Systems and methods for managing content provenance are provided. A network system accesses a document of a plurality of documents to be analyzed. The network system extracts text fragments from the document including a first fragment and a second fragment. A determination is made whether each of the text fragments match an entry in a hash table. Based on a first fragment not matching any entries in the hash table, the network system creates a new entry in the hash table, whereby the first fragment is used to generate a key in the hash table. Based on a second fragment matching an entry of the hash table, the network system associates the document with a key of the matching entry in the hash table, whereby the associating comprising updating the hash table with an identifier of the document.