# US 12,602,515 B2 · Instrumentation using access time value > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,515 B2 - Document ID: US12602515B2 - Status: Granted - Kind: B2 - Application number: 19/365,372 - Filed: 2025-10-22 - Published: 2026-02-12 - Granted: 2026-04-14 - Earliest claimed: 2023-04-27 - Assignees: RapidFort, Inc. - Applicants: RapidFort, Inc. - Inventors: Mehran Farimani; Rajeev Thakur; Chien-Hung Chen - Web page: https://patentgrep.com/patent/US12602515B2 ## CPC - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - G06F 16/10: File systems; File servers - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer sets an access time for a set of files to an initial value. Upon accessing a file by a set of executables, the computer sets the access time of the file to a new value. The computer identifies, from the set of files, a subset of files accessed by the set of executables based on the access time of files in the subset being different from the initial value. The computer provides an output representing the subset of files. ## Claims ### Claim 1 A computer-implemented method for identifying accessed files in a computing environment by instrumenting one or more applications, the method comprising: setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables; adding, to an application image comprising the set of executables, a first wrapper engine for execution upon initiation of the application image, wherein the first wrapper engine sets the access time for the set of files to the initial value; executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of the computing environment sets the access time of the file to a new value; identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value; and providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of the one or more applications or restricting access to one or more files not included in the subset of files. ### Claim 2 (depends on 1) The method of claim 1, further comprising: overriding, using a computing environment manager, a default entry point of the application image, wherein the application image comprises the set of executables, to access a wrapper engine, wherein the wrapper engine sets the access time for the set of files to the initial value. ### Claim 3 (depends on 1) The method of claim 1, wherein the access time is a field in metadata of the file, wherein the initial value is zero, and wherein the new value represents a time when the file is accessed. ### Claim 4 (depends on 1) The method of claim 1, further comprising: executing a side process to wake up in response to a trigger, wherein the subset of files accessed by the set of executables is identified, during execution of the application image, upon waking up of the side process. ### Claim 5 A non-transitory machine-readable medium storing instructions which, when executed by one or more computing machines, cause the one or more computing machines to perform operations comprising: setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables; executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of a computing environment sets the access time of the file to a new value; identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value; and providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of one or more applications or restricting access to one or more files not included in the subset of files, wherein the set of executables comprises a stub of at least one executable from an application image, wherein the stub sets the access time for the set of files to the initial value, and wherein the stub identifies the subset of files, wherein the stub is generated during instrumentation of the at least one executable. ### Claim 6 (depends on 5) The machine-readable medium of claim 5, wherein the access time is a field in metadata of the file, wherein the initial value is zero, and wherein the new value represents a time when the file is accessed. ### Claim 7 (depends on 5) The machine-readable medium of claim 5, wherein the instrumented application comprises an original application and a stub of the original application, wherein setting the access time for the set of files to the initial value is accomplished by software that intercepts the instrumented application at a beginning of execution of a first executable from the set of executables, and wherein identifying the subset of files is accomplished by software that intercepts the instrumented application at an end of execution of a second executable from the set of executables. ### Claim 8 (depends on 7) The machine-readable medium of claim 7, wherein the instrumented application comprises an output of instrumentation of the original application. ### Claim 9 (depends on 7) The machine-readable medium of claim 7, the operations further comprising: identifying a content item in temporary instantiated storage for the instrumented application; and causing, via an unstubbing technique, the content item to appear in an original location of the content item in the original application after setting the access time for the set of files to the initial value. ### Claim 10 (depends on 5) The machine-readable medium of claim 5, wherein the set of executables comprises an instrumentation of the at least one executable, wherein the instrumentation comprises the stub and an original of the at least one executable. ### Claim 11 (depends on 5) The machine-readable medium of claim 5, the operations further comprising: overriding, using a computing environment manager, a default entry point of the application image, wherein the application image comprises the set of executables, to access a wrapper engine, wherein the wrapper engine sets the access time for the set of files to the initial value. ### Claim 12 (depends on 11) The machine-readable medium of claim 11, wherein