Method and system for forensic data tracking

A computing system comprising one or more network devices, the one or more network devices comprising one or more microprocessors and one or more memories that store executable instructions that, when executed by the one or more microprocessors, facilitate performance of operations, comprising:

• receiving meta data associated with an electronic file detected at an endpoint, the meta data comprising:
• one or more of a file name associated with the electronic file, a creation date on which the electronic file was created, a modification date on which the electronic file was modified, one or more data element tags, and
• an endpoint identifier that is indicative of the endpoint on which the electronic file is located;
• analyzing the meta data based on one or more of a configured setting and a policy;
• determining, based on the analyzing of the meta data, a data classification associated with the electronic file;
• further determining, based on the analyzing of the meta data, that the electronic file is unauthorized due to a pattern of data use that constitutes a deviation from normal behavior, wherein the deviation from normal behavior is a discovery that the endpoint has increased a total number of files by a percentage that exceeds an average for a user associated with the endpoint or for an average user;
• and
• in response to determining that the electronic file is unauthorized, performing one or more responsive actions.