Storing block-level tracking information in the file system on the same block device

Writes to a storage device of a protected computer system are tracked in a manner that accounts for those writes that may occur during a system reboot process when the file system is not available. During the shutdown process, write tracking data is maintained in system memory and is written into storage locations allocated to the tracking file after the file system has been dismounted so that any writes that may occur during the file system dismount can be captured. During the boot process, temporary write tracking data is maintained in system memory even before the file system is mounted so that any writes that may occur immediately after the file system mount can be captured. The temporary write tracking data is later merged with the tracking data contained in the tracking file and the merged tracking data is used to track further writes to the storage device.