A technique is disclosed for protecting a file. In one embodiment, the technique comprises requesting access to a file, accessing a vnode associated with the file; and executing a substitute routine associated with the vnode.