Code 42 Software, Inc.

Crashplan Group LLC

Peter John Lindquist

Brian Bispala

Matthew Dornquast

Brad Armstrong

Marshall Scorcio

Christopher Parker

Damon Allison

Rory Lonergan

Daniel L Sullivan

Vijay Ramanathan

Justin Grammens

Brent Aethon McCullough

Christopher Michael Montgomery

Samuel Schroeder

Bradley David Bebchuk

Christopher Gwinn

Thomas (Tony) Lindquist

Samuel Lindsay-Levine

Charles Rostance

Jens Knutson

Robert Bajorek

Bret McGuire

Jeffrey Howie

Erik Mainz

Colt Covington

Peter Clark

Marc Everett Johnson

Mitch Coopet

A system for forensic file services is configured to receive data indicative of operations executed on a filesystem element stored on a computing resource associated with a first tenant, to and adjust the data according to an indicated database schema. The system is also configured to store the adjusted data in a record of a partition of a database, where the partition configured to store a history of operations executed on filesystem elements of computing resources associated with the first tenant. The system is further configured to receive a search request to search the database and to execute the search request on a second partition of the database to identify one or more matching records. The system is additionally configured to provide the identified records in response to the search request.

Forensic file service

In connection with a data distribution architecture, client-side 'deduplication' techniques may be utilized for data transfers occurring among various file system nodes. In some examples, these deduplication techniques involve fingerprinting file system elements that are being shared and transferred, and dividing each file into separate units referred to as 'blocks' or 'chunks.' These separate units may be used for independently rebuilding a file from local and remote collections, storage locations, or sources. The deduplication techniques may be applied to data transfers to prevent unnecessary data transfers, and to reduce the amount of bandwidth, processing power, and memory used to synchronize and transfer data among the file system nodes. The described deduplication concepts may also be applied for purposes of efficient file replication, data transfers, and file system events occurring within and among networks and file system nodes.

Deduplicated data distribution techniques

Systems and techniques for detecting suspicious file activity are described herein. System for identifying anomalous data events is adapted to monitor a networked file system and receive an indication of a suspicious event associated with a user and a file. The system is further adapted to perform a pattern of behavior analysis for the user, perform an adjacency by time analysis based on a set of events before the suspicious event and a set of events after the suspicious event, and perform an adjacency by location analysis using a set of files located in a location of the file. The system is further adapted to determine whether the suspicious event is an anomalous event based on the pattern of behavior analysis, the adjacency by time analysis, and the adjacency by location analysis and display a report for the user including the anomalous event.

Detecting suspicious file activity

In connection with a data distribution architecture, client-side 'deduplication' techniques may be utilized for data transfers occurring among various file system nodes. In some examples, these deduplication techniques involve fingerprinting file system elements that are being shared and transferred, and dividing each file into separate units referred to as 'blocks' or &#x201c;chunks.&#x201d; These separate units may be used for independently rebuilding a file from local and remote collections, storage locations, or sources. The deduplication techniques may be applied to data transfers to prevent unnecessary data transfers, and to reduce the amount of bandwidth, processing power, and memory used to synchronize and transfer data among the file system nodes. The described deduplication concepts may also be applied for purposes of efficient file replication, data transfers, and file system events occurring within and among networks and file system nodes.

Disclosed in some examples are methods, systems, and machine readable mediums which monitor, archive, and version file system elements stored in one or more different network based file storage systems for one or more different users. Any changes to file system elements stored in the network based file storage systems are recorded and versioned. The system may allow users to revert to a previous version of a file system element, recover a deleted file system element, and the system allows for audits to determine which users placed a file system element in which network based file storage systems and determine which users had access to the file system element in the network based file storage systems. As a result, the disclosed system improves the end-user experience by providing versioning and auditing capabilities as well as allowing organizations to monitor and control their digital property in network based file storage systems.

Network based file storage system monitor

Systems and techniques for a distributed file system element collection are described herein. A node may identify a state of a file system element, which is identified in a file system element definition, from a local data store. The state corresponds to a distribution action. The file system element definition is one of a plurality of file system element definitions in a collection schema of a collection to which the node is a member. The node may, in response to identifying the state of the file system element, issue a communication to some members of the collection in furtherance of completion of the distribution action. A response may be received by the node from a participant node in the list of participant nodes. The node may complete the distribution action using content from the response.

Distributed file system backup and synchronization

Disclosed in some examples are predictive storage techniques for use in a distributed data system. The predictive storage techniques may be used to manage locally stored elements of a shared data collection, such as the storage of files on nodes of the distributed data system that are limited in local storage space. The predictive storage techniques may achieve a balance between consumption of local resources and timely access of important elements in the shared data collection. For example, the predictive storage techniques may be used for keeping or pre-caching certain items of a collection that are determined as likely to be used in local storage for convenient access, and allowing access the remaining items on request over a network.

Shared file system predictive storage techniques

Disclosed in some examples is a data distribution mechanism for distributing a collection of file system elements across one or more computing devices. The system can include a plurality of nodes implemented on a machine. The data distribution mechanism may be used in connection with data synchronization, sharing, backup, archiving, and versioning operations for a plurality of connected machines on behalf of one or a plurality of users.

System for a distributed file system element collection

Growing community of inventors

Saint Paul, MN, United States of America

Peter John Lindquist