20. A computer implemented method for enterprise-wide forensic data analysis, the method comprising: providing a search pack exchange server programmed to provide search packs to one or more external systems; storing, in a nontransitory computer readable storage module, a plurality of search packs in a search pack repository, wherein the search packs are generated by different agencies within the enterprise; providing a search pack editor module adapted to create, edit and delete search packs; extracting unknown raw data from a plurality of raw data sources and providing the extracted unknown raw data as output; receiving the extracted unknown raw data from the data extraction module; determining which one or more search packs to send the unknown raw data to wherein the determination is based on categories of data; automatically identifying suspect data from among the extracted unknown raw data by applying a hash function to the extracted raw data to generate an extracted data hash value, and comparing the extracted data hash value to find identical and similar suspect data features; and storing findings reports in a findings report repository; and exchanging search packs and the findings reports between multiple, different agencies within the enterprise.
20. A computer implemented method for enterprise-wide forensic data analysis, the method comprising: providing a search pack exchange server programmed to provide search packs to one or more external systems; storing, in a nontransitory computer readable storage module, a plurality of search packs in a search pack repository, wherein the search packs are generated by different agencies within the enterprise; providing a search pack editor module adapted to create, edit and delete search packs; extracting unknown raw data from a plurality of raw data sources and providing the extracted unknown raw data as output; receiving the extracted unknown raw data from the data extraction module; determining which one or more search packs to send the unknown raw data to wherein the determination is based on categories of data; automatically identifying suspect data from among the extracted unknown raw data by applying a hash function to the extracted raw data to generate an extracted data hash value, and comparing the extracted data hash value to find identical and similar suspect data features; and storing findings reports in a findings report repository; and exchanging search packs and the findings reports between multiple, different agencies within the enterprise. 21. The method of claim 20 , further comprising providing an interface to permit an external system coupled to the enterprise to conduct a forensic data analysis using search packs created by different agencies.