Abstract: In one embodiment, a method is performed by a computer system. The method includes monitoring events in relation to files stored at multiple network nodes and, responsive to the monitoring, detecting that a new file has been created from an existing file. The method further includes accessing a stored file-family model of the existing file, the stored file-family model comprising interconnected nodes, wherein the interconnected nodes represent a plurality of overlapping file variants such that one of the interconnected nodes represents the existing file. In addition, the method includes logically connecting the existing file and the new file in the stored file-family model. The method also includes determining a primary file variant in the stored file-family model and, responsive to a determination that the existing file is not the primary file variant, notifying one or more users.