1. A method comprising: at a server in a computing system, receiving meta-data extracted from files of interest from a plurality of client computers, wherein the files of interests are selected files of the plurality of client computers and have been identified based upon activity of the files including creating, moving, copying or executing the files, and wherein the meta-data includes contextual information of how each files of interests are identified; logging the files of interest and the extracted meta-data into log files; periodically scanning the log files to identify a subset of files as candidates for rescanning based on a vector of scores, wherein the vector of scores is determined at least in part based on the contextual information; and rescanning the identified candidates against information stored at the server to determine whether a previously assigned disposition needs to be changed.