Abstract: The disclosure provides methods and systems for direct-to-cloud backup with local volume failover. According to an exemplary embodiment, first and second logical volumes are designated on a protected computing device. The first and second logical volumes may be paired to a cloud storage facility. In response to a received signal, it may be determined if the protected computing device has a communication connection to the cloud storage facility. If the protected computing device does have a communication connection to the cloud storage facility, a first computing device backup of the first logical volume may be sent to the cloud storage facility. If the protected computing device does not have a communication connection to the cloud storage facility, a second computing device backup of the first logical volume may be performed and stored on the second logical volume of the protected computing device.

Abstract: Described screenshot verification systems and methods for automatically verifying the integrity of a backup image or other process-of-interest using a screenshot verification system, as well as disaster recovery systems including said systems and performing said methods. In accordance with various aspects of the present disclosure, a virtual machine is booted and screenshots of the boot process are taken, which are used by a trained model, such as a convolutional neural network, to determine a boot state consistency. The systems and methods described deliver over 99% accuracy and do not involve regular expression analysis typical of conventional methods.

Abstract: A method for automated ransomware identification includes receiving a first series of data items for backup from a host system, identifying, using a heuristic, a first characteristic of the first series of data items, receiving a second series of data items for backup from the host system, identifying, using the heuristic, a second characteristic of the second series of data items, detecting that the second characteristic differs from the first characteristic in a manner consistent with a ransomware infection, and invoking a recovery procedure responsive to the detecting.