Software signature derivation from sequential digital forensic analysis