A system comprising: a server (100, 200) accessible by multiple users (114, 124, N, 214, 224, N2), wherein the server (100, 200) is configured to host multiple application sessions (110, 120, N, 210, 220, N2) accessible by the users (114, 124, N, 214, 224, N2); an indexer hosted on the server (100, 200), the indexer is configured to analyze at least one of a file on the server (100, 200) and metadata of the file on the server (100, 200) to identify a user that created and owns the file without input from the application sessions (110, 120, N, 210, 220, N2) and to save the metadata of the file to a virtual hard disk (VHD (112, 122, N, 212, 222, N2, 310, 320, 330)) (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user, wherein the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) is temporarily mounted to the server (100, 200); wherein the indexer is configured to: monitor a handle number assigned to the file by an operating system of the server (100, 200) when a program running in one of the application sessions (110, 120, N, 210, 220, N2) is writing to the file; identify an application session writing to the file based on the monitoring of the handle number; and identify the user by mapping the application session to the user; a communications device connected to the indexer, the communication device being configured to send the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the server (100, 200) to a storage device; and a processor on a second server (100, 200), the processor being configured to retrieve the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the storage device and temporarily mount the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user to the second server (100, 200). a server (100, 200) accessible by multiple users (114, 124, N, 214, 224, N2), wherein the server (100, 200) is configured to host multiple application sessions (110, 120, N, 210, 220, N2) accessible by the users (114, 124, N, 214, 224, N2); an indexer hosted on the server (100, 200), the indexer is configured to analyze at least one of a file on the server (100, 200) and metadata of the file on the server (100, 200) to identify a user that created and owns the file without input from the application sessions (110, 120, N, 210, 220, N2) and to save the metadata of the file to a virtual hard disk (VHD (112, 122, N, 212, 222, N2, 310, 320, 330)) (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user, wherein the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) is temporarily mounted to the server (100, 200); wherein the indexer is configured to: monitor a handle number assigned to the file by an operating system of the server (100, 200) when a program running in one of the application sessions (110, 120, N, 210, 220, N2) is writing to the file; identify an application session writing to the file based on the monitoring of the handle number; and identify the user by mapping the application session to the user; a communications device connected to the indexer, the communication device being configured to send the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the server (100, 200) to a storage device; and a processor on a second server (100, 200), the processor being configured to retrieve the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the storage device and temporarily mount the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user to the second server (100, 200). monitor a handle number assigned to the file by an operating system of the server (100, 200) when a program running in one of the application sessions (110, 120, N, 210, 220, N2) is writing to the file; identify an application session writing to the file based on the monitoring of the handle number; and identify the user by mapping the application session to the user; a communications device connected to the indexer, the communication device being configured to send the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the server (100, 200) to a storage device; and a processor on a second server (100, 200), the processor being configured to retrieve the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user from the storage device and temporarily mount the VHD (112, 122, N, 212, 222, N2, 310, 320, 330) of the identified user to the second server (100, 200).