Abstract: The retention lock (RL) status for a backup file stored in a storage target is certified by obtaining the RL status and encrypting it using an encryption key process to create a certified RL status. Verification logs are kept by appending the time of certification to a new token that can be audited. Each time a certification is attempted, a log corresponding to the latest attempt and the latest timestamp is added to the end of the verification list. This verification log may be implemented through a verification timestamp is appended to the token, or a verification log that is its own token. The verification log is maintained in a backup system and made available to an auditor for review of the certified RL status of the locked files.

Abstract: The retention lock (RL) status for a backup file stored in a storage target is certified by obtaining the RL status and encrypting it using an encryption key process to create a certified RL status. This signs the RL status by the entity storing the backup file, rather than an application setting the retention lock. The certified RL status is provided as a token to backup software of a deduplication backup system, wherein it can be made available for inspection and audit. The data may include opaque data that is data not interpreted by the filesystem. The request for RL status includes the opaque data, which is returned as part of the response, and which can be returned in part as cleartext.

Abstract: The retention lock status for a backup file stored in a storage target of a deduplication backup is certified by obtaining the retention lock status and encrypting, in the storage target, the retention lock status information using an encryption key process to create a certified retention lock status. This signs retention lock status by the entity storing the backup file, rather than an application setting the retention lock. The certified retention lock status is provided as a token to a backup software of the deduplication backup system, wherein the retention lock status information is made available for inspection and audit. It is then returned, in response to an audit request, for comparison against a cleartext representation of changes to retention lock status.

Abstract: One example method includes generating first and second snapshots of a shared protection namespace of a backup storage device. The first snapshot includes a first working frozen copy of an active namespace and the second snapshot includes a second work working frozen copy of the active namespace. First and second point-in-time copies of the first and second working frozen copies are generated in the shared protection namespace. The first point-in-time copy includes first files extracted from the first working frozen copy and that are stacked in at least one first horizontal file. The second point-in-time copy includes the second files included in the second working frozen copy that are stacked in at least one second horizontal file. A retention lock is applied to the at least one first and second horizontal files.

Abstract: Disclosed is a storage system comprising: receiving a first data segment and first metadata associated with the first data segment to be stored in the storage system; storing the first data segment and the first metadata in a persistent storage device of the storage system; compressing the first data segment using a predetermined compression algorithm to generate a first compressed data segment; and storing the first metadata and the first compressed data segment in a solid state drive (SSD) cache device of the storage system, including aligning the first metadata and the first compressed data segment to a page boundary of the SSD device to reduce a number of input and output (IO) operations required for accessing the first metadata and the first compressed data segment from the SSD cache device.

Abstract: A method of blocking access to files encrypted with a compromised key by mapping keys and ranges of containers encrypted by the keys. Upon notification that a key is compromised, fencing a container range corresponding to data segments encrypted by the compromised key to prevent deduplication operations on the segments. The method makes a point-in-time copy of the filesystem managing the segments, wherein each file of the file system is represented as tree structure having a root level and other levels. The method iteratively inspects in a level-wise manner, each container in each level of the file trees of the files to identify containers having segments encrypted by the compromised key, and marks files corresponding to the identified containers as not readable to block the access to the files encrypted with the compromised key.

Abstract: One example method includes generating first and second snapshots of a shared protection namespace of a backup storage device. The first snapshot includes a first working frozen copy of an active namespace and the second snapshot includes a second work working frozen copy of the active namespace. The first snapshot is converted into a first data-less snapshot. A snapshot difference operation is preformed between the first data-less snapshot and the second snapshot. First and second point-in-time copies of the first and second working frozen copies are generated in the shared protection namespace. The first point-in-time copy includes the first files extracted from the first working frozen copy and stacked in at least one first horizontal file. The second point-in-time copy includes the second files stacked in at least one second horizontal file. A retention lock is applied to the at least one first and second horizontal files.

Abstract: Improving read performance using pre-fetches by encoding an extent map identifying valid data of the file as extents that may be interspersed with holes constituting invalid data, and storing the extent map in the client. The extent map generates pre-fetches of data that land on only extents of the file and avoids the holes, by one of: transferring, upon the read request, the extent map to a filesystem storing the file, and bringing the extents from the extent map into memory ahead of the read request; or using, in the network client, the extent map to generate prefetch requests and execute read-ahead operations on the filesystem. The method may also apply where the application only wants to read what has changed since the last backup. In this case, the application has a map of what has changed, and can choose to read just the right extents.

Abstract: A retention lock report generation process that creates, upon deployment of a backup server in the backup system, a hidden directory structure in local storage of the backup server. Upon retention locking of a file, the process writes details of the file and lock operation to a retention lock audit (RLA) log in the form of a timestamped RLA log file. The RLA log is then stored in the hidden directory structure in the filesystem, and maintained as a rotating log containing only a latest timestamped RLA log file. Previous RLA log files are retention locked and stored differently from the RLA log. In response to a request, the RLA log and the retention lock settings for the locked files including the previous RLA log files are provided to the user, without requiring traversal of the entire filesystem as in present retention lock reporting methods.

Abstract: A retention lock report generation process creates, upon deployment of a backup server in the backup system, a hidden directory structure in local storage of the backup server. Upon retention locking (RL) of a file, the process writes details of the file and lock operation to a retention lock audit (RLA) log. The RLA log is stored in the hidden directory structure in the filesystem, and maintained as a rotating log containing only a latest timestamped RLA log file. Previous RLA log files are retention locked and stored differently from the RLA log. In a cascaded storage target system, a plurality of targets store copies of the sourced data. RLA log information is generated for locked files at each target for new lock attributes and lock state changes as propagated through the targets for both replication and back replication operations.

