9. The method as recited in claim 8 , further comprising said query system querying file data stored in one or more of said plurality of files.
8. A method, comprising: a file system storing file system content including a plurality of files on a storage device, wherein said file system is implemented by a host device and is configured to manage access to said storage device; said file system performing in-band detection of file system content access events; in response to performing said in-band detection, said file system generating a respective metadata records indicative of said file system content access events; and a query system evaluating a query specifying one or more conditions for selecting one or more of said respective metadata records, wherein said query is formulated in a query language.