Global commonality and network logging

Data is divided into blocks, a signature is derived for a block, and the signature is stored in a storage device without retaining the block. The signature may be derived with a hash function. A second signature may be derived for a second block, and compared to the first signature. If there is a match, network data for the second block may be associated to the first signature. If there is not a match, the second signature may be stored, and the second block may be discarded. Policies may be applied, including flagging the data for review, preventing transmission of the data, and storing the data. Network data may be stored with the signatures. Data may be analyzed by dividing it into blocks, deriving a signature for a block, and comparing the signature to stored signatures. If there is a match, network data associated with the matched signature may be retrieved. A plurality of blocks may be compared to the stored signatures to determine degree of commonality.