Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Abstract: A method includes receiving a plurality of files where each file represents an object. The method further combines selected files of the plurality of files into an aggregation file and stores the aggregation file on low-latency storage media, such as disk storage media. The method represents the aggregation file with a single inode that is stored on the low-latency storage media. The method migrates the aggregate file to high-latency storage media, such as tape storage media, while leaving the single inode representing the aggregation file on the low-latency storage media. By collecting files into larger aggregation files, the number of files archived is significantly reduced and the files archived are of larger size. The reduced number of files and increased size of the files improves archival and retrieval performance due to reduced metadata operation overhead. A corresponding system and computer program product are also disclosed.

Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: A computer-implemented method for operating a storage system comprising a file system for managing a data object in one or more storage blocks may be provided. The method comprising receiving from a file system manager a message indicating that the data objects is to be encrypted, determining, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object, and rendering content of the unallocated storage blocks of the set unreadable.

Abstract: A method includes receiving a plurality of files where each file represents an object. The method further combines selected files of the plurality of files into an aggregation file and stores the aggregation file on low-latency storage media, such as disk storage media. The method represents the aggregation file with a single inode that is stored on the low-latency storage media. The method migrates the aggregate file to high-latency storage media, such as tape storage media, while leaving the single inode representing the aggregation file on the low-latency storage media. By collecting files into larger aggregation files, the number of files archived is significantly reduced and the files archived are of larger size. The reduced number of files and increased size of the files improves archival and retrieval performance due to reduced metadata operation overhead. A corresponding system and computer program product are also disclosed.

Abstract: A method includes receiving a plurality of files where each file represents an object. The method further combines selected files of the plurality of files into an aggregation file and stores the aggregation file on low-latency storage media, such as disk storage media. The method represents the aggregation file with a single inode that is stored on the low-latency storage media. The method migrates the aggregate file to high-latency storage media, such as tape storage media. By collecting files into larger aggregation files, the number of files archived is significantly reduced and the files archived are of larger size. The reduced number of files and increased size of the files improves archival and retrieval performance due to reduced metadata operation overhead. A corresponding system and computer program product are also disclosed.

Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: The disclosure relates to a method for archiving files of a local file system of a client system in a remote storage system. The local file system and the remote storage system are communicatively coupled via a network. The method comprises executing an archive process on an archive computer system communicatively coupled to the network. The archiving is solely controlled by the archive process. The execution causes the archive computer system to receive a configuration comprising share metadata, descriptive of a file share in the local file system, and a network address of the client system; remotely access the local file system using the configuration; scan the files of the file share to identify candidate files for archiving; and archive the candidate files by copying the candidate files to the remote storage system.

Abstract: Operating a data processing and storage apparatus to perform continuous backup monitoring for a collection of stored file system objects. In response to changes respective to a number of the file system objects, a set of Data Management Application Program Interface (DMAPI) events is created. For each of the events, accessory file system object information relative to a file system object subject to the change is determined. The events are grouped into an event group and a unique group identifier and an overall group size count are assigned to each of the events included in the event group. The events are sent together with the respective accessory file system object information, the respective group identifier and the respective group size to a number of backup clients registered as applications. The backup clients are to process the events together with the respective accessory file system object information, the respective group identifier and the respective group size into a number of backup requests.

Abstract: A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Abstract: A computer-implemented method according to one embodiment includes receiving a request to perform a high-latency media (HLM) action on an object or a group of objects, identifying metadata associated with the object or group of objects, and conditionally allowing the HLM action to be performed on the object or group of objects, based on the HLM action and the metadata associated with the object.

Abstract: A computer-implemented method for operating a storage system comprising a file system for managing a data object in one or more storage blocks may be provided. The method comprising receiving from a file system manager a message indicating that the data objects is to be encrypted, determining, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object, and rendering content of the unallocated storage blocks of the set unreadable.

Abstract: A computer-implemented method according to one embodiment includes identifying abnormal data modification characteristics at a first system, determining time data associated with the abnormal data modification characteristics, and adjusting an instance of backup log data stored at a second system, utilizing an identification of the abnormal data modification characteristics and the time data associated with the abnormal data modification characteristics.

Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Abstract: In an approach to maintain data integrity in a computer data storage system, a clone management table is generated for a clone file tree that includes a relationship between at least one parent file and a clone file. The parent file is restored by: (i) determining that the parent-child relationship exists between the parent file and the clone file based on an entry in the clone management table, (ii) restoring data blocks in the parent file to the file system based on an analysis of an entry in the clone management table for the parent file and an identification of data blocks included in the clone file, and (iii) generating a new instance of the parent file based on the data blocks included in the file system and the entry in the clone management table for the clone file tree.

Abstract: Embodiments of systems and methods are provided for data storage in a tiered storage system comprising at least two storage tiers. A method comprises: providing storage information for each storage tier of the storage tiers to a user. The storage information comprising values of storage parameters, wherein the storage parameters comprise at least one of a storage quota limit of the user, usable storage capacity in the tier for the user based on the storage quota limit, and consumed storage capacity of the tier by the user. The storage information is used to move data between the storage tiers.

Abstract: A method for handling snapshots together with migrated files in a hierarchical storage management may be provided. The method comprises managing files using a first-tier storage and a second-tier storage. The files are organized in a managed file system—e.g., a hierarchically managed file system—in the first-tier storage. The method comprises further creating a snapshot of a portion of the files of the first-tier storage, thereby creating a hidden directory in the file system, deleting a migrated file, and moving the stub file relating to the file to be deleted in the first-tier storage to the hidden directory.