to the shadow file 20 and corresponding bit 14 is set to 1 therefore sandbox process gets the baseline view data from virtual file 10 step 406 the method of the present invention may be used with computer systems and devices as shown in fig5 and 6 fig5 illustrates a system 500 of a computer or device which includes a microprocessor 520 and a memory 540 which are coupled to a processor bus 560 which is coupled to a peripheral bus 600 by circuitry 580 the bus 600 is communicatively coupled to a disk 620 it should be understood that any number of additional peripheral devices are communicatively coupled to the peripheral bus 600 in embodiments of the invention further the processor bus 560 the circuitry 580 and the peripheral bus 600 compose a bus system for computing system 500 in various embodiments of the invention the microprocessor 520 starts disk access commands to access the disk 620 commands are passed through the processor bus 560 via the circuitry 580 to the peripheral bus 600 which initiates the disk access commands to the disk 620 in various embodiments of the invention the present system intercepts the disk access commands which are to be passed to the hard disk as shown generally by fig6 there is a user 1000.