Abstract: Techniques for managing virtual machine backups are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for managing virtual machine backups comprising opening a file containing a virtual disk of a virtual machine, parsing the file to identify one or more partitions of the virtual disk, determining file system type for each of one or more partitions, identifying a boot partition in the file, parsing, using at least one computer processor, file system information of the boot partition to identify volume information; and generating volume composition information using the identified volume information.

Abstract: A method and apparatus for creating a map of files related to a virtual disk of a virtual machine comprising inspecting file system entries within at least one volume of the virtual disk; converting information related to file system entries into a map, where the map comprises file locations within a physical disk for the files related to the virtual disk.

Abstract: A method and apparatus for creating and utilizing a map of files related to a virtual disk of a virtual machine. In one embodiment, the method comprises inspecting file system entries within at least one volume of the virtual disk; converting information related to file system entries into a map, where the map comprises file locations within a physical disk for the files related to the virtual disk. In another embodiment, the method comprises examining a map of an image of at least a portion of a virtual disk, accessing the image, extracting and utilizing at least one file. In yet another embodiment, the method comprises creating a map related to an image representing stored files in a virtual disk, storing the map and the image, selecting a file, examining the map, accessing the image, extracting the file from the image and restoring the file to a storage system.

Abstract: Embodiments of the present invention include a method and apparatus for performing incremental mapping of virtual machine incremental images. The method and apparatus comprise creating a map of the base file as well as the incremental file, utilizing at least a portion of the file tables contained in the various images. This map indicates the type of change (i.e., whether the file is contained completely in an incremental image, is contained in the base image, or is contained in both). In another embodiment, the map may also contain the location of the change or the location of the file within the sequentially stored images upon the backup media.

Abstract: A method and apparatus for mapping virtual drives is described. In one embodiment, the method for mapping virtual drives comprises processing first locations of a plurality of file system objects within a virtual volume and converting the first locations of the plurality of file system objects within the virtual volume into second locations of the plurality of file system objects relative to a virtual drive of at least one virtual drive, wherein the at least one virtual drive form a portion of the virtual volume.

Abstract: A method and apparatus for detecting a rootkit is described. In one embodiment, a method for detecting a rootkit comprises analyzing file system information associated with a plurality of files that form a volume, wherein a first portion of the file system information comprises metadata information for a master file table and a second portion comprises at least one master file table record and identifying an inconsistency within the file system information where the inconsistency indicates a modification to the file system information by a rootkit.

Abstract: A method and apparatus for resolving volumes identifiers and drive letters associated with a virtual machine is described. In one embodiment, the method comprises correlating system registry information with at least one virtual drive configuration associated with a virtual machine image to produce a correlation result and mapping a volume identifier to at least one virtual drive based on the correlation result.

Abstract: A snapshot-aware secure delete event identifying a file for snapshot-aware secure deletion on a computer system is received, and the file to be deleted is identified from the snapshot-aware secure delete event. Each file snapshot associated with the file on the computer system is accessed at the volume level and each non-duplicate file extent of the file snapshots is identified. The raw data identified by each non-duplicate file extent is securely overwritten using a secure overwrite technique, and each file snapshot is deleted from the computer system. In this way the raw data of the file and the raw data of all the diff areas of file snapshots associated with the file are securely overwritten and deleted.

Abstract: A copy of the raw data on physical disk of an inaccessible source file is automatically generated in an accessible target file. When accessed, the copy of the raw data of the inaccessible source file in the accessible target file can be read allowing a user or application to evaluate the data of the accessible target file, and thus indirectly the raw data of the inaccessible source file. In some embodiments, the copy of the raw data is evaluated for malicious code, allowing a user or application to take protective actions, such as deleting the inaccessible source file. Where the raw data of the inaccessible source file is encrypted, the copy of the raw data is automatically decrypted by the operating system when read yielding unencrypted data. Where the raw data of the inaccessible source file is compressed, the copy of the raw data is automatically decompressed by the operating system when read yielding uncompressed data.