Aspects of the subject matter described herein relate to data protection of files that may include both content and embedded metadata. In aspects, an indication that a file has changed is received. If the content has changed, the entire file or just the content may be backed up. If the metadata only has changed, the metadata may or may not be backed up, depending on implementation. Instead of parsing the file to determine the exact size and positioning of the metadata within the file, the file may be divided into three portions: a head portion, a middle portion, and a tail portion. Hashes of these portions may then be used to determine whether the metadata and/or content of the file have changed.