Client commands captured by the filter in relation to modification to file system data are parsed and used to format log entries that may include information such as a volume ID, a file handle including an inode or file ID, an operation, an offset and a length.