Abstract: A client computing device includes an entropy driver and a volume driver for protecting the client computing device against potential ransomware. The entropy driver is configured to determine one or more entropy values for a file in response to a determination that the file has been modified or changed. The determined entropy value may then be compared with a known entropy value for a filetype of the changed or modified file. Where the known entropy value and the determined entropy value differ, the volume driver may engage one or more protection operations to secure the client computing device from further corruption and/or modifications by potential ransomware and/or malware. The protection operations may include revoking and/or restricting one or more permissions on one or more storage volumes of the client computing device and backing up one or more files of the client computing device to secondary storage.

Abstract: The present inventors devised a holistic approach for protecting serverless applications in single-cloud, multi-zone, multi-cloud, and/or non-cloud data center computing environments. An illustrative data storage management system discovers application assets, relationships, and interoperability dependencies and creates an “application entity” that references the various assets. Protection preferences apply to the application entity as a whole. An orchestration function in the system coordinates storage management operations (e.g., backup, replication, live synchronization, etc.) in a suitable order of operations gleaned from asset dependencies, if any. A set of copies of the application's discovered assets are generated in coordinated fashion and represent a point-in-time copy of the application. The point-in-time copy can be restored and/or migrated to other computing services by the data storage management system.

Abstract: Techniques are disclosed relating to providing protection groups and rapid determination of expired objects and associated storage resources in a cloud-based backup storage context. In various embodiments, the disclosed techniques include generating, by a computing system, incremental backup data for a backup based on protection group information, including a set of cloud-based key-value data store buckets, filter information, and policy information. Disclosed techniques also include rapid determination of expired objects and associated storage resources. Disclosed techniques may advantageously provide a centralized view across buckets, accounts, and regions and allow users to target specific subsets of their data stores for backup, which may improve performance and reduce backup storage costs, relative to traditional techniques.

Abstract: A system for performing continuous transaction log backups with minimal resource usage of the client computing devices that are processing the transactions is disclosed. The system detects at least one input/output (I/O) activity at a client computing device. The I/O activity can be associated with at least one database operation performed via the client computing device. The system then executes one or more native commands to backup transactions log data associated with the detected I/O activity to a virtualized location. Backing-up the transactions log data comprises dynamically identifying a mount path location corresponding to the virtualized location, and transferring the transactions log data to the dynamically identified mount path using the one or more native commands. The system can then perform data processing operations (for example, data chunking and deduplicating) on the transactions log data after it is received at the dynamically identified mount path location.

Abstract: An illustrative data storage management system comprises a management database that stores administrative preferences and system configurations, as well as results and/or statistics of completed secondary storage operations, i.e., information needed by the system to protect customers' data and to track and recover the protected data, including secondary copies such as backup copies, archive copies, etc. The disclosed data storage management system is configured to protect its own system data subject to a very aggressive (short) Recovery Point Objective (RPO), by using an innovative infrastructure that enables the system's storage manager to fail over to any number of other failover destination storage managers, each one comprising a destination management database. An illustrative database granularly tracks whether each and every transaction log file has been successfully applied to each and every destination management database to synchronize with the source management database.

Abstract: An illustrative data storage management system protects data in a replicated multi-node system (“cluster”). The illustrative system creates a new administrative entity (“pseudo-client”) that represents the cluster within the system. The system intelligently performs as an adaptive “set it and forget it” system. Preferences for the pseudo-client, including alternate rules that cover various contingencies in the cluster, need not be reset as the cluster undergoes node failures and/or role changes over time. Rather, the disclosed system adapts, on each successive secondary copy job, to the current configuration of the cluster without requiring a system administrator to provide further input or analysis. This approach ensures that jobs can begin promptly as scheduled or on demand. Component selection is based at least in part on geography/zone and/or network topology considerations, which improves the likelihood of job completion and success, and RPO/RTO service levels are more likely to be met.

