Application data associated with an application program located on a storage device is restored utilizing tracked changed blocks of the storage device. The changed blocks of the storage device are tracked as the application program modifies the application data. When a system failure has occurred, file change data is generated for each file of the application data as a function of tracked changed clocks of the storage device and file system metadata of the storage device. Additionally, a file difference record for each changed file is generated to indicate changes between the application data and the last backup. The file difference record is applied to the application data such that application data corresponds to the state of last backup.