Abstract: Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A system and method for protecting data in a protected storage system. A replication of the protected storage system at a predetermined time point is stored in an object-based storage in replicated content objects of a target disk. Information related to a write operation in the protected storage system is obtained, the information including: data stored on the protected storage system and metadata related to the stored data. A journal is maintained by: including a copy of the stored data in a content entry in one or more journal content objects, including at least some of the metadata in a metadata entry in one or more metadata objects, storing the journal content objects and metadata objects in the object-based storage, and associating the metadata entry with the content entry. The data received before a predetermined time window is periodically moved from the journal to the target disk.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: In a system comprising a production environment and a replication environment, a method and program product for dynamically switching from an asynchronous replication policy to a synchronous replication policy. In a system comprising a production environment and a replication environment, a method for dynamically switching from a synchronous replication policy to an asynchronous replication policy.

Abstract: A system and method for generating incremental backups for a protected storage system may include storing in a journal data and metadata related to modification of data in the protected storage system and marking, in a memory changed block tracking (CBT) object, storage units that were modified on the protected storage system. A system and method may store a copy of a CBT object in a storage system to produce a stored CBT object. A stored CBT object may be loaded into memory to produce a memory CBT object. A CBT object may be used to identify storage units to be included in an incremental backup.

Abstract: A system and method for generating incremental backups for a protected storage system may include storing in a journal data and metadata related to modification of data in the protected storage system and marking, in a memory changed block tracking (CBT) object, storage units that were modified on the protected storage system. A system and method may store a copy of a CBT object in a storage system to produce a stored CBT object. A stored CBT object may be loaded into memory to produce a memory CBT object. A CBT object may be used to identify storage units to be included in an incremental backup.

Abstract: A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.

Abstract: A system and method for protecting data in a protected storage system. A replication of the protected storage system at a predetermined time point is stored in an object-based storage in replicated content objects of a target disk. Information related to a write operation in the protected storage system is obtained, the information including: data stored on the protected storage system and metadata related to the stored data. A journal is maintained by: including a copy of the stored data in a content entry in one or more journal content objects, including at least some of the metadata in a metadata entry in one or more metadata objects, storing the journal content objects and metadata objects in the object-based storage, and associating the metadata entry with the content entry. The data received before a predetermined time window is periodically moved from the journal to the target disk.

Abstract: A system and method for generating backups of a protected storage system from protected data in a recovery system including protecting data in the recovery system, the recovery system including a target disk configured to store a replica of the protected storage system from a predetermined time point and a journal including data and metadata of write operations to the protected storage system that occurred after the time point, periodically generating replicas of the protected storage system from the recovery system, and storing the replicas as backups.

Abstract: A hypervisor virtual server system, including a plurality of virtual servers, a plurality of virtual disks that are read from and written to by the plurality of virtual servers, a physical disk, an I/O backend coupled with the physical disk and in communication with the plurality of virtual disks, which reads from and writes to the physical disk, a tapping driver in communication with the plurality of virtual servers, which intercepts I/O requests made by any one of said plurality of virtual servers to any one of said plurality of virtual disks, and a virtual data services appliance, in communication with the tapping driver, which receives the intercepted I/O write requests from the tapping driver, and that provides data services based thereon.

Abstract: A method, system, and program product for use in a data replication environment, the data replication environment comprising a plurality of data protection appliances, each data protection appliance of the plurality of data protection appliances comprising a journal, the method comprising creating a virtual consistency group comprising a virtual journal; wherein the virtual consistency group is configured to replicate a production volume, dividing the virtual consistency group into segments; wherein each segment corresponds to a portion of the production volume and a portion of the virtual journal, and assigning each data protection appliance of the plurality of data protection appliances a segment of the virtual consistency group.

Abstract: A hypervisor virtual server system, including a plurality of virtual servers, a plurality of virtual disks that are read from and written to by the plurality of virtual servers, a physical disk, an I/O backend coupled with the physical disk and in communication with the plurality of virtual disks, which reads from and writes to the physical disk, a tapping driver in communication with the plurality of virtual servers, which intercepts I/O requests made by any one of said plurality of virtual servers to any one of said plurality of virtual disks, and a virtual data services appliance, in communication with the tapping driver, which receives the intercepted I/O write requests from the tapping driver, and that provides data services based thereon.

Abstract: In a system comprising a production environment and a replication environment, a method and program product for dynamically switching from an asynchronous replication policy to a synchronous replication policy. In a system comprising a production environment and a replication environment, a method for dynamically switching from a synchronous replication policy to an asynchronous replication policy.

Abstract: A method, system, and program product for use in a data replication environment, the data replication environment comprising a plurality of data protection appliances, each data protection appliance of the plurality of data protection appliances comprising a journal, the method comprising creating a virtual consistency group comprising a virtual journal; wherein the virtual consistency group is configured to replicate a production volume, dividing the virtual consistency group into segments; wherein each segment corresponds to a portion of the production volume and a portion of the virtual journal, and assigning each data protection appliance of the plurality of data protection appliances a segment of the virtual consistency group.

Abstract: In one aspect, a method to replicate data includes determining if an I/O data block from a journal is generated by a replication initialization process; if the I/O data block from a journal is generated by the replication initialization process, determining if the I/O data block from the journal comprises zero data; if the I/O data block from the journal comprises the zero data, reading an I/O data block in a volume; and determining if the I/O data block from the volume comprises zero data. The method also includes, if the I/O data block from the volume comprises zero data, bypassing writing the I/O data block from the journal to the I/O data block in the volume.

Abstract: Methods and apparatus for a continuous data protection system including replication and journaling, to detect a first problem, react to the first problem, recover from the first problem, determine whether to enter a regulation state due to repetition of the first problem, enter the regulation state, and maintain the regulation state after detecting the first problem again.

Abstract: Method and apparatus for data access, including for a host device designated as Device A within a host computer, the host device corresponding to a first logical storage unit designated as LUN A, where LUN A is configured to access data directly from a physical storage system, assigning a second logical storage unit, designated as LUN X, wherein LUN X is configured to access the storage system indirectly via a data protection computer, providing the data protection computer access to a data structure that is able to recover data that was stored in the storage system at an earlier point in time, T1, and in response to a request from the host computer for data that was stored in the storage system at time T1, switching Device A to get its data from LUN X instead of from LUN A. A data access system and a computer-readable storage medium are also described and claimed.

Abstract: Methods and systems for continuous data replication, including receiving a write transaction from a production site, the write transaction including raw data (RWNEW), a size indicator (SZ1) for the size of the raw data, and a start address (ADD1) for writing the raw data, copying the raw data (RWNEW) into a first journal data stream at a current journal address (JADD1), and copying the size indicator (SZ1), the start address (ADD1) and the journal address (JADD1) into a first journal meta-data stream.