Comm Vault Systems, Inc.

Amit Bhaskar Ausarkar

Amit Mitkar

Andrei Erofeev

Ajay Venkat Nagrale

Vijay H Agrawal

Deepak Raghunath Attarde

Sri Karthik Bhagi

Arun Prasad Amarendran

Mrityunjay Upadhyay

PurnaChandra Sekhar Bedhapudi

This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.

Ransomware detection and data pruning management

Recovery points can be used for replicating a virtual machine and reverting the virtual machine to a different state. A filter driver can monitor and capture input/output commands between a virtual machine and a virtual machine disk. The captured input/output commands can be used to create a recovery point. The recovery point can be associated with a bitmap that may be used to identify data blocks that have been modified between two versions of the virtual machine. Using this bitmap, a virtual machine may be reverted or restored to a different state by replacing modified data blocks and without replacing the entire virtual machine disk.

Time-based virtual machine reversion

Certain embodiments described herein relate to an improved block-level replication system. One or more components in an information management system may receive a request to perform a block-level replication between a source storage device and a destination storage device, and depending on the specific replication mode requested, (i) store block-level changes directly to the destination storage device or (ii) first to a recovery point store and then later to the destination storage device.

Block-level data replication

Buffered virtual machine replication

Virtual machine recovery point selection

Growing community of inventors

Ocean, NJ, United States of America

Amit Bhaskar Ausarkar