Abstract: Systems, methods, and devices for transactional processing of change tracking data for a database are discussed. A method includes generating a micro-partition based on execution of a transaction on a table of a database, the micro-partition reflecting changes made to the table by the transaction. A change tracking entry is generated in response to the execution of the transaction. The change tracking entry includes an indication of one or more modifications made to the table by the transaction and an indication of the micro-partition generated based on the execution of the transaction. The change tracking entry is stored in the micro-partition as metadata. At least one existing micro-partition is removed from the table, responsive to storing the change tracking entry.

Abstract: Aspects of a multi-protocol storage device including a controller are provided which handle mode switches after a shutdown resulting in a large amount of unfinished work by phasing the work during and after initialization. The controller operates in a first mode such as an SD mode and a second mode such as a NVMe mode. In the event of a shutdown in the second mode resulting in unfinished work, the controller initializes in the first mode. During initialization, the controller determines whether a completion time for the unfinished work exceeds an initialization time in the first mode. When the completion time exceeds the initialization time, the controller performs a first portion of the work during initialization and postpones performance of at least a second portion of the unfinished work until after initialization. As a result, initialization timeouts in the first mode due to the unfinished work may be avoided.

Abstract: One embodiment provides a system which facilitates organization of data. During operation, the system identifies an original data chunk stored in a non-volatile memory of a storage device, wherein the original data chunk is a logical chunk which includes original logical block addresses. The system stores a first mapping of the original logical block addresses to original physical block addresses in a first data structure. The system assigns new logical block addresses to be included in a new data chunk. The system creates, in a second data structure based on an order of the assigned new logical block addresses, a mapping of the new logical block addresses to valid original logical block addresses. The system stores, based on the first data structure and the second data structure, a second mapping of the new logical block addresses to the original physical block addresses.

Abstract: A system is used in a data processing system comprising at least one memory system which is operatively engaged and disengaged from a host or from another memory system and the host transmitting commands into the at least one memory system. The system includes a metadata generator configured to generate a map table for an available address range and a reallocation table for indicating an allocable address range in the map table; and a metadata controller configured to allocate the allocable address range to the at least one memory system when the at least one memory system is operatively engaged to the host or to another memory system, or release an allocated range for the at least one memory system such that the allocated range becomes the allocable address range when the at least one memory system is operatively disengaged from the host or the another memory system.

Abstract: A data storage apparatus may include a first memory device comprising a first area in which write data from a host device are stored and a second area, a second memory device into which the write data stored in the first memory device are copied, a storage device, and a controller. The controller is configured to control data input/output for the first memory device, the second memory device and the storage device, wherein the controller comprises a cache manager configured to evict eviction target data from the second memory device by: storing the eviction target data into the storage device, and storing the eviction target data into the second area of the first memory device.

Abstract: A distributed computing system for automatic constraint-based data resource arrangement, comprising a plurality of computing components being communicatively coupled to each other, each computing component comprising the following data resources: data storage media for storing client-related digital information, a data processor for processing said client-related digital information, and a network communications interface for communicating said client-related digital information; and a constraint engine for automatically determining alternate arrangements of said data resource assignments, said constraint engine comprising a constraint processor and a constraint database, said constraint database for receiving and storing changeable digital constraint parameters indicative of permissible operational constraints on said data resources, wherein said alternate arrangements comply with at least a first set of said changeable digital constraint parameters; wherein said data resource assignments are reassigned from

Abstract: Disclosed in the present disclosure is a data caching method and apparatus, the data caching method includes the following steps: receiving a data request message sent by a user terminal; if detecting that a cache apparatus does not include the target access data requested by the data request message, then sending the target access data in a storage apparatus to the user terminal; extracting parameter information of the target access data in the storage apparatus, and determining whether the parameter information matches a preset parameter condition; and, if the parameter information matches the preset parameter condition, then transmitting the target access data to the cache apparatus.

Abstract: Method and system are provided for managing capacity in a storage system using copy services. The method is a computer-implemented method that predicts an imminent event due to a constrained resource and identifies one or more copy service relationship that will mitigate the imminent event. The method orchestrates a partial or full invalidation of a copy service relationship to reclaim some of the constrained resource to prevent the imminent event, including updating the copy service relationship metadata to indicate the invalidation.

