1. A method comprising: receiving mapping information corresponding to a set of data, wherein the mapping information maps at least a portion of a file to a physical storage location; reading the portion of the file from the physical storage location to which the mapping information mapped the at least the portion of the file, wherein the at least the portion of the file is read from the physical storage location without accessing a file system; analyzing the portion of the file for evidence of malicious content, wherein the receiving, the reading, and the analyzing are performed by a detection program executing on a computing device; determining that a portion of a second file contains data that are shared with the portion of the file, based on the mapping information indicating that the portion of the second file is stored in a same physical location as the portion of the file, wherein the determining comprises comparing physical location information for the portion of the second file with physical location information for the portion of the file and the first file and the second file are different files; and in response to the determining: detecting that the detection program has analyzed the portion of the file and using a result of analysis of the portion of the file as a result of analysis of the portion of the second file, wherein the using the result of the analysis of the portion of the file as a result of analysis of the portion of the second file comprises: comparing one or more entry states associated with the portion of the file with a current entry state, wherein the current entry state is a state of a virtual machine before the virtual machine processes the portion of the second file; accessing information identifying an exit state, wherein the information is associated with the portion of the file and an entry state matching the current entry state; and entering the exit state identified by the information, without processing the portion of the second file in the virtual machine.