A method of determining software trustworthiness, comprising: receiving identification information associated with files of unknown trustworthiness stored on client computers; determining prevalence of at least one file of the files stored on the client computers in response to the identification information associated with files; generating a list of files of unknown trustworthiness ordered by prevalence among the client computers wherein the identification information indicates the number of client computers that have requested a trustworthiness level for a given file wherein files for which a level of trustworthiness is requested by more client computers are assigned a higher prevalence and files for which a level of trustworthiness is requested by fewer client computers are assigned a lower prevalence; removing from the list of files, information associated with at least one file in response to the prevalence thereof falling below a threshold prevalence; capturing a first snapshot of a software state of a clean machine prior to installing a software package; identifying, obtaining and storing one or more software packages that include at least one file of the list of files; installing on the clean machine one of the one or more software packages identified as including the at least one file of the list of files; capturing a second snapshot of the software state of the clean machine subsequent to installing the software package; comparing the first snapshot with the second snapshot to identify files that have been installed or modified on the clean machine by the software package; generating a report package including a catalog of the files that have been installed or modified on the clean machine by the software package; determining identification attributes for each of the files in the catalog; processing each of the files in the catalog to assign a level of trustworthiness thereto, wherein the level of trustworthiness assigned to each of the files in the catalog is included as a trustworthiness attribute for each of the files in the catalog of the report package; and providing the report package including the trustworthiness attributes as an output. determining prevalence of at least one file of the files stored on the client computers in response to the identification information associated with files; generating a list of files of unknown trustworthiness ordered by prevalence among the client computers wherein the identification information indicates the number of client computers that have requested a trustworthiness level for a given file wherein files for which a level of trustworthiness is requested by more client computers are assigned a higher prevalence and files for which a level of trustworthiness is requested by fewer client computers are assigned a lower prevalence; removing from the list of files, information associated with at least one file in response to the prevalence thereof falling below a threshold prevalence; capturing a first snapshot of a software state of a clean machine prior to installing a software package; identifying, obtaining and storing one or more software packages that include at least one file of the list of files; installing on the clean machine one of the one or more software packages identified as including the at least one file of the list of files; capturing a second snapshot of the software state of the clean machine subsequent to installing the software package; comparing the first snapshot with the second snapshot to identify files that have been installed or modified on the clean machine by the software package; generating a report package including a catalog of the files that have been installed or modified on the clean machine by the software package; determining identification attributes for each of the files in the catalog; processing each of the files in the catalog to assign a level of trustworthiness thereto, wherein the level of trustworthiness assigned to each of the files in the catalog is included as a trustworthiness attribute for each of the files in the catalog of the report package; and providing the report package including the trustworthiness attributes as an output.