Patent ID: 7991747

Claim:
A computer-implemented method comprising: monitoring, by a client agent, information content on a client for violations of a policy; determining, by the client agent, that a violation of the policy has occurred for content of a temporary file of an application; correlating, by the client agent, the policy violation of the temporary file with an original file of the application; wherein correlating the policy violation of the temporary file with the original file of the application comprises: monitoring file system operations performed by a file system for the temporary file with a file system driver; detecting that a first file system operation has occurred; detecting that a second file system operation has occurred subsequent to the first file system operation; and correlating the policy violation of the temporary file with a name of the original file in response to detection of a sequence of the first and second file system operations; generating a report for the policy violation of the temporary file using the name of the original file, and providing the report indicating the monitored file system operations to a data loss prevention (DLP) agent of a computer system.