Abstract: Techniques for creating snapshots of a target system are disclosed. In one particular exemplary embodiment, the techniques may be realized as an apparatus for creating snapshots of a target system comprising a module for tracking modifications to a target system after a given time, a module for storing information from the target system in a read-only snapshot and a writable snapshot, and a module for modifying the writable snapshot after the given time.

Abstract: Methods for utilizing a locality table when performing data deduplication are disclosed. One method involves accessing a locality table stored in memory. The locality table includes several signatures, each of which identifies one of a several data units that were consecutively added to a deduplicated data store on a persistent storage device. The method then involves searching the locality table for a new signature of a new data unit, in order to determine whether a copy of the new data unit is already present in the deduplicated data store. If the new signature is not found in the locality table, a pointer table is accessed. The pointer table indicates a subset of a set of signatures stored on the persistent storage device. In response to accessing the pointer table, the subset of the set of signatures, indicated by the pointer table, is searched for the new signature.

Abstract: A method and apparatus for performing file-level restoration from a block-based backup file stored on a sequential storage device is described. In one embodiment, a method of processing a backup file to perform file-level restoration from a sequential storage device comprises generating extent information, wherein the extent information pertains to at least one file system object associated with a backup file, wherein the backup file is to be stored on a sequential storage device, wherein the backup file is block-based and processing a backup catalog, wherein the backup catalog indicates locations of various portions of the extent information and is used to restore a file system object.

Abstract: A first write operation is intercepted. The first write operation is a write from a virtual machine to a virtual disk. The first write operation is a change to a first data location. The change to the first data location is recorded. The recording creates a first change record. The first change record is stored separately from the first data location. A first backup operation is performed. The first backup operation, the intercepting, and the recording are performed by an application executing on a host of the virtual machine. The first backup operation includes a read request for the first data location. The read request for the first data location is fulfilled based on the first change record.

Abstract: A computer-implemented method for change tracking with multiple backup jobs may include identifying a plurality of overlapping backup jobs to be performed on a volume. The computer-implemented method may also include identifying snapshots taken for any of the plurality of overlapping backup jobs. The computer-implemented method may further include, for each consecutive pair of identified snapshots, identifying changes made to the volume between the consecutive pair of identified snapshots and saving a list of the changes. The computer-implemented method may additionally include supplying the list of changes for each backup job in the plurality of overlapping backup jobs that requires the list of changes. The computer-implemented method may also include determining that no remaining backup job in the plurality of overlapping jobs requires the list of changes and deleting the list of changes. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A system and method for creating a backup image from a volume including a plurality of files are described. Information specifying a subset of the files, but not all of the files, to backup may be received. The volume may include a plurality of blocks, where the plurality of blocks includes a respective set of data blocks for each file of the volume and blocks of file system metadata structures for the volume. The method may comprise identifying a subset of, but not all of, the plurality of blocks to copy into the backup image. The subset of blocks may include each data block for each file of the subset of files, and may also include blocks of one or more file system metadata structures needed for accessing the subset of files. The method may further comprise copying each block of the subset of blocks into the backup image. In some embodiments the subset of blocks may be copied into the backup image without copying data blocks for files not in the specified subset of files.

Abstract: Methods are provided for detecting the processing status of data blocks in systems having intermittent connections. A hash value is used at times in place of a block's data content, thereby reducing processing of the block. Hash values may be maintained locally. Blocks collected locally may be stored locally at least until a connection to a server becomes available again. Systems and configured storage media are also provided.

Abstract: A computer-implemented method for tracking changes to a volume is disclosed. The method may comprise: 1) identifying a first snapshot of a volume, 2) identifying a window within which the first snapshot was created, the window beginning with a first point known to have occurred before the first snapshot and ending with a second point known to have occurred after the first snapshot, 3) identifying at least one change to the volume that occurred within the window, and 4) associating the at least one change that occurred within the window with both the first snapshot and a second snapshot created after the first snapshot. Corresponding systems and computer-readable media are also disclosed.

Abstract: Embodiments of the present invention are directed to the running of a virtual machine directly from a physical machine using snapshots of the physical machine. In one example, a computer system performs a method for running a virtual machine directly from a physical machine using snapshots of the physical machine. A snapshot component takes a snapshot of the physical system volume while the physical system volume is in an operational state. The virtual machine initializes using the physical system volume snapshot thereby allowing the physical system volume snapshot to be a virtual system volume snapshot representing an initial state of a virtual system volume. The physical system volume snapshot includes instances of all the files within the physical system volume at the time the snapshot was taken.

Abstract: Methods and systems that use a client locality table when performing client-side data deduplication are disclosed. One method involves searching one or more client locality tables for the signature of a data unit (e.g., a portion of a volume or file). The client locality tables include signatures of data units stored in a deduplicated data store. If the signature is not found in the client locality tables, the signature is sent from a deduplication client to a deduplication server and added to one of the client locality tables. If instead the signature is found in the client locality tables, sending of the new signature to the deduplication server is inhibited.

