1. A method of examining data within a computing device to detect data modification, said computing device having at least one processor and memory segregated into kernel space and user space, the method comprising configuring said at least one processor to perform: determining a number N, N>1, of primary outbound content indicators of outbound data at said user space, said N primary outbound content indicators belonging to a set of M different indicator types, M≧N; determining N secondary outbound content indicators of said outbound data at said kernel space, said N secondary outbound content indicators belonging to said set of M different indicator types; and comparing each said primary outbound content indicator with a corresponding secondary outbound content indicator, wherein a primary outbound content indicator and a corresponding secondary outbound content indicator have a common indicator type from among said set of M different indicator types; and ascertaining absence of modifications of said outbound data according to a result of said comparing.