International Business Machines Corporation

Stefan Bender

Dominic Mueller-Wicke

James Patrick Smith

Christian Mueller

Mauro Cruciani

Nils Haustein

Thomas Schreiber

Sabine U Steinhauer

Kai Boerner

Wayne A Sawdon

Oliver Augenstein

Andreas Uhl

Karl Fleckenstein

Michael Loehr

Douglas Stephen Noddings

Dietmar Fischer

Avishai Haim Hochberg

Christopher Zaremba

David George Derk

Thomas Franklin Ramke, Jr

Vadzim Ivanovich Piletski

Michael S Fruchtman

Omar Bond Vargas

Frank Mueller

Peter Tanenhaus

A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Automatic ransomware detection with an on-demand file system lock down and automatic repair function

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

In an approach to maintain data integrity in a computer data storage system, a clone management table is generated for a clone file tree that includes a relationship between at least one parent file and a clone file. The parent file is restored by: (i) determining that the parent-child relationship exists between the parent file and the clone file based on an entry in the clone management table, (ii) restoring data blocks in the parent file to the file system based on an analysis of an entry in the clone management table for the parent file and an identification of data blocks included in the clone file, and (iii) generating a new instance of the parent file based on the data blocks included in the file system and the entry in the clone management table for the clone file tree.

Clone file backup and restore

Provided are techniques for providing and managing data protection by using incremental forever for storage to cloud object stores. An incremental offload is performed by using one or more extents to identify blocks of data for a version of a virtual machine in operational recovery storage to be offloaded to a cloud object store, wherein each of the one or more extents identifies locations of the blocks of data. The blocks of data are converted to objects in an incremental forever data format. The objects are offloaded to the cloud object store. The details of the offloading of the objects are stored in a local database in the operational recovery storage. The local database is copied from the operational recovery storage to the cloud object store as a database copy.

Providing and managing data protection by using incremental forever for storage to cloud object stores

A method for accessing filesystem objects on a backup server storing block level backups, includes: receiving a request to access a filesystem object stored in the block level backups, the request including a pattern of characters identifying the filesystem object in a global history table mapping a history of filesystem objects to the block level backups; identifying, based on the pattern of characters, an object identifier in the global history table corresponding to the filesystem object; identifying, based on the object identifier, a set of one or more block level backups of the computing system having a copy of the filesystem object; selecting a block level backup from the set of one or more block level backups; mounting the selected block level backup to access a backed-up file system of the computing system; and retrieving, from the backed-up filesystem, the filesystem object.

File name level based file search and restoration from block level backups of virtual machines

A backup system retains a certain number of file versions in backups of a virtual machine running on a host computing system. Files are identified that have changed on the virtual machine since storing a backup of the virtual machine on a backup server. Host blocks on that are associated with each of the changed files are determined. Backup blocks associated with each of the host blocks are determined. The changed files and associated backup blocks are merged with previous file version information. It is determined that a version of a file has become expired, the version of the file associated with a backup block. The backup block is deleted in response to determining that the backup block is not associated with any unexpired file versions and the backup block is not associated with any unexpired virtual machine backups.

Expiration handling for block level backup of virtual machines

A method for backing a computing system includes generating a local history table of filesystem objects that have changed since storing a first backup of the computing system where the local history table includes attributes of the filesystem objects and a set of operations associated with changes to the filesystem objects. The method further includes transferring, from the computing system to a backup server, a second backup of the computing system, where the second backup includes a block level representation of a portion of a data storage medium associated with the computing system. The method additionally includes merging the local history table with a global history table stored on the backup server, the global history table mapping a history of filesystem objects to a set of block level backups of the computing system including the first backup of the computing system and the second backup of the computing system.

Block level backup of virtual machines for file name level based file search and restoration

In an approach to backup and restore one or more clone file trees, one or more processors generate a clone management table. One or more processors record a clone management information in the clone management table about each clone file. To backup a clone file, one or more processors update the clone management information, and store one or more data blocks that are in the clone file trees. To restore a clone file, one or more processors analyze a clone management information and restore one or more data blocks in the clone file. To restore a clone file parent, one or more processors analyze a clone management information and restore one or more data blocks in the clone file parent. To restore a clone file tree, one or more processors analyze a clone management information and restore one or more data blocks in the clone file tree.

A method, computer program product, and system for managing storage space in a virtualized computing environment. The method includes a computer determining, by one or more computer processors, that a virtual computer system has reached a threshold level of minimum available storage space. The storage space of the computer system is searched for an inactive snapshot file. When the inactive snapshot file is located, the inactive snapshot file is moved to a secondary storage.

Storage management in a virtual environment

Embodiments for managing data in a hierarchical storage server storing data blocks of a database system comprising primary storage devices being in an active mode and secondary storage devices being in one of an active and passive mode are provided. In response to read and write requests for data blocks at logical storage locations, a block mapping device determines physical storage locations on the storage devices. Read requests switch over secondary storage devices to the active mode when they are in the passive mode. Write requests write data blocks only to the primary storage devices. Secondary storage devices that have not been accessed for a minimum activation time may be switched over from the active to the passive mode to save power consumption and cooling. Data migration and data recall policies control moving of data blocks between the primary and secondary storage devices and are primarily based on threshold values.

Hierarchical storage management for database systems

In response to read and write requests for data blocks at logical storage locations, a block mapping device determines physical storage locations on the storage devices. Read requests switch over secondary storage devices to the active mode when they are in the passive mode. Write requests write data blocks only to the primary storage devices. Secondary storage devices that have not been accessed for a minimum activation time may be switched over from the active to the passive mode to save power consumption and cooling. Data migration and data recall policies control moving of data blocks between the primary and secondary storage devices and are primarily based on threshold values.

Growing community of inventors

Woerrstadt, Germany

Stefan Bender