Abstract: According to one aspect of the present disclosure, a method and technique for hybrid virtual machine configuration management is disclosed. The method includes assigning to a first set of virtual resources associated with a virtual machine a first priority and assigning to a second set of virtual resources associated with the virtual machine a second priority lower than the first priority. An operating system of the virtual machine is provided with the first and second priorities assigned to the respective first and second sets of virtual resources. The operating system dispatches to process a workload the virtual resources from the first set before dispatching the virtual resources from the second set.

Abstract: Techniques for data processing may include: receiving a data chunk of the data set; determining, in accordance with criteria including a compressibility ratio for the data set and a cost ratio of compression computation cost and entropy computation cost, whether to activate or deactivate entropy computation for the data set, wherein the compressibility ratio is ratio of a number of compressible data chunks of the data set and a number of uncompressible data chunks of the data set; and responsive to determining to activate entropy computation for the data set, performing first processing comprising: determining an entropy value for the data chunk; and determining, in accordance with the entropy value for the data chunk, whether to compress the data chunk.

Abstract: Systems and techniques for garbage collection are disclosed for concurrently performing a garbage collection cycle in a single traversal of a garbage collection heap while application threads are running. The garbage collection cycle includes marking a first memory object as live. The garbage collection cycle also includes determining that a forwarding pointer of the first memory object points to the first memory object. The garbage collection cycle further includes evacuating the first memory object to a free region based on the determining. The garbage collection cycle additionally includes evacuating a second memory object in the same single traversal of the garbage collection heap in which the first memory object is being marked live.

Abstract: A method, computer program product, and computer system for identifying, by a computing device, historical block usage in a plurality of slices for a user. At least a portion of the plurality of slices to keep during an evacuation process for the plurality of slices may be determined. At least the portion of the plurality of slices may be excluded from the evacuation process for the plurality of slices based upon, at least in part, the historical block usage in the plurality of slices for the user.

Abstract: A computer-implemented method for increasing record availability on a distributed database system implementing multiple partitioning strategies includes identifying first processing devices of a distributed database system for storing one or more first records in accordance with multiple partitioning strategies, determining that at least two of the first processing devices are identified for storing a given one of the one or more first records, and selecting one or more new processing devices of the distributed database system for storing the given first record to achieve sufficiently high availability of the given record within the distributed database system.

Abstract: An apparatus comprises a processing device configured to identify a snapshot lineage comprising snapshots of a storage volume and to maintain, for the snapshot lineage, a multi-level tree structure comprising (i) a first level comprising a primary volume object representing the storage volume and snapshot volume objects representing the snapshots of the storage volume and (ii) additional levels comprising data objects, where the primary and snapshot volume objects comprise pointers to the data objects, the data objects comprising data of the storage volume and snapshots. The processing device is also configured to determine storage capacity usage by the snapshot lineage based on a collective size of the data objects pointed to by the primary and snapshot volume objects, to store the determined storage capacity usage as metadata associated with the primary volume object, and to dynamically update the metadata responsive to changes in the snapshot lineage.

Abstract: A query including at least a first part and a second part can be received by an electronic system. The first part of the query can indicate to access at least a first database table and a second database table to generate an intermediate result. The second part of the query can indicate to perform a sort operation on the intermediate result with respect to columns across the first database table and the second database table to produce a final result. The method further includes building execution plans for generating the intermediate result according to the first part, where the intermediate result is to be used as the final result without building an execution plan for performing the sort operation.

Abstract: A computing system includes a computer in communication with a tiered storage system. The computing system identifies a set of data transferring to a storage tier within the storage system. The computing system identifies a program to which the data set is allocated and determines to increase or reduce resources of the computer allocated to the program, based on the set of data transferring to the storage tier. The computing system discontinues transferring the set of data to the storage tier if a resource allocated to the program cannot be increased.

Abstract: A key retrieval system includes a management system and a managed system that is coupled to the management system through a network. The managed system includes a managed device, a management system configuration storage, a remote access controller device that stores a management system configuration for the management system in the management system configuration storage and provides a key management client subsystem that is configured to use the management system configuration to access the management system. The managed system also includes a BIOS. The BIOS detects an event that triggers unlocking the managed device. The BIOS determines that the remote access controller device is unavailable and, in response, retrieves the management system configuration and accesses the management system using the management system configuration. The BIOS then retrieves the locking key from the management system and unlocks the managed device using the locking key.

