Embodiments are directed to a method of identifying changed files in incremental block based backups, by obtaining changed data blocks of a file from a change block tracking (CBT) driver, wherein the file has an associated master file table (MFT) record and a parent MFT record number used in a file system, and constructing a complete file path of the file by traversing from the changed MFT record to the root directory using respective parent MFT record numbers by iteratively parsing each record by extracting the file name and parent MFT record number and appending the file name to a previous MFT record file name.