File system point-in-time restore using recycle bin and version history

Patent metadata

Field	Value
Publication number	US-10747719-B2
Application number	US-201715836108-A
Country	US
Kind code	B2
Filing date	Dec 8, 2017
Priority date	Sep 22, 2017
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

Systems and methods for restoring a file system to a point-in-time without relying on a backup. One system includes an electronic processor configured to automatically restore a file system to a specified point-in-time by (a) automatically restoring, from a recycle bin, items deleted from the file system after the point-in-time, (b) automatically deleting, from the file system, items created within the file system after the point-in-time, (c) automatically moving items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time, (d) automatically deleting, from the file system, items copied within the file system after the point-in-time, (e) automatically renaming items renamed within the file system after the point-in-time to a name associated with the point-in-time, and (f) automatically restoring, from a version history, a version associated with the point-in-time for items with content modified after the point-in-time.

First claim

What is claimed is:

1. A system for restoring a file system to a state at a point-in-time, the system comprising:
an electronic processor configured to
receive the point-in-time,
automatically retrieve entries from a change log representing changes made to items within the file system after the point-in-time to identify items deleted from the file system after the point-in-time, items created within the file system after the point-in time, items moved within the file system after the point-in-time, items copied within the file system after the point-in-time, items renamed within the file system after the point-in-time, and items with content modified after the point-in-time, and
automatically process the entries retrieved from the change log in reverse order to roll back the changes made to the items within the file system after the point-in-time and restore the file system to the state at the point-in-time, wherein the electronic processor processes the entries retrieved from the change log by
automatically restoring, from a recycle bin, the items deleted from the file system after the point-in-time,
automatically deleting, from the file system, the items created within the file system after the point-in-time,
automatically moving the items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time,
automatically deleting, from the file system, the items copied within the file system after the point-in-time,
automatically renaming the items renamed within the file system after the point-in-time to a name associated with the point-in-time, and
automatically restoring, from a version history, a version associated with the point-in-time for the items with content modified after the point-in-time.

2. The system of claim 1 , wherein the items within the file system include at least one selected from a group consisting of a file and a folder.

3. The system of claim 1 , wherein the electronic processor is further configured to define a maximum number of versions to be maintained by the version history and a minimum number of versions to be maintained by the version history per unit of time.

4. The system of claim 1 , wherein the electronic processor is further configured to define a predetermined version to be retained per unit of time when multiple versions are available for a particular unit of time.

5. The system of claim 1 , wherein the electronic processor is further configured to create the entries included in the change log in response to the changes made to the items within the file system, wherein each entry included in the change log includes a change date and time, an identifier of the item being changed, and an identifier of a type of change.

6. The system of claim 1 , wherein at least one entry included in the change log includes at least one selected from a group consisting of an identifier of a parent item to the item being changed before the item is changed, a name of the item being changed before the item is changed, and a path of the item being changed before the item is changed.

7. The system of claim 1 , wherein the electronic processor is further configured to restore the file system to the state at the point-in-time without restoring the recycle bin.

8. The system of claim 1 , wherein the electronic processor is further configured to restore the file system to the state at the point-in-time without restoring the version history.

9. The system according to claim 1 , wherein the electronic processor is further configured to save the version associated with the point-in-time for the items with content modified after the point-in-time automatically restored from the version history as a new version within the version history.

10. The system of claim 1 , wherein the electronic processor is further configured to set a retention period of the recycle bin and the version history to a retention period of the change log.

11. The system of claim 1 , wherein the electronic processor is further configured to generate a warning in response at least one selected from a group consisting of a manual purging of the recycle bin indicating that restoring the file system will be limited if the recycle bin is manually purged and a manual purging of the version history indicating that restoring the file system will be limited if the version history is manually purged.

12. The system of claim 1 , wherein the electronic processor is further configured to use the change log for auditing purposes.

13. The system of claim 1 , wherein the electronic processor is configured to retrieve the entries from the change log by retrieving the entries from at least one audit log.

14. The system of claim 1 , wherein the electronic processor is configured to roll back the entries sequentially.

15. The system of claim 1 , wherein the electronic processor is configured to roll back the entries in parallel.

16. The system of claim 1 , wherein the electronic processor is configured to receive the point-in-time through at least one selected from a group consisting of a user interface and an application programming interface.

17. The system of claim 1 , wherein the electronic processor is configured to receive the point-in-time from a monitoring system configured to detect suspicious activity occurring within the file system.

18. The system of claim 1 , wherein the electronic processor is further configured to synchronize the file system as restored to the state at the point-in-time to at least one user device.

19. Non-transitory computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions, the set of functions comprising:
receiving a point-in-time for restoring a file system to;
automatically retrieving entries from a change log representing changes made to items within the file system after the point-in-time to identify items deleted from the file system after the point-in-time, items created within the file system after the point-in time, items moved within the file system after the point-in-time, items copied within the file system after the point-in-time, items renamed within the file system after the point-in-time, and items with content modified after the point-in-time; and
automatically processing the entries retrieved from the change log in reverse order to roll back the changes made to the items within the file system after the point-in-time and restore the file system to a state at the point-in-time, wherein processing the entries retrieved from the change log includes
automatically restoring, from a recycle bin, the items deleted from the file system after the point-in-time,
automatically deleting, from the file system, the items created within the file system after the point-in-time,
automatically moving the items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time,
automatically deleting, from the file system, the items copied within the file system after the point-in-time,
automatically renaming the items renamed within the file system after the point-in-time to a name associated with the point-in-time, and
automatically restoring, from a version history, a version associated with the point-in-time for the items with content modified after the point-in-time.

20. A method of restoring a file system to a state at a point-in-time, the method comprising:
creating an entry in a change log for each change made to the file system,

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Barreto Jose A
• Fauchere Clement B
• Abergel Meir E
• Rayson Steven J
• Song Jiashan
• Watson Andrew Sean
• Kimber Shaun W
• Desai Ronakkumar N
• Glover Andrew

Classifications

• G06F16/162

  Delete operations (erasing in storage systems G06F3/0652) · CPC title

• G06F16/1873

  Versioning file systems, temporal file systems, e.g. file system supporting different historic versions of files · CPC title

• G06F11/1446

  Point-in-time backing up or restoration of persistent data · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F11/1471

  involving logging of persistent data for recovery · CPC title