Abstract: A plurality of computing devices are communicatively coupled to each other via a network, and each of the plurality of computing devices is operably coupled to one or more of a plurality of storage devices. A plurality of failure resilient stripes is distributed across the plurality of storage devices such that each of the plurality of failure resilient stripes spans a plurality of the storage devices. A graphics processing unit is operable to access data files from the failure resilient stripes, while bypassing a kernel page cache. Furthermore, these data files may be accessed in parallel by the graphics processing unit.

Abstract: A first event occurs at a first computer at a first time, as measured by a local clock. A second event is initiated at a second computer by sending a message that includes the first time. The second event occurs at a second time, as measured by a local clock. Because of clock error, the first time is later than the second time. Based on the first time being later than the second time, an alternate second time, that is based on the first time, is used as the time of the second event. When a third system determines the order of the two events, the first time is obtained from the first computer, and the alternate second time is obtained from the second computer, and the order of the events is determined based on a comparison of the two times.

Abstract: A plurality of computing devices are communicatively coupled to each other via a network, and each of the plurality of computing devices is operably coupled to one or more of a plurality of storage devices. A plurality of failure resilient stripes is distributed across the plurality of storage devices such that each of the plurality of failure resilient stripes spans a plurality of the storage devices. A graphics processing unit is operable to access data files from the failure resilient stripes, while bypassing a kernel page cache. Furthermore, these data files may be accessed in parallel by the graphics processing unit.

Abstract: Data processing apparatus comprises one or more processing elements to execute processing instructions; address translation circuitry to perform address translations between a virtual address space and a physical address space, the address translations being defined by a current hierarchical set of address translation tables selected from two or more hierarchical sets of address translation tables, the address translation circuitry being responsive to current table definition data providing at least a pointer to a memory location of the current hierarchical set of address translation tables; the one or more processing elements being configured to overwrite the current table definition data with second table definition data providing at least a pointer to a memory location of a second, different, hierarchical set of address translation tables of the two or more hierarchical sets of address translation tables; the one or more processing elements being configured to execute test instructions requiring address tr

Abstract: A method for dynamically altering logical storage capacity within multiple storage drives is disclosed. In one embodiment, such a method monitors, within a storage environment, characteristics (e.g., age, wear, etc.) of multiple storage drives. Each storage drive has an amount of overprovisioning associated therewith. Based on the characteristics, the method periodically modifies a logical storage capacity of the storage drives in order to alter the amount of overprovisioning. The method then reorganizes the storage drives within various storage groups (e.g., RAID arrays, storage tiers, workloads, etc.) based on their logical storage capacity. For example, the method may place, as much as possible, storage drives of the same logical storage capacity within the same storage groups. A corresponding system and computer program product are also disclosed.

Abstract: A computer-implemented method according to one embodiment includes partitioning resources of a network file system (NFS) platform into a plurality of zones, based on a number of exports within the NFS platform; receiving, at one of the exports within the NFS platform, a request from a first application to utilize the resources of the NFS platform; and allocating a predetermined portion of the resources to the first application within one of the plurality of zones, based on information included within the request.

Abstract: Systems and methods are described for providing an implementation of the MapReduce programming model utilizing tasks executing on an on-demand code execution system or other distributed code execution environment. A coordinator task may be used to obtain a request to process a set of data according to the implementation of the MapReduce programming model, to initiate executions of a map task to analyze that set of data, and to initiate executions of a reduce task to reduce outputs of the map task executions to a single results file. The coordinator task may be event-driven, such that it executes in response to completion of executions of the map task or reduce tasks, and can be halted or paused during those executions. Thus, the MapReduce programming model may be implemented without the use of a dedicated framework or infrastructure to manage map and reduce functions.

Abstract: An application monitoring system for identifying and removing unused components from memory associated with an application. Embodiments identify a range, a set of historical logs associated with the range, and components in each historical log. Each component is classified based on a frequency of use of the component, the most recent time the component was used, the number of periods between the most recent use of the component and the range end point, and the number of periods between the most recent use of the component and the previous use of the component. Unused and rarely used components are isolated or removed from the memory.

