A digital forensic analysis method comprising the steps of: collecting system call data at an interface between kernel and user space of a digital computing system, the system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS; converting the collected system call data to form a collected sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element; selecting from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein the system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the collected sequence and the test sequence; and applying a non-contiguous sequence alignment algorithm to the collected sequence and the test sequence during a sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the collected sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the system call data collected at the interface of the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the collected sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a local biological sequence matching algorithm. collecting system call data at an interface between kernel and user space of a digital computing system, the system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS; converting the collected system call data to form a collected sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element; selecting from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein the system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the collected sequence and the test sequence; and applying a non-contiguous sequence alignment algorithm to the collected sequence and the test sequence during a sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the collected sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the system call data collected at the interface of the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the collected sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a local biological sequence matching algorithm.