Abstract: A server manager for detecting ransomware includes a server interface to retrieve, from a storage device, a backup of a plurality of files stored by a client device. A ransomware detection module includes a statistical filter to generate a standard pattern of file activities of the client device for a time period. A statistical behavior analysis is performed on the backup of the plurality of files based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern. The statistical anomaly corresponds to an abnormal file activity. An entropy detector generates an entropy score for the portion of the backup. The entropy score represents a randomness of a distribution of bits in a block of a file in the portion of the backup. It is determined whether the backup includes the ransomware based on the generated entropy score.

Abstract: A folder scan system configured to identify modified folders in a storage module including a plurality of folders during an incremental backup scan is presented. The folder scan system is configured to identify modified folders using a learning-based technique. A related method is also presented.

Abstract: A system for dynamically optimizing redundant backup of one or more data sets of a plurality of data sets from a client device to a tertiary storage is presented. The system includes a user input module, a parameter comparison module, a backup path selector, and a redundant backup module. The system is configured to dynamically switch between two backup paths including: (A) direct redundant backup of the data set from the client device to the tertiary storage, or (B) back up of the data set from the client device to a secondary storage and redundant backup of the data set from the secondary storage to the tertiary storage. A related method is also presented.

Abstract: A space-efficient change journal for a storage system is provided. The storage system includes a memory having computer readable instructions stored therein. The system further includes a processor configured to access a log structure merge (LSM) tree-based metadata index having metadata for the storage system. The LSM tree-based metadata index includes indices placed in a plurality of indexing layers and one or more indices are merged within the indexing layers in response to updates to metadata, or as a background task. The processor is configured to identify one or more indices of the LSM tree-based metadata index as entries of a change journal of the storage system. The processor is further configured to maintain the change journal of the storage system based upon the identified entries.

Abstract: A system includes a data store and a data management server. The data store stores a plurality of backup snapshots that capture states of a device at different times. The data management server receives a request to restore the device that is potentially malware affected. The data management server retrieves a first backup snapshot of the device. The data management server determines that a first file stored in the first backup snapshot is malware affected. The data management server checks one or more corresponding versions of the first file captured in one or more previous backup snapshots to identify a clean version of the first file. The data management server determines that a second file stored in the first backup snapshot is clean. The data management server restores data in the device.

Abstract: A backup management system may include a data management server, a warm-tier data store, and a cold-tier data store. Snapshots may be captured from various client devices. A data block stored in the warm-tier data store may be referenced by multiple backup snapshots and/or referenced by one or more users. When a data block's total reference count is equal to the cold reference count or equal to or less than a threshold total reference count, the data management server may determine that the data block is ready to be migrated to the cold-tier data store. The data management server may send the data block into a candidate queue. In the queue, data blocks with similar retention periods or similar expected restoration may be grouped as a unit. The unit may be transmitted to the cold-tier data store in a single write request.

Abstract: A system for dynamic file chunking is provided. The system includes a memory and a processor configured to access one or more files to be chunked for a data backup operation and to identify a type of the one or more files. The type of the file is based upon an extension of the respective file. The processor is configured to analyze storage data associated with each type of files corresponding to a plurality of chunking techniques. The processor is configured to associate each of files with a corresponding data chunk size and a chunking technique class based upon the analyzed storage data and to analyze data backup parameters in-real time during the data backup operation and to update at least one of the data chunk size and the chunking technique for each of the type of files based upon the data backup parameters.

Abstract: A system and a method for on-demand search of a large data-set is presented. The system includes a data indexer, an index writer, and an index reader. The data indexer is configured to index the data set. The index writer is configured to create a multi-level directory including a plurality of directories having one or more hash partitions. The index writer is further configured to generate a hash table for each directory and write data from the indexed data set into a corresponding hash partition of a directory. The index reader is configured to identify and query a hash partition in each directory based on a search term and a corresponding hash table for the directory. The index reader is further configured to retrieve one or more relevant records, and present the one or more relevant records to a user.

Abstract: A system includes a data management server and a data store. The data store uses an external file system to store data block of a client virtual machine. The client virtual machine uses an internal file system. The data management server comprises a proxy agent and a staging virtual machine. In response to receiving a request to retrieve a file indexed by the client virtual machine, the proxy agent imports data of the internal file system to a staging virtual machine. The proxy agent determines an internal file address that corresponds to the requested file. The staging virtual machine translates the internal file address to an external file address of the external file system. The staging virtual machine retrieves the file stored in the data store based on the external file address. The staging virtual machine provides the retrieved file to the target device.

Abstract: A system for recommending a disaster recovery failover region of a public cloud service provider is provided. The system includes a memory having computer-readable instructions stored therein and a processor configured to execute the computer-readable instructions to detect a disaster recovery requirement for one or more clients of the public cloud service provider. The one or more clients is predicted to be affected by a disaster. The processor is further configured to monitor one or more disaster recovery (DR) factors associated with geological and meteorological conditions, legal and compliance requirements, network latency and costs for a plurality of disaster recovery regions associated with the public cloud service provider and to recommend a disaster recovery failover region for each of the one or more clients affected by the occurrence of the disaster based on the one or more DR factors.

