Patent attributes
A method, a computer program product, and a system for initializing components to monitor for unauthorized encryptions of filesystem objects stored on a computing system. The method includes configuring an encryption monitor register to establish monitoring preferences of filesystem objects and allocating a predetermined size of persistent memory as a backup memory area for storing pre-encrypted versions of the filesystem objects. The method also includes inserting a starting address of the backup memory area in data bits of the encryption monitor register, and setting encryption monitor bits of page table entries in a hardware page table that correspond to at least one filesystem object, thereby establishing encryption monitoring of the filesystem object.
