Acronis International Gmbh

Alexey Sergeev

Serguei M Beloussov

Stanislav Protasov

Vladimir Strogov

Anton Enakiev

Andrey Kulaga

Anatoly Stupak

Maxim V Lyadvinsky

Alexey Dod

Oleg Ishanov

Oleg Melnikov

Igor Kornachev

Igor E Korshunov

Alexey Kostushko

Konstantin Karikov

Disclosed herein are systems and methods for updating select files in an image backup. In an exemplary aspect, a method comprises performing an image backup of a storage device comprising a plurality of files. The method comprises selecting a file of the plurality of files based on file selection rules and subsequent to the image backup, detecting that the file has exited a full consistency state. The method comprises monitoring the file to detect a return to the full consistency state. In response to detecting that the file has returned to the full consistency state, the method comprises identifying a physical address of at least one sector comprising the file on the storage device, and updating a version of the file previously captured in the image backup with a version of the file after returning to the full consistency state.

Systems and methods for updating select files in an image backup

The invention relates to data recovery technology. Each created backup is checked for the integrity of the placed files, while calculating the checksums of each block of data that can be restored from the backup. The computer system is restored from a backup copy by connecting it using the archive copy connection driver, which creates a virtual disk that is readable by standard means of the operating system of the computer system being restored. The booting of the operating system is performed from the virtual disk and, after restoring the functioning of the computer system, the system volume that has been damaged is restored from the backup copy to the local storage medium.

Universal platform for data protection

Disclosed herein are systems and method for selectively restoring a computer system to an operational state. In an exemplary aspect, the method may include creating a backup image of the computer system comprising a set of data blocks, detecting that the computer system has begun an initial startup, identifying a subset of the data blocks read from a disk of the computer system during the initial startup. In response to determining that the computer system should be restored, the method may include restoring the subset of the data blocks such that the computer system is operational during startup, and restoring a remaining set of the data blocks from the backup image after the startup of the computer system.

System and method of selectively restoring a computer system to an operational state

Disclosed herein are systems and method for inspecting archived slices for malware. In one exemplary aspect, the method comprises identifying a first slice in a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time. The method comprises scanning the first slice of the plurality of slices in the backup archive and detecting at least one infected file in the first slice. The method comprises identifying a block of the first slice that corresponds to the at least one infected file. The method comprises mounting, to a disk, a second slice of the plurality of slices. The method comprises tracking the block and determining that the at least one infected file exists on the second slice and removing the infected file from the second slice by generating a respective cured slice of the second slice.

System and method of inspecting archive slices for malware

Disclosed herein are systems and method for selectively restoring a computer system to an operational state. In an exemplary aspect, the method may create a backup image of the computer system comprising a set of data blocks, and create and start a virtual machine based on the backup image. The method may identify a subset of the data blocks accessed from the backup image during startup of the virtual machine. In response to determining that the computer system should be restored, the method may restore the subset of the data blocks such that the computer system is operational during startup, and restore a remaining set of the data blocks from the backup image after the startup of the computer system.

Disclosed herein are systems and method for preventing malware reoccurrence when restoring a computing device using a backup image. In one exemplary aspect, a method may identify, from a plurality of backup images for a computing device, a backup image that was created most recently before the computing device was compromised. The method may mount the backup image as a disk and scanning the disk for malicious software. The method may disable all ports and services on the computing device to prevent unauthorized network connections and service launches. The method may restore data to the computing device from the mounted disk. The method may update software on the computing device and applying latest patches, and reopen the ports and restart the services on the computing device subsequent to updating the software and applying the latest patches.

System and method of preventing malware reoccurrence when restoring a computing device using a backup image

Disclosed herein are systems and method for inspecting archived slices for malware using empty spare files. In one exemplary aspect, the method comprises generating a backup slice and a virtual volume comprising a list of files in the backup slice and associated file information. The method comprises mounting the virtual volume to a disk. The method comprises creating, in the virtual volume, empty sparse files that are placeholders of the files reference in the list of files. The method comprises detecting a change between a respective empty sparse file and a corresponding file in a previous backup slice and accordingly storing the actual content of the file in the virtual volume in place of the respective empty sparse file. The method comprises scanning the virtual volume for malicious software and generating a cured slice that replaces the backup slice in the backup archive upon detection.