Abstract: Embodiments of the present invention are directed to the running of a virtual machine directly from a physical machine using snapshots of the physical machine. In one example, a computer system performs a method for running a virtual machine directly from a physical machine using snapshots of the physical machine. A snapshot component takes a snapshot of the physical system volume while the physical system volume is in an operational state. The virtual machine initializes using the physical system volume snapshot thereby allowing the physical system volume snapshot to be a virtual system volume snapshot representing an initial state of a virtual system volume. The physical system volume snapshot includes instances of all the files within the physical system volume at the time the snapshot was taken.

Abstract: Tracking of memory block relocation when write occur to memory blocks. After detecting a write operation to be performed on a particular target memory block, it is identified whether the write operation is due to a relocation of data from another memory block. Depending at least in part on this result, the modified data may not need to be included in a subsequent incremental backup. If appropriate, relocation data is included instead. This may potentially reduce the size of the incremental backup, especially in cases in which there were many memory block movements since the last backup, as is the case with defragmentation.

Abstract: Defragmentation of a file system. Multiple files within the file system may be fully or partially defragmented with respect to the physical storage system containing the physical file system. The defragmented files include at least one file that represents a virtual storage system. That virtual storage system file contains a number of sub-files that represent files (i.e., virtual files) of the virtual storage system. These virtual files are not files managed by the physical file system, but are files recognized by a virtual file system managed by a virtual machine running on the physical machine. The defragmentation of the virtual files occurs using knowledge of the unordered nature of the allocation segments that make up the virtual storage system file. Accordingly, after defragmentation, the files of the physical file system and the virtual file system are more defragmented with respect to the physical storage system, while not requiring a shut down of the virtual file system.

Abstract: Methods are provided for detecting the processing status of data blocks. A hash value is used at times in place of a block's data content, thereby reducing processing of the block. Superblocks and superblock hash values are used to manage collisions between hash values of individual blocks, in order to reduce or eliminate the risk that blocks having different content will be treated as though they have the same content merely because they have the same hash value. Systems and configured storage media are also provided.

Abstract: A computing system configured to detect and/or remove a rootkit. For detection, a snapshot component takes a snapshot of a storage unit. A rootkit detection component accesses an enumeration of individual files stored on the storage unit using an alternative file system I/O to detect the presence of a rootkit. For removal, the location of a rootkit is identified and a computing system shutdown is initiated. A snapshot component pauses the shutdown operation prior to the completion of the shut down and takes a snapshot of a file storage unit. A rootkit repair component accesses the identified location of the portion of the file storage unit containing the rootkit and modifies the portion of the snapshot of the file storage unit so as remove the rootkit.

Abstract: A computer-implemented method for tracking changes to a volume is disclosed. The method may comprise: 1) identifying a first snapshot of a volume, 2) identifying a window within which the first snapshot was created, the window beginning with a first point known to have occurred before the first snapshot and ending with a second point known to have occurred after the first snapshot, 3) identifying at least one change to the volume that occurred within the window, and 4) associating the at least one change that occurred within the window with both the first snapshot and a second snapshot created after the first snapshot. Corresponding systems and computer-readable media are also disclosed.

Abstract: Methods are provided for detecting the processing status of data blocks in systems having intermittent connections. A hash value is used at times in place of a block's data content, thereby reducing processing of the block. Hash values may be maintained locally. Blocks collected locally may be stored locally at least until a connection to a server becomes available again. Systems and configured storage media are also provided.

Abstract: Mechanisms for backing up at least a portion of storage at a primary computing system to a backup computing system. The primary system identifies primary memory block(s) that have altered content since the time of a last backup. For each such primary block, the primary system estimates whether or not the altered content of the primary block is the same as content of another primary block as the content existed at the time of a specific backup. If they are the same, the primary system backs up the corresponding block by simply informing the backup system of the matching content, and having the backup system write the matching content of other backup block over the respective backup block, rather than transferring the entire block contents.

Abstract: Mechanisms for efficiently restoring one or more memory blocks of a primary computing system. In order to restore a backup memory block, the primary system accesses transformed data that represents a result of a deterministic many-to-one mapping function, such as a hash function, applied to the backup memory block. The primary computing system also accesses transformed data that represents a result of the deterministic many-to-one mapping function applied to a corresponding primary memory block as the memory block exists on the primary system. The primary transformed data and the backup transformed data are then compared. If the primary and backup transformed data are different, the corresponding primary and backup memory blocks are also different. Accordingly, the primary computing system requests the full memory block from the backup computing system.

Abstract: Embodiments of the present invention are directed to the running of a virtual machine directly from a physical machine using snapshots of the physical machine. In one example, a computer system performs a method for running a virtual machine directly from a physical machine using snapshots of the physical machine. A snapshot component takes a snapshot of the physical system volume while the physical system volume is in an operational state. The virtual machine initializes using the physical system volume snapshot thereby allowing the physical system volume snapshot to be a virtual system volume snapshot representing an initial state of a virtual system volume. The physical system volume snapshot includes instances of all the files within the physical system volume at the time the snapshot was taken.