Abstract: Techniques relating to tracking storage operations performed by a guest virtual machine executing on a computer system are disclosed. The guest virtual machine may include a filter driver that provides an indication to a storage tracking virtual machine executing on the computer system that the guest virtual machine is performing a write operation to a production storage device. The storage tracking virtual machine then communicates information about the write operation to a backup storage device (e.g., one that provides continuous data production (CDP) to the computer system). In another embodiment, the storage tracking virtual machine may insert breakpoints into a guest virtual machine. When a first breakpoint triggers, the storage tracking virtual machine captures an I/O buffer of the guest virtual machine. After a second breakpoint triggers, the storage tracking virtual machine communicates information about the write operation to a backup storage device.