Records declaration filesystem monitoring

A computer-implemented method to enforce a record disposition protocol on a computer system even when the computer system is offline, the computer-implemented method comprising:

• retrieving, from a record manager and over a data communications network, updates for a plurality of record definitions;
• applying the retrieved updates to the plurality of record definitions, such that once the updates are applied the plurality of record definitions is identical to a corresponding copy maintained by the record manager;
• retrieving a record definition of the plurality of record definitions, the record definition specifying one or more conditional expressions for use in identifying files to be classified as electronic records to be retained;
• for each of a plurality of files from a plurality of filesystems, responsive to determining that a respective plurality of file attributes for the respective file satisfies the one or more conditional expressions in the record definition, classifying the respective file as an electronic record;
• selecting, without requiring user action, a record disposition protocol, from a plurality of record disposition protocols, that corresponds to the record definition;
• monitoring, by a respective filesystem filter driver of a plurality of filesystem filter drivers, filesystem operations in each of the plurality of filesystems from one or more applications to an operating system filesystem driver for the respective filesystem, in order to enforce the selected record disposition protocol corresponding to the record definition, wherein the respective filesystem filter driver is executing by operation of one or more computer processors of the computer system, wherein the operating system file system driver is separate from the respective filesystem filter driver and comprises a component of an operating system executing on the computer system, wherein the record disposition protocol specifies one or more allowable file activities for the files classified as electronic records;
• and
• upon detecting that the monitored filesystem operations include a first filesystem operation for a first file, of the plurality of files, that has been classified as an electronic record within a first filesystem of the plurality of filesystems, allowing, by a file system filter driver of the plurality of filesystem filter drivers and even when the computer system is offline, the first file operation for the first file to complete only upon determining that the first file operation does not violate the selected record disposition protocol, the selected record disposition protocol specifying a first set of actions that are permitted on the first file and a second set of actions that are logged, wherein a log entry describing the first filesystem operation is created;
• wherein upon determining that the first filesystem operation violates the record disposition protocol, execution of the first filesystem operation is prevented by the filesystem filter driver, including filtering the first filesystem operation such that the operating system filesystem driver for the first filesystem does not receive the first filesystem operation for execution;
• wherein the filesystem filter driver and the operating system filesystem driver are distinct drivers operatively connected and configured to operate in conjunction to enforce the record disposition protocol on the computer system:
• (i) even when the computer system is offline and (ii) in a manner that even administrative users of the computer system cannot circumvent.