An integrated-circuit device comprising: a processor (102, 104, 106); a non-volatile memory; a hardware memory protection module configured to control access to a plurality of regions (202, 210, 212, 220, 230) of the memory in dependence on respective region-specific configuration settings; and a bus system, to which the processor (102, 104, 106) and the hardware memory protection module are connected; wherein the memory stores file creation software, which, when executed on the processor, causes the processor to: create, in the memory, a first new file by storing metadata (204, 214, 222, 226, 232) for the first new file and content data (206, 216, 224, 228, 234) for the first new file in a first memory region (202, 210, 212, 220, 230) of said plurality of memory regions; create, in the memory, a second new file by storing metadata (214, 222, 226, 232, 204) for the second new file and content data (216, 224, 228, 234, 206) for the second new file in a second memory region (210, 212, 220, 230, 202) of said plurality of memory regions, wherein the second memory region is different from the first memory region; and set respective access conditions for the first and second memory regions in the configuration settings of the hardware memory protection module, and wherein the memory stores file retrieval software and application software, wherein the file retrieval software, when executed on the processor, causes the processor to search the memory to identify a file meeting a search criterion by reading the metadata of a set of one or more files from the memory and comparing the metadata against the search criterion to identify a file from the set that meets the search criterion, and characterized by: once the file has been located by the file-retrieval software, the address of the file is passed to the application software which, when executed on the processor, attempts to access the file, thereby causing the processor, operating with a security state of the application software, to issue a bus request for a memory address in the file; and wherein the hardware memory protection module intercepts the bus request and determines whether the bus request addresses a memory region that is protected by an access condition, and, if the bus request does not meet the access condition for the memory region, the memory access request is denied, and, if the access condition is met, the memory access request is granted. a processor (102, 104, 106); a non-volatile memory; a hardware memory protection module configured to control access to a plurality of regions (202, 210, 212, 220, 230) of the memory in dependence on respective region-specific configuration settings; and a bus system, to which the processor (102, 104, 106) and the hardware memory protection module are connected; create, in the memory, a first new file by storing metadata (204, 214, 222, 226, 232) for the first new file and content data (206, 216, 224, 228, 234) for the first new file in a first memory region (202, 210, 212, 220, 230) of said plurality of memory regions; create, in the memory, a second new file by storing metadata (214, 222, 226, 232, 204) for the second new file and content data (216, 224, 228, 234, 206) for the second new file in a second memory region (210, 212, 220, 230, 202) of said plurality of memory regions, wherein the second memory region is different from the first memory region; and set respective access conditions for the first and second memory regions in the configuration settings of the hardware memory protection module,