Firstly, you need to remember that disavow links tool is not what you need to focus on as it only helps you ignore some links - you should remove some links before you upload a disavow link file with links you weren't able to delete.
As for choosing which links can have a negative influence on your rankings, you can start from checking domain PR (not PR of page with a link to you). If a home page has PR 0 or the PR isn't available, it's the first signal that tells you that:
a) domain is quite new and hasn't had time to gain trust from search engines;
b) domain has a penalty and it's PR was cut down to 0.
In both situations, links on such websites give you a minimal amount of weight, or can be toxic, so if you worry about your rankings, start from deleting them.
The second thing you should check on is the source of links. If you have lots of backlinks from the same source (ie. forums), Google may not like it as it looks unnatural.
Anchor texts are also very important. Most of websites that get unnatural links notification, have overoptimized anchor texts - you should try to remove some of them or change them to brand anchors (company name or website address).
If you think that someone else is trying to harm your websites' rankings, check Google Webmaster Tools and MajesticSEO to see when exactly those links were added. You'll know which links you should focus on.
As soon as you prepare a list of suspicious links, try to remove as many as possible. If you can't delete some links, put them in the disavow links file.
