Patent ID: 8346805

Claim:
A method, comprising: intercepting operations to save files to a system, wherein said intercepting is performed by a kernel mode input/output filter driver; scanning contents of said files to generate file signatures respectively corresponding to said files, wherein said file signatures are dependent upon data stored within respective files, and wherein said scanning is performed by a signature processing user mode service; for two or more of said files, determining whether individual ones of said file signatures respectively corresponding to said files match one or more signatures stored in a signature database; for at least one file, in response to determining that said file signature respectively corresponding to said at least one file matches one or more signatures stored in said signature database, executing a storage policy with respect to said at least one file; and for at least another file, in response to determining that said file signature respectively corresponding to said at least another file matches no signatures stored in said signature database, saving said at least another file to said system.