1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to: populate strings extracted from clean samples into a clean string database; populate strings extracted from dirty samples into a dirty string database; determine a string sample of data; determine a hash of the string sample of data; cluster the hash with other hashes from other string samples of data; and create a string hash signature of a string sample of data.