Abstract: Solutions for rapid ransomware detection and recovery include: receiving a first set of in-memory changed data blocks; identifying, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk; determining, relative to a change history of the file index, an anomalous condition; based on at least determining the anomalous condition, identifying a third set of blocks within the file index that are changed between two versions of the VM disk; determining that changes in the third set of blocks indicate ransomware; and based on at least determining that changes in the third set of blocks indicate ransomware, generating an alert. Machine learning (ML) models may perform anomaly/ransomware detection. Remediation activities may include disk restoration storing the VM memory.

Abstract: A system and method are disclosed for managing snapshots of a file system. In accordance with one implementation, the method includes receiving, by a processing device, a request to access a snapshot of a file system and in response to determining that the requested snapshot is active, providing, to the user account, access to the requested snapshot. The method also includes in response to determining that the requested snapshot is inactive: activating the requested snapshot, providing to the user account, after the activating, access to the requested snapshot; and in response to determining, after the activating, that a number of active snapshots exceeds a threshold number of active snapshots, selecting an active snapshot and deactivating the selected active snapshot, wherein the threshold number of active snapshots corresponds to a limit on resources of the file system that are devoted to active snapshots.

Abstract: A system and method are disclosed for managing snapshots of a file system. In accordance with one implementation, the method includes receiving, by a processing device, a request to access a snapshot of a file system and in response to determining that the requested snapshot is active, providing, to the user account, access to the requested snapshot. The method also includes in response to determining that the requested snapshot is inactive: activating the requested snapshot, providing to the user account, after the activating, access to the requested snapshot; and in response to determining, after the activating, that a number of active snapshots exceeds a threshold number of active snapshots, selecting an active snapshot and deactivating the selected active snapshot, wherein the threshold number of active snapshots corresponds to a limit on resources of the file system that are devoted to active snapshots.

Abstract: A system and method are disclosed for managing snapshots of a distributed file system. In accordance with one implementation, a list of snapshots of a file system is presented to a user, where the snapshots include one or more active snapshots and one or more inactive snapshots. A request by the user to access one of the snapshots in the list is received. In response to determining that the requested snapshot is active, the user is provided access to the requested snapshot. In response to determining that the requested snapshot is inactive, the requested snapshot is activated and the user is provided access to the requested snapshot.

Abstract: A system and method are disclosed for managing snapshots of a distributed file system. In accordance with one implementation, a list of snapshots of a file system is presented to a user, where the snapshots include one or more active snapshots and one or more inactive snapshots. A request by the user to access one of the snapshots in the list is received. In response to determining that the requested snapshot is active, the user is provided access to the requested snapshot. In response to determining that the requested snapshot is inactive, the requested snapshot is activated and the user is provided access to the requested snapshot.