To provide a data protection method which allows data to be protected even when there is any access beyond administrator's intention. The data protection method for accepting an access request for a file stored in a file system of a storage device and referring or updating to the file based on the access request, includes the steps of: determining whether a current time is within a preset monitoring period; obtaining a snapshot of the file system when the time reaches the monitoring period (S101); and updating the file system with the snapshot when the time reaches end of the monitoring period (S106).