Recovering infected snapshots in a snapshot chain

Patent metadata

Field	Value
Publication number	US-12399993-B2
Application number	US-202217980652-A
Country	US
Kind code	B2
Filing date	Nov 4, 2022
Priority date	Nov 8, 2021
Publication date	Aug 26, 2025
Grant date	Aug 26, 2025

Abstract

Subject matter related to data management is disclosed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A selection of an infected snapshot may be received, where the infected snapshot may be more recent than the identified most recent snapshot. The selected infected snapshot may be mounted. Based on mounting the infected snapshot, a determination of which content in the selected snapshot are not infected may be made. Based on determining which content in the selected snapshot is not infected, at least one of the non-infected content may be recovered.

First claim

What is claimed is:

1. A method, comprising:
displaying a graphical user interface showing:
at least a portion of respective snapshot chains for respective computing objects of a plurality of computing objects, wherein the respective snapshot chains are represented as one or more individual snapshots, wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, and wherein a first computing object of the plurality of computing objects is a first virtual machine, a first file system, a first database, or a first network attached storage system, and a second computing object of the plurality of computing objects is a second virtual machine, a second file system, a second database, or a second network attached storage system, and
across the respective snapshot chains, a cut line delineating infected snapshots from non-infected snapshots, wherein snapshots above the cut line are restricted from being recovered;

receiving a selection, from a user, of an infected snapshot in a snapshot chain of the respective snapshot chains associated with a computing object of the respective computing objects, wherein the infected snapshot is more recent than a most recent non-infected snapshot identified in the snapshot chain and is positioned above the cut line;
mounting, in response to the selection, the selected infected snapshot;
determining, based at least in part on mounting the selected infected snapshot, which content in the selected infected snapshot are not infected;
receiving, based at least in part on the selection, a command to recover, for the respective computing objects, non-infected data; and
recovering, in response to the command, for the respective computing objects, a non-infected snapshot from the respective snapshot chains in accordance with the cut line and at least one of the non-infected content in the selected infected snapshot.

2. The method of claim 1 , further comprising:
identifying a most recent snapshot in the respective snapshot chains that is not infected by malware, wherein the identifying comprises mounting snapshots in the respective snapshot chains in reverse chronological order and determining whether the mounted snapshots are infected by malware.

3. The method of claim 2 , wherein mounting the snapshots and determining whether the mounted snapshots are infected is repeated until at least one non-infected snapshot in the respective snapshot chains is identified.

4. The method of claim 2 , wherein mounting the snapshots and determining whether the mounted snapshots are infected is repeated past at least one non-infected snapshot in the respective snapshot chains being identified.

5. The method of claim 2 , further comprising:
repeating the identifying for all computing objects in a system.

6. The method of claim 2 , wherein determining whether the mounted snapshots are infected comprises:
applying YARA rules and hash matching to the mounted snapshots.

7. The method of claim 2 , wherein mounting the snapshots comprises mounting the snapshots in a sandboxed virtual machine.

8. The method of claim 2 , further comprising:
hydrating data in a mounted snapshot before determining whether the mounted snapshots are infected.

9. An apparatus, comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the apparatus to:
display a graphical user interface showing:
at least a portion of respective snapshot chains for respective computing objects of a plurality of computing objects, wherein the respective snapshot chains are represented as one or more individual snapshots, wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, and wherein a first computing object of the plurality of computing objects is a first virtual machine, a first file system, a database, or a first network attached storage system, and a second computing object of the plurality of computing objects is a second virtual machine, a second file system, a second database, or a second network attached storage system, and
across the respective snapshot chains, a cut line delineating infected snapshots from non-infected snapshots, wherein snapshots above the cut line are restricted from being recovered;

receive a selection, from a user, of an infected snapshot in a snapshot chain of the respective snapshot chains associated with a computing object of the respective computing objects, wherein the infected snapshot is more recent than a most recent non-infected snapshot identified in the snapshot chain and is positioned above the cut line;
mount, in response to the selection, the selected infected snapshot;
determine, based at least in part on mounting the selected infected snapshot, which content in the selected infected snapshot are not infected;
receive, based at least in part on the selection, a command to recover, for the respective computing objects, non-infected data; and
recover, in response to the command, for the respective computing objects, anon-infected snapshot from the respective snapshot chains in accordance with the cut line and at least one of the non-infected content in the selected infected snapshot.

10. The apparatus of claim 9 , wherein the instructions are further executable by the processor to cause the apparatus to:
identify a most recent snapshot in the respective snapshot chains that is not infected by malware, wherein, to identify the most recent snapshot, the instructions are further executable by the processor to cause the apparatus to:
mount snapshots in the respective snapshot chains in reverse chronological order and determine whether the mounted snapshots are infected by malware.

11. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
repeat mounting the snapshots and determining whether the mounted snapshots are infected until at least one non-infected snapshot in the respective snapshot chains is identified.

12. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
repeat mounting the snapshots and determining whether the mounted snapshots are infected past at least one non-infected snapshot in the respective snapshot chains being identified.

13. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
repeat the identifying for all computing objects in a system.

14. The apparatus of claim 10 , wherein, to determine whether the mounted snapshots are infected, the instructions are further executable by the processor to cause the apparatus to:
apply YARA rules and hash matching to the mounted snapshots.

15. The apparatus of claim 10 , wherein, to mount the snapshots, the instructions are further executable by the processor to cause the apparatus to mount the snapshots in a sandboxed virtual machine.

16. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
hydrate data in a mounted snapshot before determining whether the mounted snapshots are infected.

17. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
quarantine snapshots determined to be infected so that the quarantined snapshots are restricted from recovery.

18. A non-transitory, computer-readable medium storing code comprising instructions executable by a processor o

Assignees

• Rubrik Inc

Inventors

• Gee Adam
• Chandra Surendar
• Johnston Gregory Robert
• Sang Ishaan

Classifications

• G06F11/1435

  using file system or storage system metadata · CPC title

• G06F16/156

  Query results presentation · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F11/1469

  Backup restoration techniques · CPC title