Systems, methods, and devices for real-time searching are disclosed. A method comprises receiving a real-time data stream comprised of a plurality of characters and placing the characters in shift registers, the shift registers holding a current term. During each clock cycle of the data stream, the current term is evaluated to determine whether it matches any terms in a dictionary of terms, including indexing a plurality of look-up tables with the characters in each of the shift registers. A match data is output based on the evaluating. The method may be implemented in hardware in a computer forensic device, a controller, a computing device, and in other devices.