Systems for enabling an application to track provenance include an instrumented application binary on a client device. Overwritten library call instructions provide library calls to one or more instrumented libraries that invoke a provenance layer to track data operations. The provenance layer is configured to catch and log data events performed by the instrumented application.