Methods, devices, and systems for analyzing negotiated negotiable instruments for unlawful activity are described. A computer system, including a computer readable storage device and a processor may be provided. A plurality of electronic files may be received. Each of these electronic files of the plurality of electronic files may include an electronic image of at least a portion of a negotiable instrument and include a plurality of data fields. The plurality of electronic files may be divided into subsets based on whether data is available in particular data fields of the electronic files. Based upon the subset an electronic file is made a member of, various selection criteria may be applied to determine if the electronic file is a candidate for suspicious and/or illegal activity. Also, a listing of candidates for suspicious and/or illegal activity may be presented to a user.