Abstract: A mass storage system and method incorporates a cache memory or a cache management module which handles dirty data using an access-based promotion replacement process through consistency checkpoints. The consistency checkpoints are associated with a global number of snapshots generated in the storage system. The consistency checkpoints are organized within the sequence of dirty data in an invariable order corresponding to storage volumes with the generated snapshots, such that, responsive to destaging a consistency checkpoint the global number of generated snapshots are recorded and then read during recovery of the failed storage system.

Abstract: A cluster server manages allocation of free blocks to cluster clients performing writes in a clustered file system. The cluster server manages free block allocation with a free block map and an in-flight block map. The free block map is a data structure or hardware structure with data that indicates blocks or extents of the clustered file system that can be allocated to a client for the client to write data. The in-flight block map is a data structure or hardware structure with data that indicates blocks that have been allocated to clients, but remain in-flight. A block remains in-flight until the clustered file system metadata has been updated to reflect a write performed to that block by a client. After a consistency snapshot of the metadata is published to the storage resources, the data at the block will be visible to other nodes of the cluster.

Abstract: Embodiments of the invention relate to maintaining reference counts in a file system to track when a block is available to be freed. When a snapshot copy of a file is created, rather than copying all the blocks of the file for the snapshot copy, the snapshot inode is given pointers to the blocks of the file. Rather than updating the reference counts for all these blocks to indicate that they are now in use by more than one file, the update of reference counts for at least some of these blocks may be deferred until a later time.

Abstract: The local storage performs remote copy to the remote storage. For low traffic failback remote copy, the remote storage performs a delta copy to the local storage, the delta being the difference between the remote storage and local storage. The local storage backs up snapshot data. The remote storage resolves the difference of the snapshot of the local storage and the remote storage. The difference resolution method can take one of several approaches. First, the system informs the timing of snapshot of the local storage to the remote storage and records the accessed area of the data. Second, the system informs the timing of snapshot of the local storage to the remote storage, and the remote storage makes a snapshot and compares the snapshot and remote copied data. Third, the system compares the local data and remote copy data with hashed data.

Abstract: After a clone file is created from a file, a write request targeting the clone file can be handled. It is determined that the write request indicates the clone file that was cloned from a file in a first fileset. The clone file is of a second fileset and a clustered file system comprises the first fileset and the second fileset. A data block of the clone file affected by the write request is determined. It is then determined that the data block at a current location cannot be modified. The write request is implemented with respect to the data block at a different location.

Abstract: Embodiments of the present invention provide an approach for protecting and restoring data within a networked (e.g. cloud) storage computing environment through asynchronous replication and remote backup of data and its associated metadata. Under embodiments of the present invention, data backup and recovery functionality provides data backups by detecting incremental updates to the data and its associated metadata at specific points in time determined by policies. The policies are configurable based on user requirements. Multiple copies of the data backups can be made and stored in separate compressed files at backup/disaster recovery locations. The backups of data and its associated metadata, which includes file system configuration information can be used to restore the state of a computer file system to that of a given point-in-time. Accordingly, a data protection approach is disclosed for protecting data at both the file system level and application level.

Abstract: A checkpointing fault tolerance network architecture enables a backup computer system to be remotely located from a primary computer system. An intermediary computer system is situated between the primary computer system and the backup computer system to manage the transmission of checkpoint information to the backup VM in an efficient manner. The intermediary computer system is networked to the primary VM through a first connection and is networked to the backup VM through a second connection. The intermediary computer system identifies updated data corresponding to memory pages that have been least recently modified by the primary VM and transmits such updated data to the backup VM through the first connection. In such manner, the intermediary computer system holds back updated data corresponding to more recently modified memory pages, since such memory pages may be more likely to be updated again in the future.

Abstract: A method and apparatus for deduplication of files of a storage system is described. During a gathering phase, a file may be simultaneously processed by two or more threads to produce and store content identifiers for data blocks of the file. Each file may be sub-divided into multiple file sub-portions, each file sub-portion comprising a predetermined number of data blocks. A thread may be assigned to each sub-portion of a file for processing the data blocks. The currently assigned sub-portion for each thread may be recorded and used upon a system crash to restart each scanner thread at the currently assigned sub-portion to minimize the data blocks that are re-processed. The size of a file sub-portion may be predetermined based on the organization of inode data structures representing the files (e.g., based on the maximum number of pointers that an indirect block in the inode data structure may contain).