the wrapper engine identifies the subset of files. ### Claim 13 (depends on 11) The machine-readable medium of claim 11, the operations further comprising: adding the wrapper engine to the application image. ### Claim 14 (depends on 11) The machine-readable medium of claim 11, wherein the wrapper engine is external to the application image but is mapped to the computing environment by specifying a start setting to the computing environment manager that manages the computing environment, wherein the computing environment comprises one or more executables from the application image. ### Claim 15 (depends on 11) The machine-readable medium of claim 11, wherein the wrapper engine is external to the application image and is not mapped to the computing environment, wherein the computing environment comprises one or more executables from the application image. ### Claim 16 (depends on 5) The machine-readable medium of claim 5, the operations further comprising: adding, to the application image, a first wrapper engine for execution upon initiation of the application image, wherein the first wrapper engine sets the access time for the set of files to the initial value, and wherein the application image comprises the set of executables. ### Claim 17 (depends on 16) The machine-readable medium of claim 16, the operations further comprising: adding, to the application image comprising the set of executables, a second wrapper engine for execution upon termination of the application image, wherein the second wrapper engine identifies the subset of files. ### Claim 18 (depends on 17) The machine-readable medium of claim 17, wherein a single wrapper engine comprises the first wrapper engine and the second wrapper engine. ### Claim 19 (depends on 5) The machine-readable medium of claim 5, wherein the set of executables comprises a single executable. ### Claim 20 (depends on 5) The machine-readable medium of claim 5, wherein the application image comprises the set of executables. ### Claim 21 (depends on 5) The machine-readable medium of claim 5, wherein the initial value represents a time before the start time of executing the at least the part of the set of executables, the start time occurring after setting the access time for the set of files to the initial value. ### Claim 22 (depends on 21) The machine-readable medium of claim 21, wherein the new value represents a time after the start time. ### Claim 23 (depends on 5) The machine-readable medium of claim 5, wherein setting the access time to the new value is in response to determining that at least one of: an initial access of the file is occurring, a current modification time is younger than the access time before setting the access time to the new value, a current change time is younger than the access time before setting the access time to the new value, or the access time before setting the access time to the new value is at least a threshold time period before a current time. ### Claim 24 (depends on 5) The machine-readable medium of claim 5, the operations further comprising: executing a side process to wake up in response to a trigger, wherein the subset of files accessed by the set of executables is identified, during execution of the application image, upon waking up of the side process. ### Claim 25 (depends on 24) The machine-readable medium of claim 24, wherein the trigger comprises at least one of: reaching one or more predetermined times, a user request, a signal, an inter-process communication message or a network message. ### Claim 26 (depends on 5) The machine-readable medium of claim 5, wherein metadata of each file of the set of files comprises an access time field, and wherein setting the access time of the set of files to the initial value comprises setting the access time field of each file of the set of files to the initial value. ### Claim 27 A system comprising: processing circuitry; and a memory storing instructions which, when executed by the processing circuitry, cause the processing circuitry to perform operations comprising: setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables; executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of a computing environment sets the access time of the file to a new value; identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value; and providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of one or more applications or restricting access to one or more files not included in the subset of files, wherein the set of executables comprises a stub of at least one executable from an application image, wherein the stub sets the access time for the set of files to the initial value, and wherein the stub identifies the subset of files, wherein the stub is generated during instrumentation of the at least one executable. ### Claim 28 (depends on 27) The system of claim 27, wherein the access time is a field in metadata of the file, wherein the initial value is zero, and wherein the new value represents a time when the file is accessed. ### Claim 29 (depends on 27) The system of claim 27, wherein the instrumented application comprises an original application and a stub of the original application, wherein setting the access time for the set of files to the initial value is accomplished by software that intercepts the instrumented application at a beginning of execution of a first executable from the set of executables, and wherein identifying the subset of files is accomplished by software that intercepts the instrumented application at an end of execution of a second executable from the set of executables. ### Claim 30 (depends on 27) The system of claim 27, wherein the set of executables comprises an instrumentation of the at least one executable, wherein the instrumentation comprises the stub and an original of the at least one executable.