Abstract: Unique digital signatures of sensitive or restricted image files are calculated and stored in a database. A hook routine hooks an open or read command when an application opens an image file in order to check for a restricted digital signature of that image file. If present, a digital watermark is added to the image before the application edits that image. A user may then modify the image. A hook routine also hooks a close or write command in order to check for a digital watermark. If present, the digital watermark is removed and a new digital signature for the revised image is calculated. The digital signature for the revised image is then uploaded to a database associated with a DLP server software product, and then pushed periodically down to endpoint DLP client products.