Abstract: Providing content-based protection and process control to data objects in a multi-network system, by scanning content data to identify metadata associated with data objects to be protected by a defined protection policy. The content data is stored in storage devices comprising network attached storage (NAS), object storage, local storage, or cloud networks, and where the storage devices are deployed in different networks including core networks, edge networks, and cloud networks. The gathered metadata is stored in a catalog, and a user entered query is executed against the catalog to generate a dataset. The defined protection policy is then applied to the dataset to operate on the corresponding data objects referenced by the dataset as a single unit based on data content rather than data location in a file directory or physical location within the multi-network system.

Abstract: One example method includes defining an airgap control policy that specifies a threshold data value, generating a value for a set of data, determining whether the value that has been generated for the data meets or exceeds the threshold data value, and opening the air gap when the value that has been generated for the data meets or exceeds the threshold data value. The airgap is closed automatically when the value that has been generated for the data meets or exceeds the threshold data value.

Abstract: Enforcing a legal hold procedure in a system by scanning multiple data sources to identify data objects for processing as a unitary group with respect to common access and control processes of the legal hold to preserve the data for a defined period of time and protected against modification and unauthorized access. The metadata is stored in a static dataset that defines a single data access unit for the referenced data. A user query regarding a referenced data object is processed, and accesses the data through the dataset as a single unit based on data content rather than data location in a file directory of the system. The data may be sensitive data and the legal hold procedure may be implemented as court rules in accordance with Federal Rules of Civil Procedure.

Abstract: Classifying data objects for the content-based protection and process control in a system and modifying a classification based on evolving data. Data objects stored in the system are scanned to identify data objects to be processed similarly with respect to data protection or access control. A dataset comprising metadata for corresponding data objects is generated, and a classifier labels the dataset with a classifier tag to indicate an ownership group. Data objects that belong to the dataset are similarly tagged with the classifier so that the same operations are performed on this data regardless of location. A monitor tracks changes in the dataset based system evolution to determine a change in the classifier for the dataset based on the change. A classifier behavior tag is appended to the dataset specify an operation of the classifier to accommodate the tracked change.

Abstract: Managing versioning of data objects for a project revised from a first version to a revised version by producing a dataset representing the data objects as a group by scanning the data objects to identify metadata of the grouped data to be processed similarly within a current version of the lifecycle, and storing the identified metadata in the dataset. Data object changed from the first version to the revised version are identified, and the corresponding metadata for changed data objects in the dataset is updated. A version control operation is then performed on the dataset to update all data objects referenced by the dataset from the first version to the revised version. A commit-map and commit-tree are stored in a repository, and version control operations including commit, checkout, merge, branch and merge-branch are performed on the dataset snapshot.

Abstract: Providing content-based sensitivity classification to content data in a data processing system, by defining sensitivity designations for data objects stored in the system, and creating datasets by grouping metadata for data objects that are intended to classified with a same sensitivity designation, wherein each dataset spans multiple storage devices of different storage types, and wherein each dataset defines a single data sensitivity unit for the data objects referenced by a respective dataset. A sensitivity classifier component tags each dataset with a sensitivity tag to specify a protection or control operation on the data objects referenced by the respective dataset, and a processing component then processes data objects for each tagged dataset in accordance with the specified protection or control operation.

Abstract: Providing content based data protection for data stored in a large-scale data storage system by creating a dataset by grouping metadata for unstructured data objects that are grouped together by one or more filters. The dataset can span multiple storage devices of different types, so that it defines a single data protection unit for the corresponding content data. A user initiated query input through a search engine interface generates the one or more filters, and a protection policy is defined that protects the dataset as the single unit based on data content rather than data location. Datasets are stored in a catalog, and are generated by running queries on the catalog, where a query comprises metadata selectors as tags applied to the catalog, where the tags define at least one of a file type, name, location, creation time, or file characteristic.

Abstract: Performing charge/showback operations in a large-scale data system by scanning multiple data sources to identify data objects for processing as a unitary group with respect to common characteristics that have an impact on finances within the system. Metadata of the identified data objects are stored in a dynamic dataset that defines a single data access unit for the referenced data objects. The system processes a user query regarding cost allocations, cost forecasts, and resource usage of respective groups within an organization. The query initiates a charge-back or show-back operation that allocates costs associated with each respective usage of resources by a department or cost center, and accesses the referenced data objects through the dataset as a single unit based on data content rather than data location in a file directory of the system.

