Abstract: An origin of a file of interest on a computer system is determined by monitoring file origin events on the computer system. A file of interest resulting from one of the file origin events may then be selected for tracing. A precursor file from which the file of interest emanates as a result of one of the file origin events is then identified. By iteratively performing the identifying operation upon successive precursor files substituted in the identifying operation for the file of interest, an origin file with no further precursor file may thus be identified. It is thus possible to trace back a given process or file of interest to a file container and/or location that initially introduced it into the computer system and any intermediate files or forms the process or file of interest may have assumed.

Abstract: An origin of a file of interest on a computer system is determined by monitoring file origin events on the computer system. A file of interest resulting from one of the file origin events may then be selected for tracing. A precursor file from which the file of interest emanates as a result of one of the file origin events is then identified. By iteratively performing the identifying operation upon successive precursor files substituted in the identifying operation for the file of interest, an origin file with no further precursor file may thus be identified. It is thus possible to trace back a given process or file of interest to a file container and/or location that initially introduced it into the computer system and any intermediate files or forms the process or file of interest may have assumed.

Abstract: A computer device driver for accessing modified files held in archives in a memory device by reading a modified file from an archive in the memory device, demodifying the file in RAM and retaining the demodified file in RAM in whole or in part so that operations to the memory device can be performed on the demodified file by the operating system without having first to write the demodified file to the memory device. The device driver also accesses the file in said RAM and changes the contents of the file; and returns the file to the archive in said memory device.

Abstract: A computer device driver for accessing compressed files held in archives in a memory device, the device driver comprising: means for reading a compressed file from an archive in the memory device, decompressing the file in RAM and retaining the decompressed file in RAM in whole or in part so that operations to the memory device can be performed on the decompressed file by the operating system without having first to write the decompressed file to the memory device. The device driver also comprises means for accessing the file in said RAM and changing the contents of the file; and for returning the file to the archive in said memory device.