Embodiments for determining processing performed on a data element are provided. A file system call associated with a data element stored in a storage system is detected. The file system call is analyzed. Data lineage for the data element is determined based on the analyzing of the file system call.