Abstract: A system for estimating one or more data storage parameters and/or statistics in a data storage system is presented. The data storage system includes a plurality of storage containers. The system includes a snapshot module, a container stats aggregator, a synchronization module, a global stats aggregator, and storage stats estimator.

Abstract: A file system may include an object storage, a merged index, and a distributed database. When a file is stored in the file system, the file may be converted to an object and be stored in the object storage. The deduplication index of the file may be stored in the distributed database. The namespace metadata of the file may be stored in the merged index. The merged index generates namespace entries of the file when the file is created, deleted, and/or modified. A namespace entry may be associated with a specific file and may include a creation version and a deletion version. When a file is deleted or modified, instead of modifying the existing namespace entries, new entries associated with different versions and including different creation or deletion versions are created. The status of a file may be monitored by one or more entries associated with a file.

Abstract: Techniques and mechanisms described herein provide for verification of data across cloud-based and on-premises data storage systems. According to various embodiments, a backup client implemented on a first compute node can store a data file in a backup data repository. A data guardianship can store first data file state information describing the data file in a key-value store accessible via the internet. A data verification instance can analyze the backup data repository to verify that the data file is stored intact in the backup data repository.

Abstract: Disclosed embodiments include a method (system and non-transitory computer-readable medium) for backing up updated portions of a plurality files having hierarchical relationships through object storage. In one or more embodiments, a file is segregated into chunks, and objects corresponding to the chunks are generated for storage at an object storage. For a chunk, an object for storing the chunk and additional objects for storing mapping information are generated. The mapping information may include path information identifying a path of the file in a hierarchical structure, a file version list identifying a version of the file, a chunk list describing an association between the file and the chunks, a chunk version list identifying a version of the chunk, etc. When a portion of the file is updated, objects corresponding to the updated portion of the file can be generated, and stored at the object storage.

Abstract: A data restoration system including a data management server. The data management server receives one or more data restoration requests for restoring a plurality of data blocks. The data management server determines, based on metadata associated with the data blocks, a first subset of warm data blocks corresponding to warm-tier data and a second subset of cold data blocks corresponding to cold-tier data. The data management server retrieves the warm data blocks in the first subset and restores the warm data blocks in the first subset. The data management server groups the cold data blocks based in part on storage times of the cold data blocks to generate a plurality of cold-tier data retrieval requests. The data management server retrieves the cold data blocks by batches, each batch corresponding to one of the cold-tier data retrieval requests. The data management server restores the cold data blocks in the second subset.

Abstract: A system for data backup is provided. The system includes a memory having computer-readable instructions stored therein and a processor configured to execute the computer-readable instructions to receive a request for full data and/or incremental backup for a volume and to perform a full backup of the volume based on a first block size in response to a full data backup request. The processor is configured to generate a digital fingerprint of the full backup and determine if the full backup exists on a backup media based on the generated digital fingerprint and to upload the full backup to the backup media if it is determined that the first backup is unavailable on the backup media and perform an incremental backup of the volume based on a second block size in response to an incremental backup request. The second block size is substantially smaller than the first block size.

Abstract: A system identifies and causes transmission of differential data generated during device migration. An administrative server accesses a first backup snapshot of a retiring client device. The first backup snapshot includes a set of files stored in the retiring client device during a first checkpoint. The administrative server transmits the set of files in the first backup snapshot to a replacement client device. A cloud server stores the first backup snapshot and a second backup snapshot of the retiring client device. The second backup snapshot is created during a second checkpoint occurring after transmission of the set of files. The cloud server receives an indication that a user has logged on to the replacement client device and causes a transmission of differential data to the replacement client device. The differential data includes at least one file in the second backup snapshot that is not included in the first backup snapshot.

Abstract: A system, method, and non-transitory computer-readable medium provide backup and archive services for computing devices. Typically, multiple backup snapshots are archived together in each archive cycle. A catalogue for the current archive is efficiently created by starting with a copy of the previous archive catalogue and updating it based on metadata associated with the backup snapshots.

Abstract: A file system may include an object storage, a merged index, and a distributed database. When a file is stored in the file system, the file may be converted to an object and be stored in the object storage. The deduplication index of the file may be stored in the distributed database. The namespace metadata of the file may be stored in the merged index. The merged index generates namespace entries of the file when the file is created, deleted, and/or modified. A namespace entry may be associated with a specific file and may include a creation version and a deletion version. When a file is deleted or modified, instead of modifying the existing namespace entries, new entries associated with different versions and including different creation or deletion versions are created. The status of a file may be monitored by one or more entries associated with a file.

Abstract: A system and method for an index-based smart scan for a cloud-computing provider network is provided. The system includes a memory having computer-readable instructions stored therein and a snapshot repository configured to store a plurality of snapshots of a plurality of block storage volumes. Each of the plurality of block storage volumes is configured to perform volume based block storage operations for the cloud-computing provider network. The system further includes a processor communicatively coupled to the snapshot repository. The processor is configured to access contents of each of the plurality of snapshots. Each of the plurality of snapshots includes a point-in-time capture of the respective block storage volume. In addition, the processor is configured to perform a full scan of each of the plurality of snapshots to identify one or more files of the respective block storage volume. The processor is further configured to generate a folder index table for each of the files based upon the scan.