Patent ID: 8527465

Claim:
A method for analyzing file system events comprising: receiving, by a system for analyzing file system events, a first backup image of a file system, the first backup image having at least one backed up file system object; receiving, by the system for analyzing file system events, a second backup image of the file system, the second backup image having at least one backed up file system object, the second backup image created after the first backup image; selecting a first file system object from the first backup image; and comparing the first file system object and a second version of the first file system object to determine the difference if the second version of the first file system object is located in the second backup image, if the second version of the first file system object is not located in the second backup image, then determining that the first file system object was deleted from the file system or was created in the file system at a time interval between a creation of the first backup image and a creation of the second backup image; and using the results from the comparing step to generate a model of the file system.