System and method for data remediation without data loss

Patent metadata

Field	Value
Publication number	US-11327848-B2
Application number	US-201916718399-A
Country	US
Kind code	B2
Filing date	Dec 18, 2019
Priority date	Dec 18, 2018
Publication date	May 10, 2022
Grant date	May 10, 2022

Abstract

Disclosed herein are systems and methods for data remediation without data loss. In one exemplary aspect, the method comprises performing, at a first time, a first backup of a plurality of files on a file system of a computer system; tracking changes to any of the plurality of files on the file system after the first time; performing, at a second time, a second backup of the plurality of files on the file system; detecting, based on a scan of the second backup, an infection of the computer system caused by a malicious application; identifying, by the processor, a most recent backup of the file system that does not comprise the infection; in response to determining that the first backup is the most recent backup: restoring the first backup to the file system, and restoring a subset of files on the file system for which authorized changes.

First claim

What is claimed is:

1. A method for remediation of data, the method comprising:
performing, at a first time by a processor, a first backup of a plurality of files on a file system of a computer system;
tracking, by the processor, changes to any of the plurality of files on the file system after the first time by determining whether new user files were created or existing user files were modified on the file system;
storing path information, the new user files, and modified user files in a sync and share storage volume;
maintaining reparse points and metadata for the new user files and the modified user files, wherein the metadata identifies a location of the new user files and the modified user files in the sync and share storage volume;
performing, at a second time by the processor, a second backup of the plurality of files on the file system;
detecting, by the processor, based on a scan of the second backup, an infection of the computer system caused by a malicious application;
identifying, by the processor, a most recent backup of the file system that does not comprise the infection;
in response to determining that the first backup is the most recent backup:
restoring, by the processor, the first backup to the file system;
restoring, by the processor, a subset of files on the file system for which authorized changes were detected between the first time and the second time by recalling data of the new user files and modified user files from the sync and share storage volume using the reparse points.

2. The method of claim 1 , wherein the authorized changes comprises at least one of (1) file modification, (2) file removal, (3) file creation, wherein the authorized changes are not caused by the malicious application and are verified by a user of the computer system.

3. The method of claim 1 , wherein a third backup is performed by the processor at a third time between the first time and the second time, wherein the infection was caused between the first time and the third time, and wherein the infection was detected by the processor after the second time, further comprising:
performing a scan of the third backup; and
in response to determining that the infection exists in the third backup, restoring the first backup and restoring the subset of files.

4. The method of claim 1 , wherein a third backup is performed by the processor at a third time between the first time and the second time, wherein the infection was caused between the third time and the second time, and wherein the infection was detected by the processor after the second time, further comprising:
performing a scan of the third backup; and
in response to determining that the infection does exist in the third backup, restoring the third backup and restoring another subset of files on the file system for which authorized changes were detected between the third time and the second time.

5. The method of claim 1 , wherein tracking the changes to any of the plurality of files further comprises:
storing the path information related to the new user files or the modified user files to secure storage.

6. The method of claim 5 , wherein restoring the subset of files comprises:
after restoring the first backup, retrieving the path information of the new user files and the modified user files; and
restoring the subset of files based on the retrieved path information.

7. The method of claim 1 , further comprising:
storing the new user files and the modified user files to secure storage along with the path information;
performing a scan for maliciousness on the new user files and the modified user files; and
wherein restoring the subset of files comprises restoring the new user files and the modified user files from the secure storage to the file system of the computer system based on the scan.

8. The method of claim 1 , further comprising:
identifying a dedicated portion of an image backup archive used for regular backup operations; and
storing the path information, the new user files and the modified user files in the dedicated portion of the image backup archive.

9. A system for remediation of data, the system comprising:
a processor configured to:
perform, at a first time, a first backup of a plurality of files on a file system of a computer system;
track changes to any of the plurality of files on the file system after the first time by determining whether new user files were created or existing user files were modified on the file system;
store path information, the new user files, and modified user files in a sync and share storage volume;
maintain reparse points and metadata for the new user files and the modified user files, wherein the metadata identifies a location of the new user files and the modified user files in the sync and share storage volume;
perform, at a second time, a second backup of the plurality of files on the file system;
detect, based on a scan of the second backup, an infection of the computer system caused by a malicious application;
identify a most recent backup of the file system that does not comprise the infection;
in response to determining that the first backup is the most recent backup:
restore the first backup to the file system;
restore a subset of files on the file system for which authorized changes were detected between the first time and the second time by recalling data of the new user files and modified user files from the sync and share storage volume using the reparse points.

10. The system of claim 9 , wherein the authorized changes comprises at least one of (1) file modification, (2) file removal, (3) file creation, wherein the authorized changes are not caused by the malicious application and are verified by a user of the computer system.

11. The system of claim 9 , wherein a third backup is performed by the processor at a third time between the first time and the second time, wherein the infection was caused between the first time and the third time, wherein the infection was detected by the processor after the second time, and wherein the processor is further configured to:
perform a scan of the third backup; and
in response to determining that the infection exists in the third backup, restore the first backup and restore the subset of files.

12. The system of claim 9 , wherein a third backup is performed by the processor at a third time between the first time and the second time, wherein the infection was caused between the third time and the second time, wherein the infection was detected by the processor after the second time, and wherein the processor is further configured to:
perform a scan of the third backup; and
in response to determining that the infection does exist in the third backup, restore the third backup and restore another subset of files on the file system for which authorized changes were detected between the third time and the second time.

13. The system of claim 9 , wherein the processor is further configured to track the changes to any of the plurality of files by:
storing the path information related to the new user files or the modified user files to secure storage.

14. The system of claim 13 , wherein the processor is further configured to restore the subset of files by:
after restoring the first backup, retrieving the path information of the new user files and the modified user files; and
restoring the subset of files based on the retrieved path information.

15. The system of claim 9 , wherein the processor is further configured to:
store the new user files and the modified user files to secure storage along with the path inf

Assignees

• Acronis Int Gmbh

Inventors

• Ishanov Oleg
• Strogov Vladimir
• Kornachev Igor
• Kulaga Andrey
• Grebennikov Nikolay
• Beloussov Serguei
• Protasov Stanislav

Classifications

• G06F11/1451

  by selection of backup contents · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F2221/033

  Test or assess software · CPC title