1. A method of examining data within a computing device to detect data modification, said computing device having a processor and memory segregated into kernel space and user space, the method comprising: determining a number N, N≧1, of primary outbound content indicators of outbound data at said user space, said N primary outbound content indicators belonging to a set of M indicator types, M≧N; determining N secondary outbound content indicators of said outbound data at said kernel space, said N secondary outbound content indicators belonging to said set of M indicator types; and comparing each said primary outbound content indicator with a corresponding secondary outbound content indicator, wherein a primary outbound content indicator and a corresponding secondary outbound content indicator have a common indicator type from among said set of M indicator types; and ascertaining absence of modifications of said outbound data according to a result of said comparing.