Abstract: Described herein are techniques for automating media agent state management. For example, if a media agent is running poorly, then the media agent can be disabled and an alternate media agent can perform secondary copy job operations in place of the poorly running media agent. To determine whether a media agent is running poorly, a storage manager can determine whether the media agent has an anomalous number of failed jobs, pending jobs, and/or long running jobs and/or can determine whether the amount of resources used by the media agent is high or is increasing constantly, at a constant rate, or at a near constant rate.

Abstract: The present inventors devised techniques and technologies that streamline the protection of data stored on shared file storage e.g., on file servers, network-attached storage (NAS), share drives, network shares, etc., in a data storage management system. Some embodiments feature a proxy-less backup configuration in which backup services hosts are assigned to perform a secondary copy job, at job runtime, based on host attributes relative to the data source. Some embodiments are configured to, at job runtime, automatically resolve data paths to the source data, and automatically mount the data paths, rather than requiring data paths to be expressly pre-administered on all possible candidate backup machines. Some embodiments automatically protect data from shared file storage that was not expressly given a backup plan (“undefined” data) by applying default preferences for protecting undefined data.

Abstract: Systems and processes disclosed herein perform an automatic remediation process. The automatic remediation process may be a log-based remediation process. Systems disclosed herein may obtain log files from an information management system and determine the occurrence of errors at the information management system based on error codes included in the logs. Further, the systems may access a knowledgebase to determine whether solutions for the errors have been previously generated. The solutions may include patches or hotfixes that can be applied to the information management system without removing user-access or stopping execution of the information management system. The systems may automatically update the information management system to address the errors. Alternatively, or in addition, the systems may alert a user, such as an administrator, of the existence of a solution to the error, and whether the solution may be applied without interrupting service or access to the information management system.

Abstract: Snapshot-based disaster recovery (DR) orchestration systems and methods for virtual machine (VM) failover and failback do not require that VMs or their corresponding datastores be actively operating at the DR site before a DR orchestration job is initiated, i.e., before failover. An illustrative data storage management system deploys proprietary components at source data center(s) and at DR site(s). The proprietary components (e.g., storage manager, data agents, media agents, backup nodes, etc.) interoperate with each other and with the source and DR components to ensure that VMs will successfully failover and/or failback. DR orchestration jobs are suitable for testing VM failover scenarios (“clone testing”), for conducting planned VM failovers, and for unplanned VM failovers. DR orchestration jobs also handle failback and integration of DR-generated data into the failback site, including restoring VMs that never failed over to fully re-populate the source/failback site.

Abstract: Artificial intelligence (AI), preferably a generative AI (Gen-AI) technology, powers an illustrative “dynamic API service” that interoperates with or within a data resiliency system that has well-defined API(s) for communicating with it. The illustrative dynamic API service is configured to recognize incoming information from an originator, which may arrive unstructured or in a format that is incompatible with the API(s). The illustrative dynamic API service interprets the incoming information, identifies pertinent components in the data resiliency system, issues API call(s) to the system components, and organizes response(s) to the originator. In some embodiments, the illustrative dynamic API service uses or incorporates Gen-AI technology to perform some of the disclosed features and functions. The Gen-AI training corpus preferably includes information extracted from the data resiliency system itself. The originator systems also may employ Gen-AI, and some embodiments function in an AI-to-AI configuration.

Abstract: An illustrative “dynamic API service” interoperates with a data storage management system that has well-defined API(s). The illustrative dynamic API service is configured to recognize information received from an originator, but the information arrives unstructured or is otherwise incompatible with the API(s). The illustrative dynamic API service interprets the incoming information, identifies pertinent system components in the system, issues API call(s) to the system components, and organizes appropriate response(s). Advantageously, the illustrative dynamic API service is configured to recognize information that is relevant to the data storage management system, and to ignore irrelevant information. Relevant incoming information may include malware alerts, information requests, backup prompts, restore requests, metadata queries, configuration prompts or queries, etc., without limitation.

Abstract: The disclosed approach works without the individualized credentials of failed machines when setting up recovery VMs in a cloud computing environment. Each recovery VMs is customized to properly correspond to the system state of its failed counterpart. An illustrative data storage management system recovers backup data and system states collected from the counterpart computing devices, custom-configures recovery VMs in the cloud computing environment, and injects the desired drivers into each recovery VM during an enhanced bare-metal restore process. The enhanced bare-metal restore process works without the failed computer's credentials. The system also restores the backed up data to recovery volumes attached to the recovery VMs. The present approach is both scalable and secure.