Abstract: When updating the data in each generation's logical units, the snapshot processing unit writes the update data in accordance with the update as forward differential data 221 to the base volume, and saves the old data that existed in the base volume before that update data was written as backward differential data in the backward differential data pool, and, when each generation's logical unit backward differential data is updated, deletes the forward differential data belonging the production LUs and the snapshots that together with those production LUs form the forward differential group. As a result of this, the amount of metadata necessary for executing a host command is able to be reduced in production LUs utilizing snapshots using the forward differential method.

Abstract: Systems and methods herein provide for protecting data using snapshots and images of those snapshots to quickly recreate data upon request. For example, a storage controller of a data storage system allocates a period of time between creating snapshots of data in a first storage volume of the data storage system. The controller then logs received write requests to the first storage volume and generates snapshot of data in the first storage volume based on the allocated period of time. Thereafter, the controller may receive a request to recreate data. The controller locates the snapshot in the first storage volume based on that request to recreate the data. In doing so, the controller generates a snapshot image in a second storage volume. The controller then retrieves logged write requests and applies them to the snapshot image to recreate the data in the second storage volume.

Abstract: The present disclosure is directed to a method for providing continuous data protection for a virtual volume (VV). The method may comprise conceptually dividing the VV into a plurality of same sized chunks; preserving contents of the VV at a specified time; creating a Point in Time (PiT) instance for the VV at the specified time, comprising: a PiT Temporary Virtual Volume (PTVV) for storing modifications to the VV subsequent to the specified time, wherein data stored in the PTVV is prohibited from been overwritten; a re-allocation table for providing read access to a most recent version of each of the plurality of chunks of the VV; and a Continuous Data Protection (CDP) log for providing read access to a historic version of a chunk stored in the PTVV; and updating the PiT instance when a chunk of the plurality of chunks of the VV is being modified.

Abstract: In a storage system, one or more storage apparatuses provide a management computer with a first volume for storing data from the management computer, provide a host computer with a second volume for storing data from the host computer, and manage a volume address for the one or more storage apparatuses to manage the first volume and the second volume in the one or more storage apparatuses. The management computer issues a command specifying an arbitrary volume address to the one or more storage apparatuses, and designates, when receiving a normal response from the arbitrary volume address, a volume with the arbitrary volume address as the second volume.

Abstract: A backup cache on a client is prepopulated with fingerprints corresponding to data stored on a backup server. A plurality of fingerprints of data are received from the client, each received fingerprint corresponding to data present on the client which is subject to backup to the server. For each received fingerprint, an attempt is made to locate data corresponding to the received fingerprint stored on the backup server. Responsive to locating data corresponding to a received fingerprint stored on the backup server, data stored on the backup server considered to be “in the neighborhood” of the located data is identified. Fingerprints (e.g., hashes) identifying data stored on the backup server in the neighborhood of the located data are created and transmitted to the client, for prepopulating the backup cache on the client.

Abstract: Methods, systems, and products for storing information in a data processing system. The method includes providing a knowledge base for a file system manager that is adapted to organize a plurality of real files on a mass memory of the data processing system. The knowledge base defines a collection of knowledge that includes a set of concepts, a set of relations among the concepts, and a set of relations of inclusion that describe each real file as an instance of at least one concept. The method includes detecting a command for the file system manager for accessing a set of selected instances. The method also includes identifying a set of selected real files, which are described by the selected instances (according to the knowledge), and accessing the selected real files on the mass memory.

Abstract: Provided are a method, system, and article of manufacture for gathering state information for an application and kernel components called by the application. An implementation of a component to execute in a kernel space is instantiated in a user space. An application invokes a call to the component in the kernel space. The call to the component in the kernel space is invoked and an implementation of the component in the user space is invoked to execute the call in the user space. State information related to the execution of the call to the component in the user space to include in checkpoint information for the application is gathered.

Abstract: The present invention relates to a system that includes one or more logical volumes for storing data; a snapshot producing section for producing snapshots for the logical volumes based on a pre-scheduled snapshot acquisition time; a remote copy section for remote copying difference data for the snapshots based on pre-scheduled remote copy start times; and a scheduling section for re-scheduling the time of one or more of an Nth snapshot acquisition time, an Nth remote copy start time, and an (N+1)th remote copy start time, in such a manner that remote copying starting at the Nth remote copy start time finishes by the (N+1)th remote copy start time.

