Abstract: Some examples relate generally to a data management platform comprising: a storage device configured to store secondary data and one or more processors in communication with the storage device and configured to perform certain operations. The operations may include identifying an aspect of the secondary data stored in the storage device, the secondary data including a backup of respective primary data stored in a primary data source; identifying or receiving an indication of a target to receive data associated with the identified aspect of the secondary data; and transmitting the data associated with the aspect of the secondary data to the target.

Abstract: Techniques for preventing recovery of specific data elements based on a recovery prevention configuration defined by a user are disclosed. In some embodiments, a computer system performs operations comprising: receiving a recovery prevention configuration from a first computing device of a first user, the recovery prevention configuration comprising at least one recovery prevention parameter specified by the first user via one or more user interface elements displayed on the first computing device, the at least one recovery prevention parameter being configured to identify one or more backup data elements stored in a secondary storage system; storing the recovery prevention configuration in a database in association with the secondary storage system; and filtering out the one or more backup data elements stored in the secondary storage system from a data recovery process based on the at least one recovery prevention parameter of the stored recovery prevention configuration.

Abstract: Some examples relate generally to computer architecture software for data classification and information security and, in some more particular aspects, to verifying audit events in a file system.

Abstract: According to various embodiments, with respect to a target set of files being managed (e.g., protected by data snapshots), each file in the target set of files is classified into one of two or more filesets (discontiguous filesets), where each of these filesets comprises one or more files that are related to each other by one or more factors, such as frequency of file change or purpose of existence (e.g., used by a software application). Once classified, files within the target set of files can be uniquely processed by a data management operation (e.g., incremental data snapshot process) according to their association to a discontiguous fileset.

Abstract: Methods and systems for backing up and restoring files that have multiple hard links using master file references and index node-based mappings are described. In some cases, file fetching and restoration may be performed by a storage appliance using master file references in which a master file is identified for each multi-link file that is backed-up on the storage appliance and then referenced by one or more hard links to the multi-link file. In other cases, file fetching and restoration may be performed by a storage appliance using index node-based mappings for multi-link files that provide mappings between index node identifiers (e.g., inode numbers) for the multi-link files on a primary system and hard link paths for storing the file contents of the multi-link files on a storage appliance used for backing up the primary system.

Abstract: Systems and methods to export a database to a native database recovery, environment are described. The system includes a native database recovery environment that includes a target host. The target host receives file information and script information, over a network, via directories from a backup host. The backup host utilizes foreign snapshot files and foreign incremental files to store the file information in the foreign database recovery environment. The file information includes native snapshot files and native incremental files. The script information includes scripts that are executed by the target host in the native database recovery environment. The target host executes the scripts to mount the directories, open the database, restore the database, recover the database to a point-in-time, and unmount the directories.

Abstract: An example method of restoring a database includes obtaining information about backup data of a database from a source storage separate from a compute infrastructure. The information includes a list of data blocks of a file, transferring the data blocks on the list from the source storage to a local storage on the compute infrastructure, and tracking which data blocks of the file have been transferred from the source storage to the local storage concurrently when transferring the data blocks.

Abstract: A database can be instantly cloned from a source device to a target device by a cluster mapped to a database to be cloned. Nodes of the cluster are mapped over channels to directories of the database. Scripts are generated from one or more templates that specify the order and values to be executed to perform a database job, such as cloning the database to the target device using the mappings. To clone the database, a template can be executed that generates and populates scripts, which can be executed on the target device to provide a functioning cloned database using the mapped cluster.

Abstract: A data management and storage (DMS) cluster of peer DMS nodes manages data of a tenant of a multi-tenant compute infrastructure. The compute infrastructure includes an envoy connecting the DMS cluster to virtual machines of the tenant executing on the compute infrastructure. The envoy provides the DMS cluster with access to the virtual tenant network and the virtual machines of the tenant connected via the virtual tenant network for DMS services such as data fetch jobs to generate snapshots of the virtual machines. The envoy sends the snapshot from the virtual machine to a peer DMS node via the connection for storage within the DMS cluster. The envoy provides the DMS cluster with secure access to authorized tenants of the compute infrastructure while maintaining data isolation of tenants within the compute infrastructure.

Abstract: Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to machine learning based on changes in snapshot metadata for anomaly and ransomware detection in a file system.

Abstract: Normal virtual machine operation is observed to automatically determine patterns of resource utilization. Backup activities are then scheduled, taking into account these utilization patterns. For example, if a normally scheduled backup would occur during a busy period, it may be rescheduled to a less busy period. As another example, backups made by made opportunistically during less busy periods even if not required by the normal backup schedule, in order to alleviate backup demands during more busy periods.

