Abstract: In some embodiments, a method includes generating a hash value or a hash string of a suspected illicit file stored in a communication device in a computer network. The method includes comparing the hashed value of the suspected illicit file to hash values of known illicit files stored in a database. The method includes determining if the hash value of the suspected illicit file has a match with a hash value of a known illicit file stored in the database. The match can be, for example, an exact match with a known illicit file, an approximate match with a known illicit file or a match with a set of known hash values that can be generated by implementing a set of pre-determined rules. The method also includes generating an alert signal and an alert or forensic report associated with the match, if a successful match with a known illicit file or a pre-determined rule occurs.