Abstract: Continuous data protection is performed as two parallel processes: creating an initial backup by copying a data as a file/directory from the storage device into the backup storage, and copying the data to be written to the data storage as a part of a file/directory into the incremental backup. Alternatively, it can be performed as one process: copying the data to be written to the data storage as a part of a file/directory on the storage. A write command to a file system driver is intercepted and redirected to the backup, and the data is written to the incremental backup. If the write command is also directed to a not yet backed up data (a file/directory), the identified data is copied from the storage device to intermediate storage. The write command is executed on the file/directory from the storage device, and the file/directory is copied from the intermediate storage.