Enhanced live virtual machine file system instrumentation for security analysis

A method, comprising:

• receiving a sample for automated dynamic analysis using a computing environment;
• freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files;
• and
• performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files.

A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• receiving a sample for automated dynamic analysis using a computing environment;
• freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files;
• and
• performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files.