1. A method for determining an origin of a file on a computer system comprising monitoring file origin events on the computer system; selecting a file of interest resulting from one of the file origin events; identifying a precursor file from which the file of interest emanates as a result of the one of the file origin events; and iteratively performing the identifying operation upon successive precursor files substituted in the identifying operation for the file of interest until an origin file with no further precursor file is identified.