File level incremental continuous data protection

Creating point-in-time versions of files for applications at a storage system includes maintaining at the storage system a data structure correlating each of a plurality of applications with files for each of the applications and correlating each of the files with portions of the data storage system, using the data structure to determine specific files for a particular one of the applications for which a point-in-time version is being created, using the data structure to determine specific portions of the storage system corresponding to the specific files, suspending writes to the specific portions, completing previous writes to the specific portions following suspending writes, and performing a snapshot of the specific files following completing previous writes. The portions of the data storage may be extents. A host may provide information to the storage system to correlate applications with files and to correlate files with portions of the data storage system.