE			: TABLE
	INODE:		: INTEGER
	IMAGE_MD5	: MD5


so.. we can get --> PROCESS:PROCESSIMAGE:IMAGE_MD5 from the informants which
maps to two places.

INSERT:
	UNIQUE PROCESS:IMAGE_MD5 FROM PROCESS, WHERE ID == PROCESS:PROCESSID
	VERIFY PROCESS:IMAGE_MD5 FROM FILE, WHERE INODE == PROCESS:INODE

----------

e PROCESS:INODE -- k FILE:INODE
e PROCESS:INODE -- k PROCESS:INODE
k FILE:INODE == k PROCESS:INODE

< KNOWLEDGEBASE >
	< EQUIVALENCE >
		< TABLE = "FILE" COLUMN = "INODE" >
		< TABLE = "FILE" COLUMN = "INODE" >
	</EQUIVALENCE >
</KNOWLEDGEBASE >