Abstract: Technology for configuring and executing a shallow virtual machine to enhance memory protection between different portions of user space memory of a particular computing process. An example method may involve: associating a computing process with a virtual machine data structure, wherein the computing process initiates an update to the virtual machine data structure to cause a processor to switch between a page table structures; loading first and second executable code into user space memory of the computing process, wherein a first page table structure comprises mapping data for the first and second executable code and wherein the second executable code comprises driver code of a device; updating the second page table structure to disable execution of the first executable code and to map a portion of the user space memory to the device; and restricting the first executable code from accessing the memory mapped device.

Abstract: A method includes detecting, by a vault management device, a failed storage unit common to a first vault and a second vault. The first vault is associated with a first set of storage units and the second vault is associated with a second set of storage units. The failed storage unit is in each of the first and second sets of storage units. The method further includes identifying a number of non-failed storage units of the first and second sets of storage units and comparing the number of non-failed storage units with first and second decode threshold numbers to determine a failure impact level. The first decode threshold number is associated with the first vault and the second decode threshold number is associated with the second vault. The method further includes determining a failure abatement approach based on the failure impact level and facilitating the failure abatement approach.

Abstract: A semiconductor device includes an error correction circuit and a write operation control circuit. The error correction circuit generates corrected data and an error flag from read data according to whether an error is included in the read data outputted when a read operation is performed. The write operation control circuit generates a write control signal for controlling a write operation based on the error flag.

Abstract: A plurality of computing devices are communicatively coupled to each other via a network, and each of the plurality of computing devices is operably coupled to one or more of a plurality of storage devices. A plurality of failure resilient stripes is distributed across the plurality of storage devices such that each of the plurality of failure resilient stripes spans a plurality of the storage devices. A graphics processing unit is operable to access data files from the failure resilient stripes, while bypassing a kernel page cache. Furthermore, these data files may be accessed in parallel by the graphics processing unit.

Abstract: A method for managing objects stored in memory is presented. The method may include receiving, by a memory allocator in a garbage collected system, a first free memory chunk. The method may include creating a node to associate with the first free memory chunk and ensuring that a first memory region containing the node will be considered to be free memory during a sweeping phase of the garbage collected system.

Abstract: A system and method is disclosed for managing data in a non-volatile memory. The system may include a non-volatile memory having multiple non-volatile memory sub-drives. A controller of the memory system is configured to route incoming host data to a desired sub-drive, keep data within the same sub-drive as its source during a garbage collection operation, and re-map data between sub-drives, separate from any garbage collection operation, when a sub-drive overflows its designated amount logical address space. The method may include initial data sorting of host writes into sub-drives based on any number of hot/cold sorting functions. In one implementation, the initial host write data sorting may be based on a host list of recently written blocks for each sub-drive and a second write to a logical address encompassed by the list may trigger routing the host write to a hotter sub-drive than the current sub-drive.

Abstract: The present disclosure is directed to a memory management method and to a memory management device arranged to execute memory allocation and/or memory deallocation by use of segregated free lists, which provide information on memory chunks, wherein the memory allocation and/or the memory deallocation are executed according to states of the memory chunks, and wherein the states of the memory chunks comprise: an used state indicating that a memory chunk, which is in used state, is in use, and is not available for allocation; a linked state indicating that a memory chunk, which is in linked state, is not used, is linked within a free list of the segregated free lists, and is available for allocation; a free state indicating that a memory chunk, which is in free state, is not used, is not linked within any of the segregated free lists, and is not available for allocation.

Abstract: Embodiments of the present disclosure describe a troubleshooting method, apparatus, and system, and pertain to the field of troubleshooting. An embodiment of the method may include monitoring, by a virtualized network function (VNF), an operating status of at least one virtual machine (VM) inside the VNF. The method may also include determining, by the VNF according to a fault when the fault occurs on the VM, whether to perform VM rebuilding recovery. Furthermore the method may include sending, by the VNF, a rebuilding recovery request to a virtualized network function manager (VNFM) when determining to perform the VM rebuilding recovery. In this way, when the fault occurs on the VM, the VIM performs automatic rebuilding recovery for the VM by interactions between the VNFM and the VIM.

