Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: obtaining, by a data management system (DMS), a first snapshot of a computing system; generating, by the DMS, one or more vectors based at least in part on data from the first snapshot, the one or more vectors representative of one or more respective portions of text within one or more files represented by the first snapshot; adding, by the DMS, the one or more vectors to a vector database along with metadata or a pointer to the metadata; storing, by the DMS, the one or more respective portions of text in a secondary storage environment; and adding, by the DMS to a mapping log, respective indications of mappings between the one or more vectors and the one or more respective portions of text.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may obtain a snapshot of a file system that includes multiple files and permission sets associated with the files. A permission may indicate one or more access approvals for associated principals. The DMS may assign unique values to the permission sets, where each unique value identifies a respective permission set. The DMS may store a first mapping between the files and the unique values based on the permission sets that correspond to the files. The DMS may store a second mapping between the principals and the unique values based on an evaluation of the permission sets. The DMS may use the first mapping and the second mapping to identify, for a principal, a set of files to which the principal has access.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.

Abstract: Methods and systems for managing, storing, and serving data within a virtualized environment are described. In some embodiments, a data management system may manage the extraction and storage of virtual machine snapshots, provide near instantaneous restoration of a virtual machine or one or more files located on the virtual machine, and enable secondary workloads to directly use the data management system as a primary storage target to read or modify past versions of data. The data management system may allow a virtual machine snapshot of a virtual machine stored within the system to be directly mounted to enable substantially instantaneous virtual machine recovery of the virtual machine.

Abstract: Systems, methods, and machine-storage mediums for optimizing snapshot image processing are described. The system receives a first read request to read data from optimized snapshot information including snapshot information and cached snapshot information. The first read request includes a first offset identifying a first storage location and a first length. The snapshot information includes a full snapshot and at least one incremental snapshot. The system identifies a first portion of the data is stored in the snapshot information responsive to identifying the first portion of the data is not stored in the cache snapshot information. The system identifies a second portion of data is stored in the optimized snapshot information, reads the first portion of data and the second portion of data from the optimized snapshot information, and communicates the data, including the first and second portions of the data, to the job.

Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: obtaining, by a data management system (DMS), a first snapshot of a computing system; generating, by the DMS, one or more vectors based at least in part on data from the first snapshot, the one or more vectors representative of one or more respective portions of text within one or more files represented by the first snapshot; adding, by the DMS, the one or more vectors to a vector database along with metadata or a pointer to the metadata; storing, by the DMS, the one or more respective portions of text in a secondary storage environment; and adding, by the DMS to a mapping log, respective indications of mappings between the one or more vectors and the one or more respective portions of text.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may obtain a snapshot of a file system that includes multiple files and permission sets associated with the files. A permission set may indicate one or more access approvals for associated principals. The DMS may scan the files to identify unique pairs each including a unique combination of a respective permission set and a respective sensitive information type. The DMS may store a first mapping that maps the unique pairs to respective values that indicate an amount of sensitive information, of the respective sensitive information type, that is included in one or more files associated with the unique pair. The DMS may identify a respective set of sensitive data types included in files to which a principal has access based on the first mapping and an evaluation of the permission sets.

Abstract: Methods, systems, and non-transitory computer readable media are configured to perform operations comprising receiving an embedding vector associated with first data; permuting the embedding vector to generate a permuted embedding vector; and providing the permuted embedding vector to a vector database.

Abstract: Subject matter related to data management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, the non-infected snapshot may be recovered.

Abstract: Subject matter related to data management is disclosed. Snapshots of a target object in a computing system may be stored, where the snapshots may correspond to multiple versions of the target object. A first indication that information in a snapshot of the snapshots is flagged for quarantine may be obtained. Based on receiving the first indication, a second indication that the information in the snapshot is prohibited from being restored during a restoration operation for the target operation may be generated. The second indication that the information in the snapshot is prohibited from being restored may be stored.

Abstract: Subject matter related to data management is disclosed. Snapshots of a target object in a computing system may be stored, where the snapshot may correspond to multiple versions of the target object. An indication that information in one or more of the snapshots may be stored. A request to restore a snapshot of the target object may be received. In response to the request, a determination of whether the snapshot of the target object is prohibited from being restored may be made based on the indication that information in one or more of the snapshots is flagged for quarantine. A determination of whether to initiate a restoration operation in response to the request to restore the snapshot may also be made based on whether the snapshot is prohibited from being restored.

Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: obtaining, by a data management system (DMS), a first snapshot of a computing system, wherein the first snapshot comprises data associated with a set of files; determining, by the DMS, from among the set of files, a first subset of files or portions of files that comprise sensitive information; generating, by the DMS, one or more vectors based at least in part on data associated with a second subset of files or portions of files from among the set of files, the second subset of files or portions of files exclusive of files from the first subset of files or portions of files; and adding, by the DMS, the one or more vectors to a vector database along with metadata or a pointer to the metadata.

Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: obtaining, by a data management system (DMS), a first snapshot of a computing system; generating, by the DMS, one or more vectors based at least in part on data from the first snapshot, the one or more vectors representative of one or more respective portions of text within one or more files represented by the first snapshot; adding, by the DMS, the one or more vectors to a vector database along with metadata or a pointer to the metadata; storing, by the DMS, the one or more respective portions of text in a secondary storage environment; and adding, by the DMS to a mapping log, respective indications of mappings between the one or more vectors and the one or more respective portions of text.

Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: receiving, by a data management system (DMS), a query for a large language model (LLM) via an application; and retrieving, by the DMS and based at least in part on contextual information associated with the query, information from a vector database accessible to the DMS, wherein the vector database comprises one or more vectors comprising data associated with one or more snapshots obtained by the DMS of a computing system, wherein a prompt for the LLM is generated based at least in part on the query and the information, and a response to the query is provided based at least in part on the prompt and the LLM.

Abstract: Methods, apparatuses, and computer readable media are configured to perform operations comprising: obtaining, by a data management system (DMS), a first snapshot of a computing system; generating, by the DMS, one or more vectors based at least in part on data from the first snapshot; and adding, by the DMS, the one or more vectors to a vector database along with metadata or a pointer to the metadata, wherein the metadata is associated with the data from the first snapshot, and wherein the vector database comprises a knowledge repository that is accessible to an application associated with the DMS, the application further associated with communication with a large language model (LLM).

Abstract: Systems, methods, and machine-storage mediums for optimizing snapshot image processing are described. The system receives a first read request to read data from optimized snapshot information including snapshot information and cached snapshot information. The first read request includes a first offset identifying a first storage location and a first length. The snapshot information includes a full snapshot and at least one incremental snapshot. The system identifies a first portion of the data is stored in the snapshot information responsive to identifying the first portion of the data is not stored in the cache snapshot information. The system identifies a second portion of data is stored in the optimized snapshot information, reads the first portion of data and the second portion of data from the optimized snapshot information, and communicates the data, including the first and second portions of the data, to the job.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may obtain a snapshot of a file system that includes multiple files and permission sets associated with the files. A permission set may indicate one or more access approvals for associated principals. The DMS may scan the files to identify unique pairs each including a unique combination of a respective permission set and a respective sensitive information type. The DMS may store a first mapping that maps the unique pairs to respective values that indicate an amount of sensitive information, of the respective sensitive information type, that is included in one or more files associated with the unique pair. The DMS may identify a respective set of sensitive data types included in files to which a principal has access based on the first mapping and an evaluation of the permission sets.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.

Abstract: Subject matter related to data management is disclosed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A selection of an infected snapshot may be received, where the infected snapshot may be more recent than the identified most recent snapshot. The selected infected snapshot may be mounted. Based on mounting the infected snapshot, a determination of which content in the selected snapshot are not infected may be made. Based on determining which content in the selected snapshot is not infected, at least one of the non-infected content may be recovered.

Abstract: Subject matter related to data management is disclosed. Snapshots of a target object in a computing system may be stored, where the snapshots may correspond to multiple versions of the target object. A first indication that information in a snapshot of the snapshots is flagged for quarantine may be obtained. Based on receiving the first indication, a second indication that the information in the snapshot is prohibited from being restored during a restoration operation for the target operation may be generated. The second indication that the information in the snapshot is prohibited from being restored may be stored.