1. A method comprising: scanning a file directory to identify one or more suspect files stored in a file database; calculating, by a first computing device, a first value corresponding to a file in the file directory, wherein the first value is calculated using a function on a first portion of the first file that is smaller than an entire size of the file; the first computing device making an initial determination, based on the first value matching a particular value in a suspect files database, as to whether the file is a suspect file; if the initial determination determines that the file is a suspect file: the first computing device calculating a second value corresponding to the file, wherein the second value is calculated using the function on a second portion of the file that is larger than the first portion but smaller than the entire size of the file; in response to the first computing device determining that the second value matches another particular value stored in the suspect files database: the first computing device storing information identifying the file as a suspect file on a computer readable storage medium; the first computing device generating a report that is based, at least in part, upon the identification of the file as a suspect file; and the first computing device at least assisting in taking at least one remedial measure related to the file; and if the initial determination determines that the file is not a suspect file: the first computing device identifying the file as a suspect file based on a review of the file and storing the first value in the suspect files database.