A method for preventing malicious software from attacking files of a computer system includes the following steps. Whether a file type of a specific file corresponding to an input/output (I/O) request is a to-be-backed-up file type is checked, wherein the to-be-backed-up file type belongs to one of multiple predetermined file types susceptible to malicious software attack. When the file type of the specific file is the to-be-backed-up file type, a backup already tag in a file context tag structure of the specific file is checked. When the backup already tag shows that the specific file has not been backed up, a backup process is performed for the specific file.