Aspects and implementations of the present disclosure are directed to methods and systems for comparing sets of files using signatures. In general, in some implementations, an audit system compares a first plurality of signatures representing element information for a first file hierarchy to a second plurality of signatures representing element information for a second file hierarchy. The audit system determines, based on the comparison of the first plurality of signatures to the second plurality of signatures, whether the first file hierarchy is likely to be a modified copy of the second file hierarchy. In some implementations, the audit system compares signatures of a first signature type, selects a second signature type based on the comparison using the first signature type, and compares signatures of the second signature type. In some implementations, the second plurality of signatures is stored in a catalog of signatures representing various file hierarchies.