In one embodiment, a system may include a storage device configured to provide a storage space for data storage and a file system configured to map files to the storage space for storage and to manage application accesses to the storage device. The file system may be configured to determine a signature of a first file stored on the storage device dependent upon at least a portion of the first file, detect an operation to access content of the first file, where the operation is generated by an application distinct from the file system, and, subsequent to detecting the operation, store a record of the operation associated with the first file, where the record includes a signature corresponding to the first file, information indicating the operation type and information identifying the application.