System and method of inspecting archive slices for malware using empty sparse files

Aspects of the disclosure describe methods and systems for performing an antivirus scan using file level deduplication. In an exemplary aspect, prior to performing an antivirus scan on files stored on at least two storage devices, a deduplication module calculates a respective hash for each respective file stored on the storage devices. The deduplication module identifies a first file stored the storage devices and determines whether at least one other copy of the first file exists on the storage devices. In response to determining that another copy exists, the deduplication module stores the first file in a shared database, replaces all copies of the first file on the storage devices with a link to the first file in the shared database, and performs the antivirus scan on (1) the first file in the shared database and (2) the files stored on the storage devices.

System and method for performing an antivirus scan using file level deduplication

In part, the disclosure relates to a backup and restoration system for a transactional log based journaling application. The system includes a transactional log backup process executing on one or more computing devices; an archive stored in non-transitory computer readable memory; and a binary difference file generator in electronic communication with the archive and responsive to instructions from the transactional log backup process. In one embodiment, the binary difference file generator includes a backup driver in electrical communication with and responsive to communication signals from the transactional backup process.

Systems and methods of backup and recovery of journaling systems

Disclosed herein are systems and method for disaster recovery using application streaming. In one aspect, a method includes generating a backup image of a computing system having at least one installed application and user data. The generating involves including the user data in the backup image and actively excluding program data files of the at least one installed application from the backup image. The method includes determining an application package specifying the installed application. The application package is stored at an application streaming service. Responsive to detecting a disaster recovery event, the method further includes copying the user data from the backup image to a recovery computing instance, and executing, on the recovery computing instance, a remote application from the application streaming service based on the determined application package.

System and method for disaster recovery using application streaming

Disclosed herein are systems and method for inspecting archived slices for malware. In one exemplary aspect, the method comprises mounting, to a disk, a first slice of a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time. The method further comprises detecting a modified block of the mounted, identifying at least one file in the mounted first slice that corresponds to the detected modified block, and scanning the at least one file for viruses and malicious software. In response to detecting that the at least one file is infected, the method comprises generating a cured slice that comprises the user data of the mounted first slice without the at least one file.

Disclosed herein are systems and method for selectively restoring a computer system to an operational state. In an exemplary aspect, the method may create a backup image of the computer system comprising a set of data blocks and may store the backup image of the computer system in an archive storage database. The method may determine a subset of the data blocks of the backup image that are required to keep the computer system operational. In response to determining that the computer system should be restored, the method may restore the subset of the data blocks such that the computer system is operational during startup, and may restore a remaining set of the data blocks from the backup image after the startup of the computer system.

Disclosed herein are systems and method for storing and managing states of a computing device. In one aspect, an exemplary method comprises determining an initial state of the computing device, wherein the initial state includes states of all storage sectors associated with the computing device, storing the determined initial state in an initial blocks storage, for each new state that corresponds to a respective point in time subsequent to a time at which the initial state was determined, creating a snapshot, where the created snapshot includes a difference between the initial state and the new state, for each created snapshot, identifying a set of changed blocks that are in storage, and storing the changed blocks of data to a changed blocks storage, and creating a snap-map for any number of consecutive changes based on the sets of changed blocks corresponding to the respective consecutive changes.

Method and system for storing and managing states of a computer

A system, method and computer program product for restoration of MICROSOFT Exchange Server mail. MICROSOFT Exchange Server mail is retrieved from a virtual copy of the MICROSOFT Exchange database. Virtualization is implemented by a system filter. Logs are applied to a virtualized DB in order to synchronize it with a real DB of the MICROSOFT Exchange. The data located in the remote archive does not need to be copied into the real folder, because the data is made available by virtualization means. After the logs are applied, the virtualized DB is opened (without being mounted) from files from the virtual folder. From this point on, the DB of MICROSOFT Exchange can be viewed and the data can be queried and retrieved from the virtualized DB. Thus, a single message or a mailbox can be retrieved very fast, as if it were being retrieved from a real MICROSOFT Exchange DB.

Growing community of inventors

Moscow, Russia

Alexey Sergeev