Records declaration filesystem monitoring

Patent metadata

Field	Value
Publication number	US-9959283-B2
Application number	US-201313886057-A
Country	US
Kind code	B2
Filing date	May 2, 2013
Priority date	Jan 6, 2011
Publication date	May 1, 2018
Grant date	May 1, 2018

Abstract

Techniques for managing records on a filesystem to enforce a record disposition protocol. Embodiments identify records on the filesystem using one or more record definitions. Each record definition may contain a conditional statement which, if satisfied by a particular file on the filesystem, indicates the particular file as a record. Embodiments may then monitor file activity for each of the identified records and upon detecting the file activity, may enforce the record disposition protocol for the record. Such enforcement may include preventing the file activity, and may further include logging information related to the file activity.

First claim

What is claimed is:

1. A computer-implemented method to enforce a record disposition protocol on a computer system even when the computer system is offline, the computer-implemented method comprising:
retrieving, from a record manager and over a data communications network, updates for a plurality of record definitions;
applying the retrieved updates to the plurality of record definitions, such that once the updates are applied the plurality of record definitions is identical to a corresponding copy maintained by the record manager;
retrieving a record definition of the plurality of record definitions, the record definition specifying one or more conditional expressions for use in identifying files to be classified as electronic records to be retained;
for each of a plurality of files from a plurality of filesystems, responsive to determining that a respective plurality of file attributes for the respective file satisfies the one or more conditional expressions in the record definition, classifying the respective file as an electronic record;
monitoring, by a respective filesystem filter driver of a plurality of filesystem filter drivers, filesystem operations in each of the plurality of filesystems from one or more applications to an operating system filesystem driver for the respective filesystem, wherein the respective filesystem filter driver is executing by operation of one or more computer processors of the computer system, wherein the operating system filesystem driver comprises a component of an operating system executing on the computer system;
responsive to determining that the monitored filesystem operations include a first filesystem operation for a first file that has been classified as an electronic record within a first filesystem of the plurality of filesystems, selecting, by the filesystem filter driver corresponding to the first filesystem and without requiring user action, the record disposition protocol, from a plurality of record disposition protocols, that corresponds to the record definition, the record disposition protocol specifying a first set of actions permitted on the first file and a second set of actions that are logged; and
upon determining that the first filesystem operation violates the record disposition protocol, preventing, by the filesystem filter driver, execution of the first filesystem operation, by filtering the first filesystem operation such that the operating system filesystem driver for the first filesystem does not receive the first filesystem operation for execution;
wherein upon determining the first filesystem operation does not violate the record disposition protocol: (i) the first filesystem operation is transmitted to the operating system filesystem driver for the first filesystem for execution against the first filesystem, and (ii) a log entry describing the first filesystem operation is created;
wherein the filesystem filter driver and the operating system filesystem driver are distinct drivers operatively connected and configured to operate in conjunction to enforce the record disposition protocol on the computer system: (i) even when the computer system is offline and (ii) in a manner that even administrative users of the computer system cannot circumvent.

2. The computer-implemented method of claim 1 , wherein the created log entry describes at least one of: (i) an instance of monitored activity, (ii) an electronic record associated with instance of the monitored activity, (iii) an indicator of a time when the instance of monitored activity occurred, (iv) a user identifier which identifies a user performing the instance of monitored activity, and (v) any modifications made to one of the electronic records as part of the monitored activity.

3. The computer-implemented method of claim 1 , further comprising:
transmitting the created log entry to the record manager for addition to a comprehensive store of log entries across the plurality of filesystems.

4. The computer-implemented method of claim 1 , further comprising:
transmitting, over the data communications network, a listing of the declared electronic records to the record manager for inclusion in a comprehensive listing of electronic records across the plurality of filesystems.

5. The computer-implemented method of claim 1 , wherein the filesystem filter driver prevents at least one of access, alteration and deletion of the files classified as electronic records, based on the selected record disposition protocol, even though the at least one of access, alteration and deletion of the files satisfies a filesystem permissions policy enforced by the operating system filesystem driver for the first filesystem.

6. The computer-implemented method of claim 1 , wherein the first filesystem is accessed by a filesystem sweeper to scan for newly created files not yet identified as an electronic record, wherein the filesystem sweeper is configured to use a set of record definitions retrieved from a drive map, including the record definition, in order to determine whether the newly created files are to be declared as electronic records, wherein declaring the newly created files as electronic records comprises storing, in the drive map, an indication that the newly created files are declared as electronic records.

7. The computer-implemented method of claim 6 , wherein the created log entry specifies each of: (i) an instance of monitored activity, (ii) an electronic record associated with instance of the monitored activity, (iii) an indicator of a time when the instance of monitored activity occurred, (iv) a user identifier which identifies a user performing the instance of monitored activity, and (v) any modifications made to one of the electronic records as part of the monitored activity.

8. The computer-implemented method of claim 7 , further comprising, by a filesystem monitor operatively connected to the filesystem filter driver:
transmitting the created log entry to the record manager for addition to a comprehensive store of log entries across the plurality of filesystems, wherein the comprehensive store of log entries is managed by the record manager.

9. The computer-implemented method of claim 8 , wherein the computer system being offline comprises the computer system being disconnected from the data communications network, wherein the retrieved updates are applied in the drive map by the filesystem monitor.

10. A computer-implemented method to enforce a record disposition protocol on a computer system even when the computer system is offline, the computer-implemented method comprising:
retrieving, from a record manager and over a data communications network, updates for a plurality of record definitions;
applying the retrieved updates to the plurality of record definitions, such that once the updates are applied the plurality of record definitions is identical to a corresponding copy maintained by the record manager;
retrieving a record definition of the plurality of record definitions, the record definition specifying one or more conditional expressions for use in identifying files to be classified as electronic records to be retained;
for each of a plurality of files from a plurality of filesystems, responsive to determining that a respective plurality of file attributes for the respective file satisfies the one or more conditional expressions in the record definition, classifying the respective file as an electronic record;
selecting, without requiring user action, a record disposition protocol, from a plurality of record disposition protocols, that corresponds to the record definition;
monitoring, by a respective filesystem filter driver of a plurality of filesystem filter drivers, filesystem operations

Assignees

• IBM

Inventors

• Loo Dennis

Classifications

• G06F17/00

  Digital computing or data processing equipment or methods, specially adapted for specific functions (information retrieval, database structures or file system structures therefor G06F16/00) · CPC title

• G06F15/16

  Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs {(coordinating program control therefor G06F9/52; in regulating and control system G05B)} · CPC title

• G06F16/1734 Primary

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title

• G06F16/16

  File or folder operations, e.g. details of user interfaces specifically adapted to file systems · CPC title

• G06F16/125

  characterised by the use of retention policies (retention policies for HSM systems G06F16/185) · CPC title