1. A method for efficient computer forensic analysis and data access control, the method comprising: from within a virtualization layer separate from a guest operating system: monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory; tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network; and linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accesses.