Abstract: In some examples, a data management system processes snapshots of a distributed file system, the distributed file system having files, each file comprising multiple data chunks. The data management system performs operations including storing file-to-chunk mapping in file system metadata; creating, for each chunk, a chunk generation ID by associating each chunk with a file system generation ID; in a next-generation snapshot of the distributed file system, incrementing, for all chunks in the next-generation snapshot, the respective chunk generation IDs; and taking a snapshot of the file system metadata and storing an updated file-to-chunk mapping associated with the next-generation snapshot.

Abstract: A method for transferring virtual machines across hypervisors is described. According to the method, a data management system may interface with a first hypervisor platform and a second hypervisor platform. The data management system may obtain a snapshot of a first virtual machine executing on the first hypervisor platform. The snapshot may include data and metadata associated with the first virtual machine in a first format that is supported by the first hypervisor platform. The data management system may extract the data and the metadata from the snapshot of the first virtual machine and convert the data and the metadata from the first format to a second format that is supported by the second hypervisor platform. The data management system may transfer the data and the metadata in the second format to a second virtual machine executing on the second hypervisor platform.

Abstract: Techniques for database management are described. A database management system may transmit a request for a data management system of a database to provide a set of metadata attributes for structured data within the database, and may receive a set of metadata attributes for the structured data within the database. The data management system may perform a pattern matching procedure to evaluate the set of metadata attributes for the structured data within the database against one or more patterns associated with a data type to determine one or more locations within the database that include structured data of the data type. Based on the pattern matching procedure, the data management system may output an indication that the one or more locations within the database include structured data of the data type.

Abstract: Methods and systems for recovering databases and other applications with reduced downtime using recoverable chains are described. When protecting or backing up a database, an integrated data management and storage system may capture snapshots of the database at a snapshot frequency (e.g., at 15 minute intervals) and acquire database transaction logs that include data changes of the database at a frequency that is greater than the snapshot frequency. The integrated data management and storage system may generate a particular point in time version of the database by identifying a recoverable chain that comprises a combination of one or more database snapshots including the snapshot closest to the recovery point and one or more database transaction logs.

Abstract: In some examples, a cluster comprises peer nodes and a distributed data store implemented across the peer nodes, a method of remote linking of data objects for data transfer between a first node cluster and a second node cluster among the peer nodes, the method comprising: creating a data object group including multiple remote data objects, wherein a plurality of remote data objects in the data object group represent a same first virtual machine and are registrable on at least the first and second node clusters of the peer DMS nodes; creating or identifying remote links to a plurality of the remote data objects in the data object group; designating a member of the data object group as an active member of the group; and assigning a task to the active member to be completed using remote links.

Abstract: Methods and systems for improving data back-up, recovery, and search across different cloud-based applications, services, and platforms are described. A data management and storage system may direct compute and storage resources within a customer's cloud-based data storage account to back-up and restore data while the customer retains full control of their data. The data management and storage system may direct the compute and storage resources within the customer's cloud-based data storage account to generate and store secondary layers that are used for generating search indexes, to generate and store shared space layers and user specific layers to facilitate the deduplication of email attachments and text blocks, to perform a controlled restoration of email snapshots such that sensitive information (e.g., restricted keywords) located within stored snapshots remains protected, and to detect and preserve emails that were received or transmitted and then deleted between two consecutive snapshots.

Abstract: In some examples, performing a backup of a group of relational databases comprises identifying the group of relational databases; identifying I/O traffic flowing into or out of the group of relational databases; temporarily freezing the I/O traffic flowing into or out of the group of relational databases; identifying a set of batch backup operations to be performed during the temporary I/O freeze; identifying relational dependencies between at least some databases in the group of relational databases; based on the identified relational dependencies, identifying, among the set of batch backup operations, a first sub-set of backup operations eligible to be performed in parallel, and a second sub-set of backup operations not eligible to be performed in parallel; conducting the backup, wherein conducting the backup comprises performing the identified first sub-set of backup operations in parallel and performing the identified second sub-set of backup operations sequentially; and unfreezing the I/O traffic.

Abstract: In some examples, a method comprises: receiving a request to read data within a specified range from a backup file storing at least one base snapshot and at least one incremental snapshot; looking up the specified range in range filters from the backup file, the range filters corresponding to snapshots stored in the backup file and each range filter comprising bits indicating whether data exists at respective ranges within the snapshot corresponding to the respective range filter; and in response to the looking up, reading the requested data from the looked-up range in the backup file.

Abstract: A data management system (DMS) may select, prior to obtaining a first snapshot of a first virtual machine (VM) and from among one or more snapshots previously obtained by the DMS, a second snapshot to use for deduplication of the first snapshot. The DMS may obtain the first snapshot after selecting the second snapshot. Obtaining the first snapshot may include writing a first subset of data blocks from the first VM to a snapshot file for the first snapshot based on the first subset of the data blocks from the first VM being different from a first corresponding subset of the second snapshot and refraining from writing a second subset of the data blocks from the first VM to the snapshot file for the first snapshot based on the second subset of the data blocks from the first VM matching a second corresponding subset of the second snapshot.

Abstract: Embodiments disclosed herein provide systems, methods, and computer readable media for container based application reification. In a particular embodiment, an application reification system is provided including one or more computer readable storage media and a processing system operatively coupled with the one or more computer readable storage media. The application reification system further includes program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to preserve a version of application data at a first time and a configuration of an application at the first time. At a second time subsequent to the first time, the program instructions direct the processing system to create a template for a container containing the application in the configuration and a pointer to the version of the application data in a secondary storage repository.

