Abstract: The disclosed approach works without the individualized credentials of failed machines when setting up recovery VMs in a cloud computing environment. Each recovery VMs is customized to properly correspond to the system state of its failed counterpart. An illustrative data storage management system recovers backup data and system states collected from the counterpart computing devices, custom-configures recovery VMs in the cloud computing environment, and injects the desired drivers into each recovery VM during an enhanced bare-metal restore process. The enhanced bare-metal restore process works without the failed computer's credentials. The system also restores the backed up data to recovery volumes attached to the recovery VMs. The present approach is both scalable and secure.

Abstract: The disclosed data storage management system enables data owners to model the costs and attributes of archiving their data and to readily capture and implement one or more resultant archiving plans. Modeling enables data owners to make informed choices about cost profiles before data is actually archived. Archiving plans devised according to these choices are intended to save on data storage costs and provide a compliance-ready data archive in cloud storage repository(ies). Armed with archiving simulations supplied by the illustrative data storage management system, a data owner may control data placement to predict costs, free up primary storage, and move inactive data to less expensive archive storage. Preferably, the disclosed system is implemented as a software-as-a-service (SaaS) solution, and the accompanying archive storage is implemented as a cloud storage service, but the invention is not limited to SaaS or to cloud-based data archives.

Abstract: An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Abstract: After completion of a backup job, the illustrative system performs a threat analysis of the freshly generated backup copies. Each copy is restored at a secure storage area. The system scans the restored data using, preferably, a signature-based malware scanning engine. If the scan finds malware infection or some other unsafe condition, a tracking index is updated to indicate that the copy is unsafe, and the secondary copy is quarantined. The quarantine prevents the copy from being restored to the production environment, and from acting as a source for other copies. The system iterates, scanning preceding versions of the copy, updating the index, and quarantining, until a clean or uninfected copy is found. The clean copy is so indexed. Responsive to a restore request, the illustrative system automatically restores the clean copy and skips over the infected copy/copies, preferably without asking the requesting user for input or approval.

Abstract: A distributed data storage system using erasure coding (EC) provides advantages of EC data storage while retaining high resiliency for EC data storage architectures having fewer data storage nodes than the number of EC data-plus-parity fragments. An illustrative embodiment is a three-node data storage system with EC 4+2. Incoming data is temporarily replicated to ameliorate the effects of certain storage node outages or fatal disk failures, so that read and write operations can continue from/to the storage system. The system is equipped to automatically heal failed EC write attempts in a manner transparent to users and/or applications: when all storage nodes are operational, the distributed data storage system automatically converts the temporarily replicated data to EC storage and reclaims storage space previously used by the temporarily replicated data. Individual hardware failures are healed through migration techniques that reconstruct and re-fragment data blocks according to the governing EC scheme.

Abstract: An improved information management system that implements a staging area or cache to temporarily store primary data in a native format before the primary data is converted into secondary copies in a secondary format is described herein. For example, the improved information management system can include various media agents that each include one or more high speed drives. When a client computing device provides primary data for conversion into secondary copies, the primary data can initially be stored in the native format in the high speed drive(s). If the client computing device then submits a request for the primary data, the media agent can simply retrieve the primary data from the high speed drive(s) and transmit the primary data to the client computing device. Because the primary data is already in the native format, no conversion operations are performed by the media agent, thereby reducing the restore delay.

Abstract: Systems and methods for providing and/or facilitating live browsing of granular mail or mailbox data, such as data stored within Exchange mailboxes, are described. For example, the systems and methods may provide mechanisms for browsing and/or restoring granular data (e.g., email data) from an Exchange database backup copy (or other secondary copy), without having to restore the entire database from the backup copy.

Abstract: An illustrative data storage management system comprises a management database that stores administrative preferences and system configurations, as well as results and/or statistics of completed secondary storage operations, i.e., information needed by the system to protect customers' data and to track and recover the protected data, including secondary copies such as backup copies, archive copies, etc. The disclosed data storage management system is configured to protect its own system data subject to a very aggressive (short) Recovery Point Objective (RPO), by using an innovative infrastructure that enables the system's storage manager to fail over to any number of other failover destination storage managers, each one comprising a destination management database. An illustrative database granularly tracks whether each and every transaction log file has been successfully applied to each and every destination management database to synchronize with the source management database.

Abstract: Systems and methods for creating local, or on-premises, secondary copies of data managed and/or stored in online repositories are described. In some embodiments, the systems and methods perform a single application programming interface (API) call to a web application level of an online repository to transfer a copy of the data stored in the online repository from the online repository to a local site of a local information management system. Via the local site, the systems and methods access the copy of the data at the site of the local information management system, generate a metadata manifest file that associates metadata files and data files within the copy of the data of the site of the local information management system, and transfer the data files and the metadata manifest file to a media agent for storage to a secondary storage device of the local information management system.

Abstract: A system and method of deployment of malware detection traps by at least one processor may include performing a first interrogation of a first Network Asset (NA) of a specific NA family; determining, based on the interrogation, a value of one or more first NA property data elements of the first NA; obtaining one or more second NA property data elements corresponding to the specific NA family; integrating the one or more first NA property data elements and the one or more second NA property data elements to generate a template data element, corresponding to the specific NA family; producing, from the template data element, a malware detection trap module; and deploying, on one or more computing devices of a computer network, one or more instantiations of the malware detection trap module as decoys of the first NA.