Abstract: Embodiments applying data protection and control policies using content-based datasets by scanning data objects stored in the system to determine grouped data that is processed similarly with respect to data protection and access control operations defined by a policy. A dataset is produced comprising metadata the scanned data objects of the grouped data. The actions performed on the dataset will affect only the corresponding data objects referenced by the metadata. A policy attribute derivation (PAD) process determines a change in the policy affecting a subset of data objects of the dataset and dictating changed data protection and access control operations applied to this subset, and tags the change in the policy as a PAD tag to the dataset to affect the application of the changed data protection and access control operations only to the subset and not any remaining data objects of the dataset.

Abstract: Managing a lifecycle of data by identifying data objects that are subject to same control rules in each stage of the lifecycle as grouped data, where the control rules allow only authorized access to or authorized operations on the grouped data based on a current stage of the lifecycle. A dataset is generated for the grouped data by identifying metadata of the grouped data to be processed similarly within the lifecycle, and storing the metadata in the dataset. The control rules associated with the grouped data as stage tags for the dataset. Actions performed on the data referenced by the dataset are monitored to ensure that the monitored actions comply with control rules using the stage tags of the dataset.

Abstract: One example method includes receiving, at an IO journal, a new entry that identifies a respective disk location L, and data X written at that disk location L, and determining whether a location specified in an oldest entry of the IO journal is specified in any other entries in the IO journal. When the location specified in the oldest entry is not specified in any other entries in the IO journal, adding the new entry to the IO journal, and augmenting the new entry with undo data. Or, when the location specified in the oldest entry is specified in at least one other entry in the IO journal, setting data specified in the oldest entry as undo data for the next entry that identifies that location, and adding the new entry to the IO journal, and deleting the oldest entry from the IO journal.

Abstract: One example method includes performing a filtering process that identifies one or more candidate hosts for scheduling of a pod, wherein the candidacy of a host is determined based in part upon an association rule, generating an overall host score for each of the candidate hosts, and scheduling the pod to one of the candidate hosts based on the overall host score of that candidate host. A host risk score and/or pod risk score may be used in the generating of the overall host score.

Abstract: A method includes searching a group of PITs, identifying one of the PITs as having an indicator of an occurrence of an event involving data associated with the identified PIT, restoring the data, running a production system copy using the data, and while the production system copy is running, taking increasingly granular backups of the data until the event is located. The event may be a corruption of the data, or other problem.

Abstract: Disk drive reallocation or replacement is disclosed. When performing a data protection operation, a health score is determined for each of the disk drives associated with the data protection operation. Replacement is recommended for each of the disk drives with an unfavorable health score. The recommendation may also identify a drive class based in part on the write or wear pattern. This allows unhealthy drives to be replaced prior to performing the data protection operation.

Abstract: One method includes receiving a request to restore data to a particular point in time, scanning a snapshot that corresponds to the point in time, based on the scanning, identifying any invalid data segments pointed to by the snapshot, for each of the invalid data segments, identifying a most recent, valid, version of that segment, and based on the request, restoring a set of valid data segments. In this method, no invalid segments are restored.

Abstract: Redistributing disks based on disk wear patterns is disclosed. The wear patterns of disk drives in a storage system are learned or determined. When a restore operation is performed, the volumes to disk drive mappings are changed to balance the overall wear pattern of the storage system. This insures that, after the restore operation, disks that had comparatively lower wear levels are used more heavily while disks that had comparatively higher wear levels are used less heavily.

Abstract: One example method includes receiving, at a remote site from a production site, copies of production site assets, storing, at the remote site, the copies of the production site assets, using, at the remote site, the copies of the production site assets to restore a temporary production site, running the temporary production site at the remote site, and restoring, from the remote site to the production site, the copies of the production site assets.

Abstract: A forensic kit with a granular infected backup. A forensic engine may evaluate a production system that is infected with malware or other corruption and generate a forensic kit. The forensic kit may include copies of components of the production system that are infected or that are sufficiently related to infected components. The forensic kit may be provided to investigators.

Abstract: A method includes accessing a group that comprises a group of PITs, replaying the PITs according to respective times at which the snapshots were taken, analyzing the PITs as they are being replayed, and based on the analyzing, identifying an event that has occurred within a time frame spanned collectively by the PITs. Replaying the PITs includes presenting the PITs, in order from oldest to newest, as a continuous stream of events.

Abstract: Opportunistically transmitting backups through a time-limited air gap. A data protection system may predict rates of changes for one or more applications. The predicted rate of change allows a size of corresponding backups to be estimated. If there is time during which an air gap is available (closed), at least of the backups is selected and opportunistically transmitted to a vault through the air gap.