Abstract: Some embodiments of the invention provide components and/or techniques that may assist in choosing a snapshot to which to roll back to address a system malfunction. For example, some embodiments of the invention may record various metrics describing the system's performance, reliability and/or functionality at the points at which various snapshots are taken, along any of numerous dimensions. When a user later indicates a desire to restore the system to a previous point, these metrics may be analyzed to choose a snapshot to which to roll back.

Abstract: Implementing point in time back-up. A method that may be practiced in a distributed computing environment. The distributed computing environment includes a number of computing system nodes. The method includes at a first node in the computing environment, taking a snapshot of a cluster volume. The cluster volume stores data items (e.g. files/blocks). Taking a snapshot includes marking a point in time for data items in the volume. The method further includes receiving a notification that a different node in the computing environment than the first node, has determined to change a data item in the cluster volume at a point after the marked point in time from an old version of the data item to a new version of the data item. The method further includes at the first node, saving the old version of the data item prior to modification.

Abstract: A method, device, and system for resetting snapshots are provided. The reset of a snapshot incorporates the traditional snapshot delete and snapshot create operations into a single operation. Additionally, a snapshot created under the reset operation may receive an array partition from a snapshot being deleted under the same snapshot reset operation thereby retaining its identifying characteristics.

Abstract: A method, computer readable medium, and a system for reconstituting a virtual snapshot of files in a file virtualization system includes forming at a file virtualization device a virtual snapshot that includes a plurality of physical snapshots associated with one or more file storage devices participating in the virtual snapshot, receiving a request for performing an operation on one or more physical snapshots in the plurality of physical snapshots, providing the one or more physical snapshots in response to the request for performing the operation when the one or more physical snapshots exists in the virtual snapshot, and reconstituting the virtual snapshot by including the one or more physical snapshots to form a reconstituted virtual snapshot in response to the request for performing the operation when the one or more physical snapshots do not exist in the virtual snapshot.

Abstract: An on-disk storage arrangement increases the number of persistent consistency point images (PCPIs) that may be maintained for a volume of a storage system. The on-disk storage arrangement comprises a novel volume information (volinfo) block representing a root of the volume; the volinfo block is stored at predefined locations on disk and comprises various system wide configuration data. The volinfo block further comprises a data structure configured to provide a level of indirection that increases the number of PCPIs maintainable by a file system executing on the storage system. To that end, the data structure may be organized as an array of pointers, wherein each pointer references a block containing a snapshot root, thereby enabling efficient access to each PCPI maintained by the file system.

Abstract: A method, device, and system for resetting snapshots are provided. The reset of a snapshot incorporates the traditional snapshot delete and snapshot create operations into a single operation. Additionally, a snapshot created under the reset operation may receive an array partition from a snapshot being deleted under the same snapshot reset operation thereby retaining its identifying characteristics.

Abstract: In one embodiment, a user or client device communicates with a distributed file system comprised of one or more physical nodes. The data on each of the physical nodes store metadata about files and directories within the file system. Some of the embodiments permit a user to take a snapshot of data stored on the file system. The snapshot may include a single file, a single directory, a plurality of files within a directory, a plurality of directories, a path on the file system that includes nested files and subdirectories, or more than one path on the file system that each includes nested files and directories. In some embodiments, systems and methods intelligently choose whether to use copy-on-write or point-in-time copy when saving data in a snapshot version of a file whose current version is being overwritten. In some embodiments, systems and methods allow snapshot users to return from a snapshot directory to the immediate parent directory from which the user entered into the snapshot.

Abstract: The creation and utilization of network restore points is provided by a schema associated with a structured data set that can be conveniently backed up by periodically taking snapshots of the structured data to establish a series of restore points that can be used in the event that the primary structured data becomes lost or corrupted. In general, the snapshots are only taken after the structured data set has undergone a change in content, although they may be taken at other times as well. The snapshot may be taken by a network restore point engine that can be accessed by a user over the Internet. In addition, the snapshot may be stored on an Internet-based storage medium or it may be pushed to or pulled by the client so that the snapshot resides on a client-resident storage medium.

Abstract: A method and apparatus for different embodiments of incremental garbage collection of data in a secondary storage. In one embodiment, a method comprises locating blocks of data in a log that are referenced and within a range at a tail of the log. The method also includes copying the blocks of data that are referenced and within the range to an unallocated segment of the log.

