An on device client that augments operating system functionality may monitor for an event from an operating system running on a processor of a device. Responsive to determining that the event is indicative of an installation of an application on the device, the on device client may generate a table associated with the application. The table comprises locations of file system entities associated with the application. The table is stored in a memory device. Responsive to determining that the event is indicative of a modification to the application installed on the device, the on device client may trigger one or more automatic processor actions to keep the modification consistent across the file system entities of the application.