Identifying history of modification within large collections of unstructured data

A method for maintaining a representation of a history of operations performed on documents in a data processing environment comprising:

• maintaining a Document Distribution Path representation, the representation including entries that comprise (i) an identifier of one or more source documents, (ii) an identifier of at least one destination document;
• (iii) a relationship descriptor representative of the manner in which the one or more source documents were used to generate the destination document;
• sensing access events that possibly affect the relationships between documents, the step of sensing access events being carried out by a monitor process located within an operating system kernel of a user client computer device;
• in response to sensing an access event in which a new source document is created, or in which a relationship descriptor for an existing document has changed, creating a new entry in the Document Distribution Path representation to reflect the affect of that access event on the history of operations;
• and
• if the relationship descriptor cannot be determined from the sensed access event,
• querying the destination document against a database of existing documents to determine an appropriate relationship descriptor.