Abstract: Data duplication may be reduced in cloud storage. First snapshots of one or more remote volumes may be received via a network. The first snapshots may be copies of the one or more remote volumes at a first instant in time. Responsive to and/or based on the first snapshots, unique clusters and duplicate clusters may be identified among the valid clusters of the remote volumes. The unique clusters and single instances of the duplicate clusters may be stored in a backup file, such that the backup file is devoid of duplicate clusters. Second snapshots of the one or more remote volumes may be received via the network. The second snapshots may be copies of the one or more remote volumes at a second instant in time, wherein the second instant in time is after the first instant in time. Responsive to the second snapshots, the clusters in the backup file that are no longer valid may be utilized to store the valid clusters in the one or more remote volumes not yet stored in the backup file.

Abstract: A fault-tolerant messaging system comprises a primary broker, a first network, a back up broker, and a second network. The primary broker and the back up broker are coupled to the first network for communication with clients thus creating a messaging system. The primary broker and the back up broker are also coupled to the second network for replicating state from the primary broker and the back up broker, and also sending transaction events immediately to maintain synchronization. The brokers further comprise a replication module for communicating state between the primary broker and the back up broker, a recovery module for performing recovery on the back up broker upon failure of the primary broker, and a fault-tolerant connection module for establishing a fault-tolerant connection between the primary broker and the back up broker over the second network. The present invention also includes a number of novel methods for performing fault tolerance.

Abstract: A system and method of transactional session management. Information sufficient to permit creation of a deep copy of a session object is saved concurrently for all aspects of the transaction. For example, the saving may save state information provided by different hierarchical levels of the session as well as possible different hardware or software entities participating in the session. In the event of a rollback condition, the deep copy is supplied to one or more applications. Those applications may then continue the session from the point of the deep copy.

Abstract: A server apparatus performs data I/O processing on a P-VOL in response to a request from a client apparatus and includes a file system which receives data write and read requests in units of files from the client apparatus. The server apparatus stores, into a D-VOL, differential data generated by updating the P-VOL, and manages a snapshot management table wherein a block address of the D-VOL storing the acquired differential data is registered. When a remaining capacity of a storage area of the D-VOL becomes equal to or less than a predetermined threshold value, the server apparatus enables a block of the D-VOL which had stored therein the differential data on a certain predetermined file, to be used as a storage area for newly acquired differential data.

Abstract: Techniques for managing inodes of a file system are described herein. According to one embodiment, in response to a request received at the file system for committing a file to a storage, a first indirect block having multiple entries is allocated. At least one entry stores a pointer linked with a data block, where the first indirect block is referenced by a pointer stored within an inode associated with the file. A first set of data blocks having a first predetermined number of data blocks is allocated, where each entry is referenced by a pointer stored in an entry of the first indirect block. The first indirect block and the first set of data blocks are contiguous blocks with respect to each other, such that content of the first indirect block and the first set of data blocks can be retrieved via a single storage access operation.

Abstract: A backup method that uses snapshot delta views to create backups of a data collection is provided. The method comprises taking a first snapshot of the data collection, in response to determining that a previous snapshot used to create a backup does not exist; creating a backup of the data collection using the first snapshot, in response to determining that the previous snapshot does not exist; recording that the first snapshot was used as a source for the creation of a backup; and taking a second snapshot of the data collection, in response to determining that the previous snapshot that was used as a source for a backup does exist.

Abstract: Website administrators can specify page groups and/or single pages as checkpoint nodes for site analysis reporting purposes, and can configure the system of the invention to provide information as to a particular visitation path through the checkpoints. Any group of pages can be designed as a single checkpoint node for website traffic analysis and reporting purposes. Page groups can be used in place of or in addition to individual web pages in any context where site traffic analysis is being presented or performed.

Abstract: Provided are an apparatus to restore data, and a snapshot image segmentation apparatus and method that create a plurality of snapshot images, store the snapshot images in a storage, and load the stored snapshot images to a memory according to snapshot image loading priority. The snapshot image segmentation apparatus may includes a number-of-snapshot images deciding unit configured to decide the number of snapshot images, a segmentation unit configured to segment an entire image including data stored in a memory into one or more snapshot images, based on the number of snapshot images, and a loading priority deciding unit configured to decide snapshot image loading priority of the segmented snapshot images, based on data loading priority of the data stored in the memory.