Abstract: In some examples, an anomaly database system is provided for processing metrics in telemetry data. An example anomaly database system comprises a continuous data management (CDM) node, the CDM node including a metrics library for sending out system metrics in a sparse manner and a statistics relay for receiving streaming metrics from nodes in a node cluster, the node cluster including the CDM node, the statistics relay pushing the received metrics to a metrics collector. A sparse consumers module pulls metrics, from the metrics collector, pushed to the metrics collector by the statistics relay.

Abstract: A data management system having a storage appliance configured to store a snapshot of a virtual machine; and one or more processors in communication with the storage appliance. The one or more processors are configured to perform operations including: identifying a plurality of shards of the virtual machine; requesting a shard snapshot of each of the plurality of shards; receiving the shard snapshots asynchronously; ordering the received shard snapshots sequentially into a results queue; and storing a single snapshot of the virtual machine based on the ordered shard snapshots. The operations may further include maintaining a flow control queue that limits a number of the requested shard snapshots.

Abstract: A data management system comprises: a storage appliance configured to store a snapshot of a virtual machine; and one or more processors in communication with the storage appliance. The one or more processors are configured to perform operations including: identifying a plurality of shards of the virtual machine; requesting a snapshot of each of the plurality of shards; receiving the shards asynchronously; ordering the received snapshot shards sequentially into a results queue; and storing a single snapshot of the virtual machine based on the ordered snapshot shards. Operations may further include maintaining a flow control queue that limits the number of snapshot shards requested.

Abstract: An example method of managing and storing data includes pulling and saving a first snapshot of a first state of a target machine running on a cloud service and creating a first virtual machine (VM) package associated with the first snapshot. The first VM package sufficient to instantiate a VM emulating the target machine with the first state on an on-premise destination VM platform. The method includes pulling and saving a second snapshot of a second state of the target machine, wherein the second state occurs after the first state. A second VM package is created and associated with the second snapshot, the second VM package sufficient to instantiate the VM emulating the target machine with the second state on the destination VM platform. The second VM package is created by updating the first VM package according to differences between the first snapshot and the second snapshot.

Abstract: Systems, methods, and machine-storage mediums for optimizing snapshot image processing are described. The system receives a first read request to read data from optimized snapshot information including snapshot information and cached snapshot information. The first read request includes a first offset identifying a first storage location and a first length. The snapshot information includes a full snapshot and at least one incremental snapshot. The system identifies a first portion of the data is stored in the snapshot information responsive to identifying the first portion of the data is not stored in the cache snapshot information. The system identifies a second portion of data is stored in the optimized snapshot information, reads the first portion of data and the second portion of data from the optimized snapshot information, and communicates the data, including the first and second portions of the data, to the job.

Abstract: Described herein is a system that restores a database by processing a portion of the database. The system restores the database to a previous state at a particular time by reverting data entries that have changed since the time to their initial values before the change. Data entries that have changed after the restore time are identified. For the data entries that have changed after the restore time, their initial values before the change are determined from various sources. The system determines a database version that is created most recently before the restore time. The system additionally identifies changes to the database between the restore time and when the database version is created. The initial values can be determined from either the database version or the changes made to the database between the restore time and when the database version is created.

Abstract: Systems, methods, and machine-storage medium for classifying snapshot image processing are described. The system receives read requests to read snapshot information. Each read request includes an offset identifying a storage location and a length. The snapshot information includes snapshots including a full snapshot and at least one incremental snapshot. The read requests include a first read request to read data from the snapshot information. The system generates a first plurality of read events including a second plurality of read events that are generated by processing the first read request. The second plurality of read events includes first and a second read events. The system identifies whether utilizing a cache optimizes the job based on the first plurality of read events.

Abstract: Methods and systems for improving data back-up, recovery, and search across different cloud-based applications, services, and platforms are described. A data management and storage system may direct compute and storage resources within a customer's cloud-based data storage account to back-up and restore data while the customer retains full control of their data. The data management and storage system may direct the compute and storage resources within the customer's cloud-based data storage account to generate and store secondary layers that are used for generating search indexes, to generate and store shared space layers and user specific layers to facilitate the deduplication of email attachments and text blocks, to perform a controlled restoration of email snapshots such that sensitive information (e.g., restricted keywords) located within stored snapshots remains protected, and to detect and preserve emails that were received or transmitted and then deleted between two consecutive snapshots.

Abstract: In some embodiments, a process for restoring a version of a virtual machine using a data storage system comprises identifying a particular version of a virtual machine to be restored, determining a base image from which the particular version may be derived, determining a set of incremental files for generating the particular version, generating a file associated with the particular version using the base image and the set of incremental files, and outputting at least a portion of the file.