File level incremental continuous data protection

A non-transitory computer readable medium containing software that, when executed by a processor, creates point-in-time versions of files for applications at a storage system, the software comprising:

• executable code that maintains at the storage system a data structure correlating each of a plurality of applications with all of the files associated with each of the applications and correlating each of the files with portions of the data storage system, wherein at least some of the applications are associated with more than one of the files;
• executable code that uses the data structure to determine more than one of the specific files for a particular one of the applications for which a point-in-time version is being created;
• executable code that uses the data structure to determine specific portions of the storage system corresponding to the specific files;
• executable code that suspends writes to the specific portions to suspend writes to all of the specific files for the particular one of the applications based on association of each of the specific files to the particular one of the applications;
• executable code that completes previous writes to the specific portions following suspending writes;
• and
• executable code that performs a snapshot of only the specific files following completing previous writes.

A storage system that creates point-in-time versions of files for applications, comprising:

• a processor;
• and
• a non-transitory computer readable medium containing executable code that is executed by a processor to maintain in a memory of the storage system a data structure correlating each of a plurality of applications with all of the files associated with each of the applications and correlating each of the files with portions of the data storage system, wherein at least some of the applications are associated with more than one of the files, executable code that is executed by a processor to use the data structure to determine more than one of the specific files for a particular one of the applications for which a point-in-time version is being created, executable code that is executed by a processor to use the data structure to determine specific portions of the storage system corresponding to the specific files, executable code that is executed by a processor to suspend writes to the specific portions to suspend writes to all of the specific files for the particular one of the applications based on association of each of the specific files to the particular one of the applications, executable code that is executed by a processor to complete previous writes to the specific portions following suspending writes, and executable code that is executed by a processor to perform a snapshot of only the specific files following completing previous writes.