Abstract: One embodiment is related to a method for generating a searchable metadata table based on a backup data stream from a client to a backup system, comprising: generating a plurality of intermediate tables; and generating a searchable metadata table based on the plurality of intermediate tables, wherein the searchable metadata table may comprise, for each file or directory in a row, an inode number, a metadata hash value, an acl hash value, a name, a full path, a size, and a time of last modification.

Abstract: A method and system for implementing agentless virtual disk metadata indexing. Specifically, the disclosed method and system entails the parsing of data within a virtual machine and/or virtual disk snapshot to extract filesystem metadata information during data backup operations. Extraction of the filesystem metadata information is performed based on an understanding of a filesystem layout for a format in which the snapshot is defined, rather than based on the mounting and traversing of the snapshot. Furthermore, the extracted filesystem metadata information is encoded in a schema that may facilitate indexing of the information for use in a metadata searching and/or retrieval service.

Abstract: According to one embodiment, one or more consistent states of a virtual machine (VM) are backed up and stored. An index library is used to extract, from the consistent state(s) of the VM, metadata corresponding to content files captured in the consistent state(s). The extracted metadata is stored into a metadata catalog, where the metadata catalog is subsequently downloaded by an index server to index the content files captured in the consistent state(s).

Abstract: A method, apparatus, and system for storing indexed metadata associated with backed up data is provided. The operations comprising: for each first data item stored at a first client device to be backed up, extracting, at the first client device, an associated first metadata item; transforming, at the first client device, the first metadata item based on a predefined metadata definition; associating, at the first client device, a first client identifier and a backup identifier with the transformed first metadata item; and transferring the transformed first metadata item from the first client device to a metadata bus of a search cluster.

Abstract: One embodiment is related to a method for performing garbage collection at a backup system, comprising: determining an object that is present in a preceding backup but is no longer present in a present backup when or after the present backup is made; associating an indicator indicative of the preceding backup with the object in response to the determination that the object is no longer present in the present backup; determining whether the object is to be deleted from the backup system based on the indicator and a policy during garbage collection; and deleting the object in response to determining that the object is to be deleted.

Abstract: Embodiments for a method of implementing dynamic subgraphs in a graph database by defining vertices of a subgraph descriptively in such a way that the original intent of the content is preserved while the subgraph itself is changing. A database process preserves a “view” of the database as a stored query which will define a subgraph members while the subgraph members are modified, and as opposed to a method in which edges are induced from their vertices to be included in the subgraph, by defining the content of a subgraph descriptively using a database view, vertices which are new and should be contained in the subgraph will automatically be included.

Abstract: Systems, methods, and computer-readable media can present improved detection of ransomware in a computer system. Embodiments can provide receiving backup data from the computer system. Metadata may be extracted from the backup data. Change rates of the backup metadata against prior backup data may be computed. Ransomware may be then detected by determining that the change rate exceeds a threshold change rate.

Abstract: Combining a Merkle tree with a graph database by defining a Merkle tree with each node having a hashed value of the metadata for the node and any children of that node, associating non-hashed data with the hashed data for each node, wherein the non-hashed data has an up-pointer from a child node to any of its immediate parent node, and defining bi-directional edges between the nodes of the Merkle tree having a graph database structure to create a reference for the up-pointers associated with each Merkle tree node. The bi-directional edges with up-pointers along with the Merkle tree hash scheme allows efficient traversal of the tree where the hash values indicate non-changed nodes to prevent traversing the database, and further allows efficient path definitions by allowing database processes to walk up edges.

Abstract: A recipe is stored for an application where the recipe specifies parameters and actions for restoring, shutting down, and backing up the application. A snapshot backup of the application is copied from a backup system to a recovery system where the application is restored according to the recipe. After the application is restored, the application is shutdown. While the application is shutdown, the application is backed up to create an application-consistent backup of the application.