Abstract: In some examples, a replication manager detects changed data caused by an input/output (I/O) operation, where the replication manager is to replicate data writes of I/O operations to a storage system. A classifier classifies the changed data to identify a sensitivity of the changed data. A system determines, based on the identified sensitivity of the changed data, an access control rule for a data object comprising the changed data. The system performs access control of the data object based on the determined access control rule.

Abstract: In some examples, a system identifies, from among a plurality of input/output (I/O) operations with a storage system, a subset of I/O operations involving encrypted data segments of a given data size. The system computes a measure based on a quantity of the I/O operations in the subset of I/O operations involving the encrypted data segments of the given data size. Based on the measure, the system determines whether an intermittent encryption attack is occurring with respect to the storage system.

Abstract: Example implementations relate to data storage. An example includes inspecting a block level input/output (I/O) request to be executed by a block-based storage device, and in response to a determination that the block level I/O request includes a filesystem operation, generating a copy of the block level I/O request. The example also includes parsing the copy of the block level I/O request to extract a plurality of attributes of the filesystem operation, where the parsing is asynchronous to an execution of the block level I/O request by the block-based storage device. The example also includes storing the extracted plurality of attributes of the filesystem operation in an entry of a filesystem operation database, where each entry of the filesystem operation database is associated with a different filesystem operation in a filesystem stored on the block-based storage device.

Abstract: Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.

Abstract: Example implementations relate to data storage. An example includes inspecting a block level input/output (I/O) request to be executed by a block-based storage device, and in response to a determination that the block level I/O request includes a filesystem operation, generating a copy of the block level I/O request. The example also includes parsing the copy of the block level I/O request to extract a plurality of attributes of the filesystem operation, where the parsing is asynchronous to an execution of the block level I/O request by the block-based storage device. The example also includes storing the extracted plurality of attributes of the filesystem operation in an entry of a filesystem operation database, where each entry of the filesystem operation database is associated with a different filesystem operation in a filesystem stored on the block-based storage device.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: An enterprise disaster recovery system, including at least one data disk, a processor for running at least one data application that reads data from the at least one data disk and writes data to the at least one data disk over a period of time, a recovery test engine that (i) generates in parallel a plurality of processing stacks corresponding to a respective plurality of previous points in time within the period of time, each stack operative to process a command to read data at a designated address from a designated one of the at least one data disk and return data at the designated address in an image of the designated data disk at the previous point in time corresponding to the stack, and (ii) that generates in parallel a plurality of logs of commands issued by the at least one data application to write data into designated addresses of designated ones of the plurality of data disks, each log corresponding to a respective previous point in time, wherein the plurality of previous points in time within the p

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A data center for data backup and replication, including a pool of multiple storage units for storing a journal of I/O write commands issued at respective times, wherein the journal spans a history window of a pre-specified time length, and a journal manager for dynamically allocating more storage units for storing the journal as the journal size increases, and for dynamically releasing storage units as the journal size decreases.

Abstract: An embodiment may simulate a block storage system on an object storage system. An embodiment may define one or more logical parts of the block storage system and may store data included in the logical parts in a respective plurality of objects in the object storage system. In order to modify a simulation when data in the block storage system is modified, an embodiment may create a new object in the object storage system and may store the modified data in the new object. An embodiment may update a range-map to include at least one of: a reference to the new object, a logical address of the modified data, a size of the modified data and a counter.