1. A system for forensic data analysis comprising: a raw data receiver that receives raw data; a processor coupled to a nontransitory computer readable medium and the raw data receiver, the computer readable medium having stored thereon software instructions and a plurality of search packs each having associated suspect data features, the software instructions, when executed by the processor cause the processor to perform forensic data analysis operations, the software instructions being arranged to define: a search pack controller that imports, exports, creates or edits search packs; a data extraction module that extracts unknown raw data from a plurality of raw data sources and provides extracted raw data as output; an interpreter module that receives the extracted unknown raw data from the data extraction module; determines which one or more search packs to send the unknown raw data to wherein the determination is based on categories of data; accesses the plurality of search packs; automatically identifies suspect data from among the extracted unknown raw data by applying a hash function to the extracted raw data to generate an extracted data hash value, and comparing the extracted data hash value to find identical and similar suspect data features; and generates a report indicating any matches between the extracted unknown raw data and any similar suspect data features.