Abstract: The present invention relates to a system and method of data restoration, for instance, after the occurrence of a user error. In particular, snapshot database can be maintained that stores a copy of database data. The snapshot database does not have to store a complete copy of all data on a source database, but rather shares data that is common to both but not necessarily identical. If an error occurs on the primary database then the database can be reverted back to a point in time prior to the error by replacing source database files with snapshot files. Additionally, an undo component can be employed in conjunction with the snapshot to approach an error to a finer grained point in time. In brief, the present invention can restore a database much faster and simpler, while utilizing less space and resources than conventional data restoration technologies.

Abstract: A method for capturing an image of a machine having one or more disks is presented. The method comprises creating a snapshot of the machine, the snapshot including full machine encapsulation, querying the one or more disks on the machine to obtain information stored thereon, creating metadata able to access one or more files, one or more folders, and the application on the machine, and capturing the snapshot, the obtained information and the metadata in the image. The method may also comprise migrating the captured image and/or extracting one or more files and/or folders from the captured image on another machine. The migration can be between physical and physical, physical and virtual, physical and cloud, etc. The method may comprise capturing another image comprising the snapshot, the metadata and changed information different from the obtained information.

Abstract: A computer implemented method includes monitoring blocks of data on a storage device that are changing as the computer operates. On detecting a computer shut down event, a copy of changes to the monitored blocks are saved. Upon startup of the computer, a backup of the changed blocks of data is performed.

Abstract: Method and apparatus for file sharing between continuous and scheduled backups is described. One example relates to backing up source data stored by a computer system. A first portion of the source data is backed up at points in time in response to a backup schedule to produce a plurality of partial backups. A second portion of the source data is backed up continuously in response to changes of the second portion to maintain a replica of the second portion. The replica of the second portion is linked to the plurality of partial backups to produce a respective plurality of full backups of the source data.

Abstract: A method for dynamic consistency group formation, in one embodiment, includes creating a snapshot of first data stored on a source storage system with respect to data content and data structure, copying the snapshot to a target storage system, detecting one or more write operations affecting data on the source storage system while copying the first data, detecting one or more collisions affecting the first data on the source storage system, wherein a collision occurs whenever the write operations affect the first data prior to the first data being written, setting a consistency group interval which represents an interval duration between successive snapshot create-and-copy events, and altering the consistency group interval to minimize collisions affecting data on at least one of the storage systems. Other methods, systems, and computer program products for dynamic consistency group formation are also described.

Abstract: A storage system maintains a journal and a snapshot of one or more data volumes. Two journal entry types are maintained, an AFTER journal entry and a BEFORE journal entry. Two modes of data recovery are provided: “fast” recovery and “undo-able” recovery. A combination of both recovery modes allows the user to quickly recover a targeted data state.

Abstract: A system including: one or more file systems for storing data; a snapshot producing section for producing snapshots for the file systems based on a pre-scheduled snapshot acquisition time; a remote copy section for remote copying difference data for the snapshots based on pre-scheduled remote copy start times; and a scheduling section for re-scheduling the time of one or more of an Nth snapshot acquisition time, an Nth remote copy start time, and an (N+1)th remote copy start time, in such a manner that remote copying starting at the Nth remote copy start time finishes by the (N+1)th remote copy start time.

Abstract: After a clone file is created from a file, a write request targeting the clone file can be handled. It is determined that the write request indicates the clone file that was cloned from a file in a first fileset. The clone file is of a second fileset and a clustered file system comprises the first fileset and the second fileset. A data block of the clone file affected by the write request is determined. It is then determined that the data block at a current location cannot be modified. The write request is implemented with respect to the data block at a different location.

Abstract: A proposal is made of a file management system and method capable of reliably deleting unnecessary data. In a file management console and method for reading or writing data of a file from or in a first volume, which is provided by a storage device, in response to a request sent from a host computer, one snapshot or multiple snapshots that relate to the first volume and can be updated are created. In response to an externally issued designated file deletion command, a designated file is deleted from all of the first volume and snapshots or part thereof specified in the deletion command. At this time, the data items of the designated file in the first volume and/or snapshots from which the designated file should be deleted are overwritten with invalid data. Moreover, pieces of management information on the designated file are changed to a reference-disabled state.

