Patent ID: 8356357

Claim:
A computer-implemented method of detecting and tracking transformed files suspected to contain confidential information and inaccessible by a Data Loss Prevention (DLP) application, the method comprising: detecting, by a computer, that an application has accessed a file that contains confidential information; detecting, by the computer, that the application wrote a transformed file that contains content inaccessible to the DLP application, the transformed file suspected to contain at least a portion of the confidential information; generating, by the computer, a signature for the transformed file containing the inaccessible content, the signature stored in a signature database containing a plurality of signatures of transformed files; comparing, by the computer, the signature generated to files transmitted via a network, wherein the transmitted files contain content inaccessible to the DLP application; and responsive to a comparison indicating that the signature matches a file transmitted via the network, detecting, by the computer, that matched file is the transformed file.