Abstract: Computer receives, from within system application comprising application(s) that communicate with operating system(s) (OS), selection of target application. Computer creates stub application for target application that mimics entry and exit points of target application. Computer isolates target application externally to system application. Computer establishes network connection(s) connecting isolated target application and stub application to process communication between isolated target application and system application. Computer generates OS tracing system that logs file and directory accesses of isolated target application. Computer monitors runtime behavior of isolated target application, using logs of OS tracing system, to identify files used by target application. Computer determines set of files not used by target application.