Abstract: Method and system for incremental backup of data containers with fixed length records is provided. Initially, a backup application copies all stored data containers to create an initial backup container. A data structure corresponding to the first backup operation is also created. The data structure maintains unique file identifiers for each data container and information regarding when a record was added. The data structure is created and maintained by an application that also creates, updates, and modifies the fixed length records. The application updates the base data structure when records are added to a data container, after the initial backup. For a next backup operation, the initial data structure is compared to an updated data structure that is current at the next backup time. The comparison identifies the new records that were added (or updated) since the initial backup operation. The backup application then incrementally copies the new records.

Abstract: One embodiment of the present invention is directed to a multi-node data-storage system comprising a number C of component-data-storage-system nodes that store data pages of a data object in a mirror and in 0, 1, or more parity-encoded snapshots, the mirror comprising 2 or more replicates including a 0th replicate and each parity-encoded snapshot containing 1 or more stripes, each stripe including snapshot data pages and snapshot parity pages.

Abstract: Technologies are described herein for managing database snapshots. One user interface is provided for managing the automated creation and deletion of database snapshots. Parameters are received through the user interface that define how the database snapshots should be created and deleted. Once the parameters are defined, a timer job is executed that causes a DBMS to create and delete the database snapshots according to the specified parameters. A user interface is also provided for manually managing the creation, deletion, and restoration of database snapshots. A request may be received through this user interface to recover data from a database snapshot. In response to such a request, another user interface is provided for specifying the data that should be recovered. Once the data to be recovered has been specified, the desired data is recovered from the database snapshot.

Abstract: Embodiments of the invention relate to maintaining reference counts in a file system to track when a block is available to be freed. When a snapshot copy of a file is created, rather than copying all the blocks of the file for the snapshot copy, the snapshot inode is given pointers to the blocks of the file. Rather than updating the reference counts for all these blocks to indicate that they are now in use by more than one file, the update of reference counts for at least some of these blocks may be deferred until a later time.

Abstract: Writes to blocks of a protected storage volume that occur between the beginning of a prior backup interval and the beginning of a current backup interval are tracked using a first snapshot that is maintained through the current backup interval. At the beginning of the current backup interval, a second snapshot is generated. Blocks that are indicated by a dirty block list of the first snapshot as having been changed are read from the snapshot volume for the second snapshot and copied to a backup storage volume. For the next backup interval, the second snapshot or alternatively, a newly generated third snapshot, is used to track writes to blocks of a protected storage volume that occur between the beginning of the current backup interval and the beginning of a next backup interval.

Abstract: Data written in the primary logical volume of the first storage device are transmitted to the third storage device via the second storage device, the data being written in the same location as the primary logical volume within the secondary logical volume in the third storage device; when transmission of the data stops among the first to the third storage devices, the respective second storage device and the third storage device manage locations in the secondary logical volume where the data held thereby are to be written; and, when transmission of the data resumes among the first to the third storage devices, the locations in the secondary logical volume managed by the respective second and the third storage devices are aggregated, the data to be written in the respective aggregated location in the secondary logical volume being transmitted from the first storage device to the third storage device via the second storage device.

Abstract: A storage system including: a storage device for storing a file; a plurality of file systems for managing the file; and a plurality of NAS servers that control access from a client to the file systems via a global namespace formed by grouping local namespaces for the one or more file systems; wherein, each NAS server includes a memory to store global namespace management information including global paths of the file systems; one NAS server of the NAS servers accepts a request to obtain snapshots of the file systems from external of the storage system; the one NAS server instructs itself and the other NAS servers to obtain snapshots of the file systems; the one NAS server and the other NAS servers obtain the snapshots of the file systems, and inform the one NAS server of snapshot identifiers and of local paths of the snapshots; the one NAS server makes snapshot management information including global paths of the snapshots based on each of the snapshot identifiers received from the other NAS servers and each

Abstract: A method may include identifying a virtualized application that has a read-only virtualization sublayer and a read-write virtualization sublayer. The read-only virtualization sublayer may represent a base state of the virtualized application and the read-write virtualization sublayer may be configured to store changes to the base state of the virtualized application. The method may also include determining a first difference between the read-only virtualization sublayer and the read-write virtualization sublayer at a first point in time and using the first difference between the read-only virtualization sublayer and the read-write virtualization sublayer to create a first snapshot that represents a state of the virtualized application at the first point in time. Various other methods, systems, and computer-readable media are also disclosed.