Patent ID: 7937758

Claim:
A method for determining an origin of a file on a computer system comprising monitoring file origin events on the computer system; selecting a file of interest, on the computer system, resulting from one of the file origin events; identifying a first precursor file from a first record of a file origin table, wherein the file of interest emanates from the first precursor file as a result of the one of the file origin events; adding the first precursor file to a file origin path list, wherein the file origin path list comprises a list of records of one or more precursor files that are a predecessor of the file of interest, wherein the list of records is a chain of records from the file of interest to an origin file; substituting the first precursor file for the file of interest; iteratively performing the identifying operation upon successive precursor files substituted in the identifying operation for the previously identified file until the origin file with no further precursor file is identified; generating a signature for each of the precursor files added to the file origin path list; adding the signature for each precursor file to the file origin path list; receiving a request to download a file, wherein the file originates from at least one precursor file in the file origin path list; and determining whether to allow the file to download based on an analysis of the signature for the at least one precursor file in the file origin path list.