Abstract: A method, system, computer system, and computer-readable medium to search contents of a large number of files. Data are read sequentially from a storage device without using a file system. Physical location information for the files is obtained and used to construct files from the data read. Such physical location information can be obtained, for example, by accessing a file system mapping catalog without causing the file system to read the files. Accessing the mapping catalog can be performed quickly because only metadata is read from the mapping catalog. The constructed files can then be searched for content without the overhead of the file system. Content such as virus signatures and keywords can therefore be discovered much more quickly. Furthermore, because the device is read sequentially, storage locations belonging to more than one file are read only once, further improving the performance of the content search.

Abstract: The present invention enables a large number of files to be processed for evidence of malicious content, independently of the file system that maintains the files. The processed files can be obtained from live data or a point-in-time copy (e.g., a snapshot) of the data, based on mapping information that maps the files to the physical storage device. In one embodiment, a method involves accessing mapping information corresponding to a set of data. The mapping information maps at least a portion of a file to a physical storage location. The portion of the file can be read from the physical storage location using the mapping information, without accessing a file system. The portion of the file can then be analyzed for evidence of malicious content.

Abstract: A method, system, computer system, and computer-readable medium that enable a secondary host that is not the file system host to create a backup of a clone file set that shares at least one data block on a storage device with an active file set. Start and end locations are identified for a set of contiguous storage locations (referred to as a “chunk”) on the storage device. Physical location information is obtained for each portion of a file contained in the chunk. The start and end locations and physical location information for portions of files contained in the chunk are provided to the secondary host, which sequentially reads data from the set of contiguous storage locations and constructs a copy of the file(s) making up the clone file set. The file(s) are written by the secondary host to a storage device to create a backup of the clone file set.