A computerized method of proactively generating and comparing computer forensic evidence for a computer system, comprising the steps of: generating, executed by a processor, a representation of content of at least one target within a set of targets; generating an inverted index of the set of targets, wherein the inverted index stores a mapping of terms from associated contents, generating the inverted index comprises pooling the terms contained in the set of targets and indexing the terms, the inverted index is proactively generated for computer forensic evidence for the at least one target for allowing a forensic analysis with the computer forensic evidence by maintaining a forensically accurate representation of the content of the at least one target including if the content changes, and updating the inverted index upon occurrence of a predetermined operation that changes the content; generating at least one signature for the at least one target based on the representation of content of the target, wherein generating the at least one signature further includes the step of extracting a set of tokens representing content of the at least one target, and the inverted index is associated with signatures of each target of the set of targets; and comparing the at least one generated signature with at least one previously generated signature for the same at least one target to determine whether the signatures have a similarity above a predetermined threshold, wherein both the at least one generated signature and the at least one previously generated signature are proactively generated for computer forensic evidence for the at least one target. generating, executed by a processor, a representation of content of at least one target within a set of targets; generating an inverted index of the set of targets, wherein the inverted index stores a mapping of terms from associated contents, generating the inverted index comprises pooling the terms contained in the set of targets and indexing the terms, the inverted index is proactively generated for computer forensic evidence for the at least one target for allowing a forensic analysis with the computer forensic evidence by maintaining a forensically accurate representation of the content of the at least one target including if the content changes, and updating the inverted index upon occurrence of a predetermined operation that changes the content; wherein the inverted index stores a mapping of terms from associated contents, generating the inverted index comprises pooling the terms contained in the set of targets and indexing the terms, the inverted index is proactively generated for computer forensic evidence for the at least one target for allowing a forensic analysis with the computer forensic evidence by maintaining a forensically accurate representation of the content of the at least one target including if the content changes, and updating the inverted index upon occurrence of a predetermined operation that changes the content; generating at least one signature for the at least one target based on the representation of content of the target, wherein generating the at least one signature further includes the step of extracting a set of tokens representing content of the at least one target, and the inverted index is associated with signatures of each target of the set of targets; wherein generating the at least one signature further includes the step of extracting a set of tokens representing content of the at least one target, and the inverted index is associated with signatures of each target of the set of targets; and comparing the at least one generated signature with at least one previously generated signature for the same at least one target to determine whether the signatures have a similarity above a predetermined threshold,