Abstract: Improving the performance of read operations in a restore path of a backup system by adaptively applying compression. The method defines an extent covering data segments for which compression ratio statistics are calculated, and calculates a respective compression ratio for each data segment in the defined extent. It then associates each unique compression ratio with a corresponding index value and stores each compression ratio and associated corresponding index value in an array. The array is appended as extended file attribute to the data segments, the indexed compression ratio is used by a backup server to determine whether or not to apply compression to the data segments in a restore path sending the data segments from the backup server.

Abstract: One example method includes accessing a point-in-time copy including retention locked backups that were stored on a backup storage server at a time the point-in-time copy was generated. The method further includes accessing a current namespace including retention locked backups that are currently stored on the backup storage server. Each retention locked backup includes data backup files. The method also includes determining a first set of retention locked backups that are included in the point-in-time copy, but are not included in the current namespace. The method finally includes copying the first set of retention locked backups from the point-in-time copy into the current namespace without removing any of the retention locked backups already in the current namespace.

Abstract: During a current backup of a file system of a client, a determination is that a file in the current backup includes first data regions found in a file from a previous backup, and second data regions that are new. A virtual synthetic file is generated by writing the second data regions, and synthesizing the first data regions by referencing the file from the previous backup. A request received to restore the particular file includes identifications of other files still present at client. A determination is that the particular file corresponds to the virtual synthetic file and that the other files still present at client include the file from the previous backup. The second data regions are read to send to client. A complete version of the particular file is assembled at client using the file from the previous backup, still present at client, and the second data regions.

Abstract: Corruption detection in backups is disclosed. Backups that are received into a backup environment are stored in corresponding lineages. A detection engine is configured to perform corruption detection operations on the most recent backups in each of the lineages based on a sample frequency. Corruption detection operations may also be performed randomly and based on unexpected or unusual changes in backup metadata.

Abstract: One example method includes creating a namespace of a deduplication filesystem, adding a ‘temporary’ flag to the namespace, adding a ‘delete’ flag to the namespace when the namespace is to be deleted, and when a maximum number of namespaces permitted by the deduplication filesystem has been reached due to the creating of the namespace, deleting another namespace bearing a ‘temporary’ flag and a ‘delete’ flag. In this way, efficient use may be made of the NVRAM, while also maintaining compliance with deduplication filesystem requirements concerning the maximum number of permitted namespaces.

Abstract: Improving the performance of read operations in a restore path of an inline deduplication system utilizing a DDBOOST interface by providing an adaptive compression component for use with DDBOOST applications. A built-in compression mode transfers read data if there are sufficient CPU resources in the server and client to compress and decompress the read data without destabilizing the system. CPU usage is tracked to generate predicted respective client and server CPU usage. These respective predictions are compared to defined maximum threshold usage values. If the predicted values do not exceed the thresholds, compression is used, otherwise the data is transmitted over the network as non-compressed data. A pre-filter is used to first determine whether or not the data would benefit from the built-in compression mode.

Abstract: A self-healing method of recovering files using a cyber recovery vault for deduplication filesystems. Data to be backed up from a production system to a backup system in a datacenter is also copied to a cyber security vault coupled to the data center through an air gapped connection. A copy process makes a point-in-time (PIT) copy of the portion of data to a namespace in the vault, and retention locks the copied portion in the vault. An automated process detects a missing segment error, such as due to a bad index lookup in the data to be backed up. The self-healing process provides the missing segment from the PIT copy in the cyber security vault. For any missing fingerprints the process adds the data in new containers and the references in the index, providing an indirection that allows for just writing a new container with the missing L0 references and updating the index.

Abstract: System audits messages, communicated internally in copy management system, about copy management jobs, and learns about relationships between message requests for user actions on copy management jobs and subsequent failures of copy management jobs. System creates snapshot of copy management content displayed by user interface and selected by user as context for user's message, and creates message's link to snapshot. System stores user entries that identify message's intended recipient(s), time of availability, and text. If message requests user action on copy management job, and relationship between unanswered requests for user to perform action on copy management job and subsequent failures of copy management job satisfies relationship threshold, then machine learning system sends message via copy management system's internal communication channel to system-selected administrator, who selects message's hyperlink to snapshot.

Abstract: System determines first context of messages between copy management system users and creates snapshot of copy management content part, which is displayed by user interface, and selected by system user as context for subsequent message. System creates hyperlink in message to snapshot that depicts copy management content part and stores user entries for tag that identifies at least one intended recipient of message, time when message is available for intended recipient(s), and text for message. System sends message at time to intended recipient(s) via internal communication channel of system. In response to recipient of message selecting message's hyperlink to snapshot, system outputs context for message to recipient's user interface, which enables recipient to respond to message. If second context of messages between copy management system users matches first context of messages, then information requested in message after first context of messages is conveyed to at least one user interface.

Abstract: Methods of cloning data backup across namespaces are disclosed. In response to receiving a file replication request, one or more source files are cloned from a first namespace to a second namespace, as one or more destination files. A first attribute indicating that the source file(s) have been cloned to the second namespace as the destination file(s) is created. A source synthetic file is cloned from the first namespace to the second namespace, as a destination synthetic file, where synthetic information of the destination synthetic file points to the source file(s) as one or more base file. A second attribute indicating that the source synthetic file has been cloned to the second namespace as the destination synthetic file is created. Based on the first and second attributes, the synthetic information of the destination synthetic file is updated or propagated to use the destination file(s) as one or more base files on the second namespace.