The article introduces file identifying characteristics, describes file operation examples, offers file operation identification algorithm, presents developed file impact identification process model. There is a possibility to create system based on developed model that allows to automate file impact identification process to determine impact on stored information during information security incident response. Information impact determination makes incident result removing process easier. The system used allows to verify information sources that contain file identifying characteristics and file operations data