System and method for identifying leaked data and assigning guilt to a suspected leaker

A system and method for identifying a leaked data file and assigning guilt to one or more suspected leakers proceeds through a plurality of levels. At a first level, primary watermark detection occurs. Data is inserted into a subset of data to determine correlation with data in the suspected leaked file. The guilt probability that results is then weighted based on the number of bits matched. In a second level, another search process is performed for detecting additional salt-related patterns. The guilt score is then computed for every detected recipient identifier for the suspected leaked data file, and the relative guilt of these recipients is weighted. In a third layer, the statistical distribution of data in the suspected leaked file is compared with that of corresponding data in the reference files. After this layer is complete, the average of guilt scores across each of the layers is calculated.