Abstract: A system and method for performing an image level restore of data is described. In some examples, the system receives a request to restore a file and transmits the request to an intermediate component. The intermediate component may then retrieve a directory file from an image of a secondary copy of a data set, identify a location of the file from the directory file, and provide the location to the requestor.

Abstract: Snapshot-based disaster recovery (DR) orchestration systems and methods for virtual machine (VM) failover and failback do not require that VMs or their corresponding datastores be actively operating at the DR site before a DR orchestration job is initiated, i.e., before failover. An illustrative data storage management system deploys proprietary components at source data center(s) and at DR site(s). The proprietary components (e.g., storage manager, data agents, media agents, backup nodes, etc.) interoperate with each other and with the source and DR components to ensure that VMs will successfully failover and/or failback. DR orchestration jobs are suitable for testing VM failover scenarios (“clone testing”), for conducting planned VM failovers, and for unplanned VM failovers. DR orchestration jobs also handle failback and integration of DR-generated data into the failback site, including restoring VMs that never failed over to fully re-populate the source/failback site.

Abstract: The disclosed cyber threat detection and deception system leverages metadata information collected by the data storage management system. Using the metadata collected by the data storage management system, the cyber threat detection and deception system analyzes that metadata to detect any anomalies. Once suspicious or abnormal behavior is detected in an asset, the cyber threat detection and deception system creates and deploys a cyber deception plan for that asset. The cyber deception plan is implemented by way of deploying sensors or emulation traps in any number of cyber-threat appliances within the data network. Lures or tokens are configured and deployed on the suspected assets themselves to redirect attackers to the emulation traps.

Abstract: A data storage environment can include one or more virtual machines instantiated on a host computing device. Based on physical location data of the one or more virtual machines received from the host computing device, a storage manager can control the performance of a secondary copy operation on one or more storage units that store virtual machine data associated with the one or more virtual machines and/or the performance of a secondary copy operation on the one or more virtual machines.

Abstract: An illustrative data storage management system enables a Tenant to retain control over criteria for protecting the Tenant's data, and hides details of the Service Provider's infrastructure. The Service Provider may have many data centers, each one represented within the system by a Resource Pool with attributes that reflect the infrastructure resources of the corresponding data center. A system analysis, which is triggered by the Tenant's choices for data protection, keys in on a suitable Resource Pool. The system analysis identifies suitable system resources within the Resource Pool and associates them to the data source. Subsequent data protection jobs invoke proper system components based on the associations created by the system analysis. In some embodiments, the system will invoke infrastructure resources created on demand when a data protection job is initiated rather than being pre-existing resources.

Abstract: Systems described herein may dynamically add one or more proxy agents to a cloud data storage system to process an information management job, such as restore job. Upon completion of the job or at some other appropriate interval, the system can power down and decommission the proxy agents and/or the virtual machines on which the proxies reside according to a cleanup schedule (e.g., at hourly or minute intervals). The system takes into account currently existing proxies or virtual machines when processing a restore request to determine the need for new proxies to service the restore request. In this manner the system can save costs and computing resources through efficient virtual machine deployment and retirement.

Abstract: Protecting configuration data in a clustered container system may include, in some embodiments, protecting an ETCD data store in a Kubernetes cluster. A data storage management system addresses the unique needs of protecting an ETCD data store of a target Kubernetes cluster, as well as protecting non-ETCD data payloads. The illustrative data storage management system defines ETCD as a unique kind of workload. ETCD protection is integrated within the data storage management system, which automatically creates data structures and resources within the system for, and provides special-purpose features to protect, ETCD contents and associated security certificates. One of the special-purpose features deploys a temporary data transfer agent within the target Kubernetes cluster to safeguard an ETCD snapshot and transmit its contents, along with the security certificates, to a backup infrastructure that operates outside of the target Kubernetes cluster.