Patent ID: 8893223

Claim:
A method, implemented by a computing system programmed to perform the following, the method comprising: creating, by a processing device of the computing system, an inventory of protected files in the computing system, wherein the inventory stores hashes and policy violation statuses of the protected files, wherein the creating the inventory comprises: obtaining a running instance of a data object corresponding to one of the protected files when the one protected file is created, opened, or saved; extracting decrypted data from the running instance of the data object; scanning the decrypted data to detect a violation of a data loss prevention (DLP) policy; creating a hash of the one protected file; and storing the hash and a policy violation status of the one protected file; monitoring the protected files of the inventory; detecting a transfer of one of the protected files being monitored; and performing an action when the policy violation status indicates that the one protected file violates the DLP policy.