Abstract: The subject matter of this specification can be implemented in, among other things, a method that includes receiving, from within a guest operating system hosted by a host operating system at a computer system, requests to access sparse files within a guest file system of the guest operating system. The sparse files each correspond to an external data file outside the guest file system. Each of the requests to access the sparse files within the guest file system is directed to the corresponding external data file outside the guest file system. The method includes identifying a frequency with which each of the sparse files is accessed. The method includes moving an external data file from a first type of storage device to a second type of storage device based on the frequency with which the external data file is accessed relative to others of the external data files.

Abstract: The subject matter of this specification can be implemented in, among other things, a method that includes receiving, from within a guest operating system, a request to create a data file in a guest file system of the guest operating system. The method further includes in response to the receipt of the request to create the data file, creating an external data file in a first storage device for a file system outside the guest file system, creating a sparse file in the guest file system, and storing metadata that directs requests to access the sparse file from within the guest operating system to the external data file in the first storage device.

Abstract: A system and method is provided for accessing secure files by local client devices. An exemplary method comprises receiving an access request to access an encrypted file on a client device, in response to the access request, transmitting a decryption request to decrypt a remote processing portion of a block of the encrypted file, receiving, in response to the decryption request, the decrypted remote processing portion of the block of the encrypted file, and receiving a local decryption key and applying the local decryption key to decrypt one or more local portions of the block of the encrypted file to obtain a fully decrypted block of the encrypted file.

Abstract: A system and method is provided for secure file access by local client devices. An exemplary method includes receiving an identifier of a data block and a first portion of the data block from a client device, encrypting, with a master encryption key, the first portion of the data block, transmitting, by the server, a generated encryption key and the encrypted first portion of the data block to the client device to be stored locally in memory of the client device, wherein the generated encryption key is based on the master encryption key and the identifier and causing the client device to encrypt a second portion of the data block using the generated encryption key, and causing the client device to store the encrypted second portion of the data block in the memory of the client device.

Abstract: A system and method is provided for secure file and document management and editing by local client devices. An exemplary method includes receiving by a server, an identifier of a data block and a portion of the data block from a client device, encrypting the first portion of the data block, and generating an encryption key based on the identifier of the data block. The method further includes transmitting, by the server, the encrypted first portion of the data block to the client device to be stored locally in memory of the client device, and causing a second portion of the data block to be encrypted by the client device using the encryption key. A as result, the encrypted second portion of the data block can be stored in the memory of the client device in connection with the encrypted first portion of the data block.

Abstract: A method of incremental backup of a storage device includes reading descriptors of logical storage units of the storage device; comparing the descriptors of the logical storage units of the storage device with descriptors of archived logical storage units; for logical storage units of the storage device whose descriptors are not identical to the descriptors of the archived logical storage units, backing up contents of physical storage units that correspond to those logical storage units of the storage device; and, for logical storage units of the storage device whose descriptors are identical, performing a comparison step to check if these logical storage units need to be backed up. The logical storage units can be files. The comparison step can be, e.g., (1) bit-wise comparison of the logical blocks, (2) comparing control sums of the logical blocks, and (3) comparing log files relating to the logical storage units The physical storage units can be blocks. The descriptors can be, e.g.

Abstract: A method of restoring a storage device includes creating an image of the storage device of a computer system; during execution of a boot loader, starting an initialization application that at least partially restores to the storage device, operating system data from the image; modifying a disk driver of the operating system to form a driver that redirects unexecutable storage device read requests to the image; rebooting the computer system using the at least partially restored operating system data; and restoring unaltered portions of remaining data from the image as a background process.

Abstract: A system for data backup includes a storage device, a backup storage device, and an intermediate storage device. Backup procedure is performed on-line and copies data blocks from the storage device into the backup storage device. When a write command is directed to a data storage block identified for backup that has not yet been backed up, the identified data storage block is copied from the storage device to the intermediate storage device, the write command is executed on the identified data storage block from the storage device, and the data storage block is copied from the intermediate storage device to the backup storage device. In case of an error accessing a block on the storage device, the block is marked as invalid. The intermediate storage device can be external to a file system of a computer that includes the storage device, or can be located in the storage device, or can be a separate partition of the storage device, or can be a file within a file system.