To perform information tracing, at least one signature to be traced is received. It is detected that a first process causes data to be provided to at least one of a second process and a file. It is determined whether the data contains the at least one signature. In response to determining that the data contains the at least one signature, a log is updated. The log contains information identifying at least one of processes and files that are part of a flow of the at least one signature.