Solutions are provided that use shared scan phases and scan output for various file-level incremental data analysis systems. In one embodiment, a shared scan phase is initiated for a plurality of files in a file system. During the shared scan phase, one or more rules are applied to the files in the file system to identify files on which to perform one or more operations. Shared scan output is created that includes information describing the identified files and operations to be performed on the identified files. Embodiments of the present invention can reduce the amount of time and computing resources that would otherwise be consumed by performing separate walkthroughs of a file system during separate scan phases.