Abstract: Embodiments of the invention provide methods, systems, software and data structures for monitoring, analyzing, storing and/or collecting events on a monitored computer. In a set of embodiments, a monitoring process monitors one or more applications for events occurring in those application. The monitoring process, in some cases, runs in common a thread of execution with one or more of the applications. If the monitoring process detects an event, it might notify an event capture process, which might capture the event. In some embodiments, an analysis process might determine whether the event should be collected, and if so, maintain a representation of the event (perhaps in a specialized data structure). In other embodiments, a data management process is configured to store information about one or more events in an event cache, which might comprise a plurality of file streams and/or metafile streams, enabling efficient storage of information about events.

Abstract: Data storage device, system, and method for restricting host access to only one portion of a data storage device includes a storage device having a user space including a plurality of sectors and a plurality of host access spaces each including a corresponding plurality of portions of the plurality of sectors wherein only one of the plurality of host access spaces is accessible at any one time to a host device. A switch selects one of the host access spaces as the active host access space. The method restricts host access to only a portion of a data storage device by dividing a user space on the data storage device into a plurality of host access spaces, selecting one of the plurality of host access spaces as an active host access space, and restricting access by the host device to only the active host access space.

Abstract: Data storage device, system, and method for restricting host access to only one portion of a data storage device includes a storage device having a user space including a plurality of sectors and a plurality of host access spaces each including a corresponding plurality of portions of the plurality of sectors wherein only one of the plurality of host access spaces is accessible at any one time to a host device. A switch selects one of the host access spaces as the active host access space. The method restricts host access to only a portion of a data storage device by dividing a user space on the data storage device into a plurality of host access spaces, selecting one of the plurality of host access spaces as an active host access space, and restricting access by the host device to only the active host access space.

Abstract: The invention provides systems and methods for storing and recovering images in a computer partition, and more particularly to tools and techniques for placing and extracting images to and from the same partition that is imaged. Both a factory image and a user-updateable image may be stored on the same partition. Copies of a portion of the partition data and/or the system data for the imaged partition can be stored at a specified location within the imaged partition, in a separate partition, or on a removable recovery medium, thereby allowing images to be recovered after disruption of the imaged partition's system data. The image may be stored contiguously or non-contiguously. The image may also be stored as a system file or as an image container which comprises one or more than one image file. To speed restoration time and to assist recovery, the image may be stored at or near the end of the partition. Familiar or novel image formats may be used.

Abstract: Methods, systems, and articles of manufacture are provided for manipulating partitions while imaging them to another disk on the same or another computer. By integrating partition manipulations with imaging, the invention reduces data movement. Rather than resizing a source partition in place and then imaging the resized source partition, for instance, one embodiment of the invention leaves the source partition intact and performs resizing on-the-fly by manipulating a memory-resident copy of the source partition's file system structures and then copying the modified structures and corresponding portions of the source user data to the target location. In addition to partition resizing, on-the-fly manipulations possible with the invention include cluster resizing, defragmentation, file relocation, and others. Novel image file formats suitable for on-the-fly manipulations are also described.