Investigation procedures for virtual machines

Patent metadata

Field	Value
Publication number	US-12436849-B2
Application number	US-202217973456-A
Country	US
Kind code	B2
Filing date	Oct 25, 2022
Priority date	Oct 25, 2022
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

A data management system (DMS) may facilitate an investigation procedure for a set of one or more virtual machines (VMs) hosted in a first environment. The DMS may receive an indication of a selection of one or more sets of VMs and corresponding snapshots for the investigation procedure. The corresponding snapshots may be stored in a second environment, and each snapshot may be associated with a version of a respective set of VMs. The DMS may mount the one or more sets of VMs to one or more testing environments different than the first and second environments. The mounting may use the snapshots stored in the second environment to provide the testing environments with query access to respective versions of the sets of VMs hosted in the first environment. The DMS may perform query operations between the first environment and the testing environments as part of the investigation procedure.

First claim

What is claimed is:

1. A method, comprising:
receiving a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;
receiving a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;
mounting, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and
performing one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.

2. The method of claim 1 , wherein performing the one or more querying operations comprises:
providing the plurality of testing environments access to the respective versions of the plurality of sets of virtual machines to facilitate the investigation procedure for the plurality of sets of virtual machines.

3. The method of claim 1 , further comprising:
receiving a third indication of a set of virtual machines selected for recovery from among the plurality of sets of virtual machines and a corresponding snapshot selected for the recovery from among the corresponding plurality of snapshots, wherein the set of virtual machines and the corresponding snapshot are selected for the recovery based at least in part on the investigation procedure for the plurality of sets of virtual machines; and
recovering, in response to the third indication, a respective version of the set of virtual machines to a production environment based at least in part on the corresponding snapshot stored in the second environment.

4. The method of claim 1 , further comprising:
receiving parameters for the plurality of testing environments; and
identifying the plurality of testing environments in accordance with the parameters, wherein mounting the plurality of sets of virtual machines to the plurality of testing environments is based at least in part on identifying the plurality of testing environments.

5. The method of claim 4 , further comprising:
retrieving metadata associated with the plurality of testing environments; and
validating the parameters for the plurality of testing environments based at least in part on the metadata.

6. The method of claim 1 , further comprising:
generating a recovery plan that comprises the selection of the plurality of sets of virtual machines, the selection of the corresponding plurality of snapshots, and one or more parameters associated with the plurality of testing environments, the plurality of sets of virtual machines, the corresponding plurality of snapshots, or any combination thereof; and
storing the recovery plan for subsequent investigation procedures.

7. The method of claim 6 , further comprising:
receiving a third indication to initiate a second investigation procedure; and
performing the second investigation procedure in accordance with the stored recovery plan.

8. The method of claim 1 , further comprising:
receiving, via the second indication, a set of computing resources, network resources, or both, wherein the mounting comprises using the set of computing resources, network resources, or both to mount the plurality of virtual machines to the plurality of testing environments.

9. The method of claim 1 , wherein the plurality of sets of virtual machines and the corresponding plurality of snapshots are selected in response to a ransomware attack on the plurality of sets of virtual machines.

10. The method of claim 1 , wherein the plurality of sets of virtual machines and the corresponding plurality of snapshots are selected randomly.

11. The method of claim 1 , wherein the plurality of sets of virtual machines comprise the same virtual machines, and the corresponding plurality of snapshots are associated with different point-in-time versions of the same virtual machines.

12. The method of claim 1 , wherein the plurality of testing environments comprise sandboxed environments.

13. An apparatus, comprising:
at least one processor;
memory coupled with the at least one processor; and
instructions stored in the memory and executable by the at least one processor to cause the apparatus to:
receive a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;
receive a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;
mount, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and
perform one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.

14. The apparatus of claim 13 , wherein the instructions to perform the one or more querying operations are executable by the at least one processor to cause the apparatus to:
provide the plurality of testing environments access to the respective versions of the plurality of sets of virtual machines to facilitate the investigation procedure for the plurality of sets of virtual machines.

15. The apparatus of claim 13 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:
receive a third indication of a set of virtual machines selected for recovery from among the plurality of sets of virtual machines and a corresponding snapshot selected for the recovery from among the corresponding plurality of snapshots, wherein the set of virtual machines and the corresponding snapshot are selected for the recovery based at least in part on the investigation procedure for the plurality of sets of virtual machines; and
recover, in response to the third indication, a respective version of the set of virtual machines to a production environment based at least in part on the corresponding snapshot stored in the second environment.

16. The apparatus of claim 13 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:
receive parameters for the plurality of testing environments; and
identify the plurality of testing environments in accordance with the parameters, wherein mounting the plurality of sets of virtual machines to the plurality of te

Assignees

• Rubrik Inc

Inventors

• Thomas Anita
• Cheng Wenchun
• Chen Shaomin
• Zhang Junchao
• Zou Hongbo
• Wang Scott
• Kumar Abhishek

Classifications

• G06F11/1448

  Management of the data involved in backup or backup restore · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• G06F11/0712

  in a virtual computing platform, e.g. logically partitioned systems · CPC title

• G06F11/0793

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title