A backup system includes a processor and a machine-readable storage storing instructions. The instructions are executable by the processor to: access a plurality of blocks included in a block-based backup of a first snapshot of a storage volume; determine, based on the plurality of blocks of the block-based backup, a first filesystem stored on the storage volume, the first filesystem being a first type of filesystem; select, from a plurality of filters, a first filter associated with the first type of filesystem; determine a changed file in the first filesystem based on the selected first filter; and update a catalog to indicate that the changed file is associated with the first snapshot.