Abstract: In some examples, a data management and storage (DMS) platform, comprises peer DMS nodes in a node cluster, a distributed data store comprising local and cloud storage, and at least one processor configured to perform operations in a method of creating a local consolidated patch file from a patch file chain stored in the cloud storage. The operations include, in a first dry-run phase, creating a logical patch file image of data blocks in one or more cloud patch files stored in the cloud storage; in a second data-transfer phase, downloading at least some of the data blocks from the cloud patch files identified by the logical patch file image, the second data-transfer phase comprising a coalescing operation to construct a set of coalesced reads of the data blocks; and creating and storing, in the local storage, the local consolidated patch file using the downloaded data blocks.

Abstract: A second data source may retrieve metadata for one or more versions of a set of versions of a file stored at the first data source. In some examples, the metadata for the one or more versions of the file may include at least an identifier of the file, a timestamp, and a cryptographic signature. In some examples, generation of the cryptographic signature may be based on the identifier of the file, the timestamp, and a cryptographic key. The second data source may identify a set of versions of the file that were uploaded from a trusted data source to the first data source based on a comparison of the cryptographic signature to a computed cryptographic signature. The second data source may then determine a targeted version of the file and retrieve the targeted version of the file from the first data source.

Abstract: Techniques for implementing a scalable automated training framework for anomaly and ransomware detection are disclosed. A computer system may instantiate one or more virtual machines (VMs). Each VM may be loaded with a corresponding file system. The computer system may simulate, on the one or more VMs, user actions and ransomware, which may cause changes to the corresponding file systems loaded on to the VMs. The computer system may obtain snapshots of the VMs that indicate changes to the corresponding file system of each of the VMs. The computer system may generate a metadata file for each VM based on the corresponding snapshot. The computer system may generate training data for training a ransomware detection model using a machine learning algorithm based on the metadata files for each of the VMs.

Abstract: Embodiments disclosed herein provide systems, methods, and computer readable media for data lineage based multi-data store recovery. In a particular embodiment, a method provides identifying first data in a first table of a plurality of tables stored in a plurality of data stores and restoring the first data to a first correct version of the first data in a prior version of the first table. The method further provides identifying a second table of the plurality of tables that descends from the first table and includes second descendent data that stems from the first data. The method also provides restoring the second descendent data to a second correct version of the second descendent data in a prior version of the second table.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may determine to generate a backup instance of an application that includes multiple user accounts. The DMS may identify a time window for generation of the backup instance based on a set of backup parameters associated with the application. The DMS may calculate respective runtime durations for the user accounts based on respective quantities of data objects in the user accounts and respective backup job types associated with the data objects. The DMS may determine respective values of a semaphore parameter based on the respective runtime durations and the time window, where the semaphore parameter defines a threshold quantity of data objects to be processed in parallel. The DMS may generate the backup instance of the application based on processing the user accounts in accordance with the respective values of the semaphore parameter.

Abstract: In some examples, an anomaly database system is provided for processing metrics in telemetry data. An example anomaly database system comprises a continuous data management (CDM) node, the CDM node including a metrics library for sending out system metrics in a sparse manner and a statistics relay for receiving streaming metrics from nodes in a node cluster, the node cluster including the CDM node, the statistics relay pushing the received metrics to a metrics collector. A sparse consumers module pulls metrics, from the metrics collector, pushed to the metrics collector by the statistics relay.

Abstract: Embodiments disclosed herein provide systems, methods, and computer readable media for sub-cluster recovery in a data storage environment having a plurality of storage nodes. In a particular embodiment, the method provides scanning data items in the plurality of nodes. While scanning, the method further provides indexing the data items into an index of a plurality of partition groups. Each partition group includes data items owned by a particular one of the plurality of storage nodes. The method then provides storing the index.

Abstract: A data management platform may receive, from a user of a data management platform, a first job request to perform a backup of data from a data source to a database managed by the user. In some examples, the database may be configured as a set of database instances running on a set of computing nodes of a computing cluster. The data management platform may store a backup load indication that indicates which computing node is assigned to perform the backup of the data based on receiving the first job request. The data management platform may receive one or more second job requests subsequent to receiving the first job request and may determine a backup load for one or more computing nodes of the set of computing nodes. The data management platform may then assign one or more target computing nodes for performing the one or more second job requests.

Abstract: Methods, systems, and devices for data management are described. A first procedure for capturing first point-in-time data for a data object may be performed and may include initiating a first type of operation to back up the first point-in-time data, the first operation being native to the data object and enabling sections of files to be backed up in parallel on a per-section basis. A second procedure for restoring the first point-in-time data to the computing system may also be performed. Performing the second procedure may include executing, based on recreating the first point-in-time data, the first type of operation to backup sections of first files of the first point-in-time data in parallel on the per-section basis to the computing system. And further include initiating a second type of operation to restore second files of the first point-in-time data in parallel on a per-file basis to the computing system.

Abstract: A data management system (DMS) may facilitate snapshot exports between a snapshot storage account and a computing system. The DMS may receive, from the computing system, a request to download data associated with one or more snapshots stored in the snapshot storage account in a first cloud environment. The DMS may generate an export job for execution by one or more computing resources within the first cloud environment based on the request. The export job may be operable to decrypt the data and write the decrypted data to an export storage account in a second cloud environment. The DMS may generate an encrypted download link that is operable to download the decrypted data from the export storage account. The DMS may transmit the encrypted download link to the computing system associated with the request to download the data.