Abstract: A method, article of manufacture, and apparatus for efficiently restoring a target system are disclosed. In some embodiments, a set of computer systems to be restored to a common state is determined. An image is then created from a computer system from the set of computer systems. A profile is generated from each of the computer systems in the set of computer systems. A profile is associated with the image. The profiles and images are then stored in a storage device. The image may be modified. In some embodiments, software components are removed from the image. In some embodiments, software components are added to the image.

Abstract: A method, article of manufacture, and apparatus for efficiently restoring a target system are disclosed. In some embodiments, a target is analyzed. A target profile is created based on the analysis. The target profile is then compared to a source profile. A profile difference is generated based on the comparison. The source image is modified based on the profile difference, and the modified image is then stored on the target. In some embodiments, modifying the source image may include removing or adding software components.

Abstract: A method, article of manufacture, and apparatus for backing up or archiving objects from a first location to a second location, comprising determining the objects to be backed up and a prioritization of the objects according to a first criterion. The objects are transmitted from the first location to the second location substantially in accordance with the prioritization. The transmission may be suspended in accordance with loss of network connectivity, a user action, or throttling to reduce processor or network load. Transmission may be continued, and the objects reprioritized according to the first criterion, wherein relevant changes in the objects are reflected. A backup target may be chosen based on the location of the source, and if the location changes, a new backup target may be chosen in consideration of bandwidth. The backups to the backup targets may be combined to define a backup.

Abstract: Differential scanning is disclosed. A scan collection period is determined. A system is monitored to detect object events during the scan collection period, and a scan list may be updated with information regarding objects to be scanned, based on some of the object events. Objects are scanned based on the information in the scan list. Information regarding objects associated with object events occurring outside the scan collection period may be removed from the scan list.

Abstract: A method, article of manufacture, and apparatus for efficiently backing up information are disclosed. In some embodiments, a source is analyzed, the source profile is generated based on the analysis, the source profile is then associated with a source image, and the source profile is stored in a storage device. In some embodiments, the source profile is stored in a source profile database. In some embodiments, the source image may be modified based on the source profile. The source image may have software components removed.

Abstract: A method, article of manufacture, and apparatus for restoring or transmitting files from a first location to a second location, comprising prioritizing the files, and restoring or transmitting the files in prioritized order. In one embodiment, the files may be prioritized according to file type, and may be subsorted by timestamp. In one embodiment, the files may be prioritized according to timestamp or timestamp range, and subsorted by file type. File types may be grouped such that all file types in a group have the same priority, and the group may be associated with an application or application suite. In one embodiment, the files may be prioritized according to predicted file usage.

Abstract: Scanning is disclosed. A system is monitored to detect object events, and it is determined whether an object event requires an update to a scan list. If an update is required, the scan list is authenticated. The scan list is updated with information regarding objects associated with the object event. Authentication may be performed by comparing a stored hash value of the scan list with a computed hash value of the scan list. If the scan list is not successfully authenticated, a full scan may be performed or a remotely stored scan list may be used.

Abstract: A method, article of manufacture, and apparatus for restoring or transmitting files from a first location to a second location, comprising prioritizing the files, and restoring or transmitting the files in prioritized order. In one embodiment, the files may be prioritized according to file type, and may be subsorted by timestamp. In one embodiment, the files may be prioritized according to timestamp or timestamp range, and subsorted by file type. File types may be grouped such that all file types in a group have the same priority, and the group may be associated with an application or application suite. In one embodiment, the files may be prioritized according to predicted file usage.

Abstract: Incremental scanning is disclosed. A system is monitored to detect object events, and a scan list may be updated with information regarding objects to be scanned, based on some of the object events. Objects are scanned based on the information in the scan list.

Abstract: Scanning is disclosed. A scan collection period is determined. A system is monitored to detect object events during the scan collection period, and differential and incremental scan lists may be updated with information regarding objects to be scanned, based on some of the object events. Objects are scanned based on the information in the incremental scan list. Objects are scanned based on the information in the differential scan list. The incremental scan may be performed more than once before the differential scan is performed. Information regarding objects associated with object events occurring outside the scan collection period may be removed from the scan list.

Abstract: Scanning is disclosed. A system is monitored to detect object events, and it is determined whether an object event requires an update to a scan list. If an update is required, the scan list is authenticated. The scan list is updated with information regarding objects associated with the object event. Authentication may be performed by comparing a stored hash value of the scan list with a computed hash value of the scan list. If the scan list is not successfully authenticated, a full scan may be performed or a remotely stored scan list may be used.

Abstract: Differential scanning is disclosed. A scan collection period is determined. A system is monitored to detect object events during the scan collection period, and a scan list may be updated with information regarding objects to be scanned, based on some of the object events. Objects are scanned based on the information in the scan list. Information regarding objects associated with object events occurring outside the scan collection period may be removed from the scan list.