Add a new signature module, reports when hidden or system files are created.  Also fix up the filetime mimicking module to report all instances