6 BackTracker objects Process –Identified uniquely by pid & version number –Tracked from creation (fork/clone) to exit File object –Identified uniquely by a device/inode #/version # –Including data & metadata specific to file –Affected by system calls such as write Filename –Identified uniquely by a canonical name –Directory data that maps a name to a file object –Affected by system calls such as rename, create … Finer granularity than processes, file objects & filenames.
{}