Abstract: A method, system, computer system, and computer-readable medium to search contents of a large number of files. Data are read sequentially from a storage device without using a file system. Physical location information for the files is obtained and used to construct files from the data read. Such physical location information can be obtained, for example, by accessing a file system mapping catalog without causing the file system to read the files. Accessing the mapping catalog can be performed quickly because only metadata is read from the mapping catalog. The constructed files can then be searched for content without the overhead of the file system. Content such as virus signatures and keywords can therefore be discovered much more quickly. Furthermore, because the device is read sequentially, storage locations belonging to more than one file are read only once, further improving the performance of the content search.

Abstract: The present invention enables a large number of files to be processed for evidence of malicious content, independently of the file system that maintains the files. The processed files can be obtained from live data or a point-in-time copy (e.g., a snapshot) of the data, based on mapping information that maps the files to the physical storage device. In one embodiment, a method involves accessing mapping information corresponding to a set of data. The mapping information maps at least a portion of a file to a physical storage location. The portion of the file can be read from the physical storage location using the mapping information, without accessing a file system. The portion of the file can then be analyzed for evidence of malicious content.