Just quickly thinking of where there might be a lot of images/documents modified quickly: web browser cache, photo management software, antivirus software.
I think it'd be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.
I think it'd be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.
https://www.qubes-os.org/intro/