Abstract: A system and method is disclosed for managing data in a non-volatile memory. The system may include a non-volatile memory having multiple non-volatile memory sub-drives. A controller of the memory system is configured to route incoming host data to a desired sub-drive, keep data within the same sub-drive as its source during a garbage collection operation, and re-map data between sub-drives, separate from any garbage collection operation, when a sub-drive overflows its designated amount logical address space. The method may include initial data sorting of host writes into sub-drives based on any number of hot/cold sorting functions. In one implementation, the initial host write data sorting may be based on a host list of recently written blocks for each sub-drive and a second write to a logical address encompassed by the list may trigger routing the host write to a hotter sub-drive than the current sub-drive.

Abstract: The present application is directed to a memory-access-multiplexing memory controller that can multiplex memory accesses from multiple hardware threads, cores, and processors according to externally specified policies or parameters, including policies or parameters set by management layers within a virtualized computer system. A memory-access-multiplexing memory controller provides, at the physical-hardware level, a basis for ensuring rational and policy-driven sharing of the memory-access resource among multiple hardware threads, cores, and/or processors.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for migrating data from a first storage system to a second storage system. That data is for a process (e.g., a virtual machine, application, or some other process) operating on a computer system that is separate from the first storage system and the second storage system. That data is stored according to data subsets that are each exclusive of each other. As each data set is migrated, access to the data set by the process is precluded, but access for the remaining data sets is not affected. Once the data migration is complete, access to the data set by the process is restored.

Abstract: An information processing apparatus includes a processor, a memory, and a storage device. The processor includes a plurality of sub-processors. The memory stores data of part of pages included in an address space allocated to processes executable in parallel using the plurality of sub-processors. The storage device retreats data of pages that are not stored in the memory. The processor acquires a working set size for each of the processes. The working set size indicates an amount of pages used for a unit time. The processor selects part of the processes when a sum of working set sizes of the processes exceeds a predetermined threshold value. The processor stops the selected processes for a predetermined time. The processor controls data of pages corresponding to the processes being stopped to be retreated from the memory to the storage device.

Abstract: Systems, methods, and devices for generating a transactional change tracking summary for a database. A method includes executing a transaction on a table of a database, wherein the table includes a micro-partition and the transaction is executed on the micro-partition. The method includes, in response to the transaction being fully executed, generating a change tracking entry comprising an indication of one or modifications made to the table by the transaction. The method includes storing the change tracking entry in a change tracking stream, wherein the change tracking stream includes one or more sequential change tracking entries that each correspond to a different transaction that is fully executed on the table.

Abstract: A memory system includes a memory device and a controller. The memory device includes first and second memory groups. The controller includes a resource controller and first and second flash translation layer (FTL) cores. Each of the first and second FTL cores manages a plurality of logical addresses (LAs) that are mapped, respectively, to a plurality of physical addresses (PAs) of a corresponding memory group. The resource controller determines LA use rates of the first and second FTL cores, selects a source FTL core and a target FTL core from the first and second FTL cores using the LA use rates, and balances the LA use rates of the source FTL core and the target FTL core by moving data stored in storage spaces associated with a portion of the LAs from the source FTL core to storage spaces associated with the target FTL core.

Abstract: An addressing scheme in systems utilizing a number of operative memory slices in a last level cache that is not evenly divisible by a number of memory channels utilizes the operative slices exposes the full last level cache bandwidth and capacity to data processing logic in a high-performance graphics system.

Abstract: The subject technology obtains, at a database system, an ingest request to ingest one or more files into a table of a database. The subject technology, after obtaining the ingest request and prior to the ingesting of the one or more files, persists the one or more files in a file queue that corresponds to the table. The subject technology assigns the one or more files to one or more execution nodes to be ingested into the table. The subject technology operates an ingest puller to poll the file queue. The subject technology ingests, by the one or more execution nodes, the one or more files into one or more micro-partitions of the table via one or more pipes.

Abstract: Systems and methods are provided to enable control and placement of data repositories. In some embodiments, the system segments data into zones. A website, for example, may need to segment data according to location. In this example, a zone may be created for North America and another zone may be created for Europe. Data related to operations executed in North America, for example, can be placed in the North America zone and data related to transactions in Europe can be placed in the Europe zone. According to some embodiments, the system may use zones to accommodate a range of deployment scenarios.

Abstract: Systems and methods for random fill caching and prefetching for secure cache memories are provided. The system dynamically de-correlates fetching a cache line to the processor from filling the cache with this cache line, due to a demand memory access, in order to provide greater security from information leakage due to cache side-channel attacks on cache memories. The system includes a random fill engine which includes a random number generator and an adjustable random fill window. Also provided is an adaptive random fill caching system which dynamically adapts the random fill window to a wide variety of computational workloads. Systems and methods for cache prefetching to improve system performance using adaptive random fill prefetching and random fill prefetching are also provided.

