Abstract: An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and signatures of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion. The signatures of the storage level logical unit include encoded data of files of the storage level logical unit that are monitored in the point-in-time copy.

Abstract: An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and signatures of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion. The signatures of the storage level logical unit include encoded data of files of the storage level logical unit that are monitored in the point-in-time copy.

Abstract: An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and a signature of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion.

Abstract: An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and a signature of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion.

Abstract: A method for detecting a modification to stored data includes continuously creating a point-in-time copy of a storage level logical unit, the point-in-time copy comprising a volume copy of the storage level logical unit and a signature of the storage level logical unit, comparing at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, and monitoring, based on the comparing, changes on certain logical blocks of the stored data, using the signature of the storage level logical unit.

Abstract: A method for detecting a modification to stored data includes continuously creating a point-in-time copy of a storage level logical unit, the point-in-time copy comprising a volume copy of the storage level logical unit and a signature of the storage level logical unit, comparing at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, and monitoring, based on the comparing, changes on certain logical blocks of the stored data, using the signature of the storage level logical unit.

Abstract: A method (and system) for detecting intrusions to stored data includes creating a point-time-copy of a logical unit, and comparing at least a portion of the point-time-copy with a previous copy of the logical unit. The method (and system) monitors access to a data storage system and detects an intrusion or any other intentional or unintentional, unwanted modification to data stored in the data storage system. The method (and system) also recovers data once an intrusion or other unwanted modification is detected.

Abstract: A computer implemented method, apparatus, and computer usable program product for managing redundant array of independent drives. In response to a failure of a hard disk in a first RAID array, the process calculates an amount of free capacity available across a set of remaining hard disks in the first RAID array. The set of remaining hard disks comprises every hard disk associated with the first RAID array except the failed disk. In response to a determination that the amount of free capacity is sufficient to re-create the first RAID array at a same RAID level, the process reconstructs the first RAID array using an amount of space in the set of remaining drives utilized by the first RAID array and the free capacity to form a new RAID array without utilizing a spare hard disk.

Abstract: A computer implemented method, apparatus, and computer usable program product for managing redundant array of independent drives. In response to a failure of a hard disk in a first RAID array, the process calculates an amount of free capacity available across a set of remaining hard disks in the first RAID array. The set of remaining hard disks comprises every hard disk associated with the first RAID array except the failed disk. In response to a determination that the amount of free capacity is sufficient to re-create the first RAID array at a same RAID level, the process reconstructs the first RAID array using an amount of space in the set of remaining drives utilized by the first RAID array and the free capacity to form a new RAID array without utilizing a spare hard disk.

Abstract: A method (and system) for detecting intrusions to stored data includes creating a point-time-copy of a logical unit, and comparing at least a portion of the point-time-copy with a previous copy of the logical unit. The method (and system) monitors access to a data storage system and detects an intrusion or any other intentional or unintentional, unwanted modification to data stored in the data storage system. The method (and system) also recovers data once an intrusion or other unwanted modification is detected.

Abstract: A method (and system) for detecting intrusions to stored data includes creating a point-time-copy of a logical unit, and comparing at least a portion of the point-time-copy with a previous copy of the logical unit. The method (and system) monitors access to a data storage system and detects an intrusion or any other intentional or unintentional, unwanted modification to data stored in the data storage system. The method (and system) also recovers data once an intrusion or other unwanted modification is detected.

Abstract: A system and method for extracting data from a protected region of memory loads at least a first part of extraction code into physical memory and, thereafter, activates a memory mapping facility that maps a real memory onto the physical memory and prevents programs from accessing a protected memory region of the physical memory. At least a second part of the extraction code is then loaded into the virtual memory utilizing the memory mapping facility. The extraction code is then executed to deactivate the memory mapping facility and to copy data from the protected memory region to a second physical memory region, such that reactivating the memory mapping facility will cause a real memory region to be mapped onto the second physical memory region.