Patent ID: 8726396

Claim:
A method comprising: monitoring, by a processing device of a computing system, protected files in the computing system; and when one of the protected files is created, opened, or saved, obtaining, by the processing device, a running instance of a data object, corresponding to the one protected file, from a data store that stores information to track objects that are actively being processed by a currently running application on the computing system; and extracting, by the processing device, the decrypted data from the obtained data object; and scanning, by the processing device, the decrypted data to detect a violation of a data loss prevention (DLP) policy; creating a hash of the one protected file; storing the hash and a policy violation status of the one protected file; detecting a transfer of the one protected file; checking the policy violation status of the one protected file; and performing an action when the policy violation status indicates that the one protected file violates the DLP policy.