An apparatus for authorizing file access events includes a processor and a memory that stores code executable by the processor. The code is executable by the processor to record hardware usage patterns prior to a file access event of a file, and correlate the hardware usage patterns with file access events targeting the file. The code is also executable to receive a file access event targeting the file, compare a hardware usage pattern preceding the received file access event targeting the file to the hardware usage patterns correlated with file access events targeting the file, and authorize the received file access event in response to the hardware usage pattern preceding the received file access event targeting the file matching a hardware usage pattern correlated to a file access event targeting the file.