Providing an isolation system that allows analysts to analyze suspicious information in way that aids in preventing harmful information from spreading to other applications and systems on a network. A plurality of virtual containers may be used by analysts to analyze suspicious information. The suspicious information may first be hashed before being analyzed by the analyst. The hash for the suspicious information may be compared to stored hashes. When the hash meets a stored harmful hash the suspicious information may be determined to include harmful information without having to be further analyzed. When the hash meets a stored acceptable hash the suspicious information may be determined to be acceptable information without having to be further analyzed. Should the hash for the suspicious information fail to meet any stored hashes, then the suspicious information may be analyzed for harmful information within the virtual container.