Abstract: This application relates to apparatus and methods for automatically determining and providing digital advertisements to targeted users. In some examples, a computing device receives campaign data identifying items to advertise on a website, and generates campaign user data identifying a user that has engaged all of the items on the website. The computing device may then determine a portion of the users based on a relationship between each user and the campaign user data, and may determine user-item values for each of the items for each user of the portion of users, where each user-item value identifies a relational value between the corresponding user and item. The computing device may then identify one or more of the items to advertise to each user of the portion of users based on the user-item values, and may transmit to a web server an indication of the items to advertise for each user.

Abstract: A system for performing a computation includes an interface and a processor. The interface is configured to receive an indication of the computation. The processor is configured to determine whether the computation is with respect to a computation version number. In response to a determination that the computation is with respect to a computation version number: 1) determine whether the system has been updated to at least the computation version number; and 2) in response to a determination that the system has been updated to at least the computation version number: a) determine a set of data values for the computation associated with the computation version number; b) perform a partition reduce operation on the set of data values to determine a partition result; and c) provide the partition result.

Abstract: Systems and methods for migrating and/or replicating computer systems are disclosed. Computer systems may be migrated and/or replicated from physical systems or virtual systems to physical or virtual systems. Migrating/replicating computer systems comprises determining the structure of the source computer system, generating instructions for migrating/replicating the structure of the computer system, and packaging the instructions in an executable package. The instructions may be formatted as a template, such as an OVF template, and be packaged with an executable agent and task list. The executable agent may be received and executed by a destination computer system. Executing the executable package may cause the instructions to be executed, as well as the optional agent, there configuring the destination computer system, possibly copying data present on the source computer system, and possibly rebooting the destination computer system.

Abstract: Disclosed in some examples are methods, systems, machine-readable mediums, and NAND devices which create logical partitions when requested to create a physical partition. The controller on the NAND mimics the creation of the physical partition to the host device that requested the physical partition. Thus, the host device sees the logical partition as a physical partition. Despite this, the NAND does not incur the memory storage expense of creating a separate partition, and additionally the NAND can borrow cells for overprovisioning from another partition. In these examples, a host device operating system believes that a physical partition has been created, but the NAND manages the memory as a contiguous pool of resources. Thus, a logical partition is created at the NAND memory controller level—as opposed to at the operating system level.

Abstract: Systems, methods, and devices for batch ingestion of data into a table of a database. A method includes determining a notification indicating a presence of a user file received from a client account to be ingested into a database. The method includes identifying data in the user file and identifying a target table of the database to receive the data in the user file. The method includes generating an ingest task indicating the data and the target table. The method includes assigning the ingest task to an execution node of an execution platform, wherein the execution platform comprises a plurality of execution nodes operating independent of a plurality of shared storage devices collectively storing database data. The method includes registering metadata concerning the target table in a metadata store after the data has been fully committed to the target table by the execution node.

Abstract: A method, computer program product, and computer system for physical memory allocation of a computer system, the method including collecting computer system architecture specifications, a configuration, and user requirements, identifying a plurality of memory intervals to be allocated, based on the computer system architecture specification, the configuration, and the user requirements, grouping memory intervals into a plurality of color groups, wherein each memory interval within each of the plurality of color groups comprise identical memory attributes, dividing memory into sets of memory segments, wherein each set of memory segment is assigned a color of the plurality of color groups, allocating a memory interval of the plurality of memory intervals within the set of memory segments of corresponding color, and selecting a page size for a translation of a memory interval of the plurality of memory intervals, depending upon the allocation of the memory interval and the sets of memory segments.

Abstract: A method and an apparatus for recovery of a file system using metadata and data clusters. The apparatus for recovery of a file system generates an MFT entry list in a disc or an evidence image, collects at least one data cluster candidate, and uses at least one MFT entry and at least one data cluster candidate within the MFT entry list to generate at least one MFT entry-data cluster pair candidate. The apparatus for recovery of a file system analyzes the at least one MFT entry-data cluster pair candidate to determine attribute values of a virtual partition and generate the virtual partition based on the attribute values.