Abstract: Uploads of restored virtual machine (“VM”) data to cloud storage, e.g., VM restore-to-cloud operations, are performed without having to write whole restored virtual disk files to a proxy server before the virtual disk data begins uploading to cloud. Restored data blocks from a backup source are locally cached, staged for efficiency, and asynchronously uploaded to the cloud page-by-page without tapping mass storage resources on the proxy. Downloads of VM data from cloud storage, e.g., VM backup-from-cloud, are performed without having to download a virtual disk file in its entirety to the proxy server before the backup operation begins generating a backup copy. This speeds up “pulling” VM data from the cloud by pre-fetching and locally caching downloaded data blocks. The cached data blocks are processed for backup and stored page-by-page directly into a secondary copy of the cloud VM virtual-disk file without tapping mass storage resource at the proxy.

Abstract: Certain embodiments described herein relate to an improved disk usage growth prediction system. In some embodiments, one or more components in an information management system can determine usage status data of a given storage device, perform a validation check on the usage status data using multiple prediction models, compare validation results of the multiple prediction models to identify the best performing prediction model, generate a disk usage growth prediction using the identified prediction model, and adjust the available space of the storage device according to the disk usage growth prediction.

Abstract: An information management system includes a storage manager for managing backup and/or restore operations for one or more client computing devices. The storage manager may be in communication with a resource administrator of a computing resource cluster, wherein the resource administrator instantiates one or more computing pods using the computing resource cluster. The resource administrator may receive a request for computing resources from the storage manager and provision the computing pods based on the request. The resource administrator may then select a pre-configured container image from one or more pre-configured container images based on the computing resource request, wherein the pre-configured container image configures a computing pod to create secondary copies of primary data from a particular primary data source of the information management system.

Abstract: A data storage management system is enhanced to accommodate, and moreover to optimize, the storing and retention of deduplicated secondary copies at write-once read-many (WORM) enabled storage platforms. Enhancements include without limitation: user interface (UI) options to enable WORM functionality for secondary storage, whether used for deduplicated or non-deduplicated secondary copies; enhancements to secondary copy (e.g., deduplication copy, backup) operations; and pruning changes. The storage manager is generally responsible for managing the creation, tracking, and deletion of secondary copies, with and without deduplication. Media agents that store secondary copies to and prune them from the WORM-enabled storage platforms also are enhanced for communicating and interoperating with both bucket-level and object-level WORM-enabled storage platforms to implement the features disclosed herein.

Abstract: Recovery points can be used for replicating a virtual machine and reverting the virtual machine to a different state. A filter driver can monitor and capture input/output commands between a virtual machine and a virtual machine disk. The captured input/output commands can be used to create a recovery point. The recovery point can be associated with a bitmap that may be used to identify data blocks that have been modified between two versions of the virtual machine. Using this bitmap, a virtual machine may be reverted or restored to a different state by replacing modified data blocks and without replacing the entire virtual machine disk.

Abstract: Data protection resources are automatically scaled to the needs of data source(s) in an application orchestrator computing environment, such as a cluster in a Kubernetes deployment. The approach is adaptable to data sources in production clusters or application suites that are not application orchestrator deployments, such as a cloud-based database-as-a-service (DBaaS). A data storage management system protects cluster-based data with an elastic number of data protection resources (e.g., data agents, media agents), which are deployed on demand. The number of data protection resources deployed for a particular job are appropriate to the workload(s) at present and depend on a variety of scaling factors. In some embodiments, data protection resources are deployed within the same cluster as the data sources.

Abstract: The disclosed enhancements optimize the use of the live browse cache and pseudo-disk storage areas, improving metadata handling so that it can be used more effectively to speed up live browse and file indexing of backup copies in a data storage management system. The enhancements operate granularly to identify within each extent being backed up smaller sectors that comprise metadata. The disclosed approach pre-fetches the metadata of the backup copy before allowing the file scan of the file indexing and/or the live browse operation to proceed. The backup operation, the file indexing operation, and the live browse operation are enhanced to handle the more granular metadata sectors without changing the granularity of the full extents generated and stored in the backup.

Abstract: An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Abstract: An illustrative data storage management system relies on a specially configured proxy server to operate software containers on a proxy server, maintain resources needed by the software containers, and interwork with other system components. Illustratively, a catalog service on the proxy server maintains a software cache according to maintenance rules and also maintains an associated cache catalog. The software containers are generally managed and operated by an illustrative container manager also hosted by the proxy server. The illustrative software cache comprises contents needed by the software containers, such as pre-configured container templates, DBMS software components, lightervisors representing target operating systems, and storage management software for performing test and storage operations. The maintenance rules govern when cache contents should be purged and moved into offline archive copies.

Abstract: A distributed data storage system that employs erasure coding grows from fewer than data-plus-parity (D+P) storage service nodes to at least D+P nodes. The system detects an increase in the number of available storage service nodes, i.e., at least D+P; analyzes how storage for each virtual disk is distributed among storage containers in the existing (pre-growth) nodes; identifies containers that are co-hosted on the same node; and, on a node-by-node basis, migrates data fragments from a co-hosted storage container to a corresponding new container that is configured on another node. For each virtual disk in the illustrative system, the migration causes containers, including the erasure-coded data fragments they host, to be re-distributed so that the containers for a virtual disk are NOT doubled up or co-hosted on the same node. The disclosed computer-implemented process for re-distributing erasure-coded data fragments operates organically, without requiring the system to restart or reboot.