Symantec Corporation

Veritas Technologies LLC

Symantec Operating Corporation

Timothy Michael Naftel

David Teater

Michael Spertus

Sinh Nguyen

Sridhar Surampudi

James Olson

Robert Chester

Mark Kevin Kennedy

Weibao Wu

Adam Glick

Kuldeep Sureshrao Nagarkar

James P Ohr

Satyajit Gorhe Parlikar

Matthew M Reker

Matthew J Kokotovich

James Robert Olson

Sinh D Nguyen

Various techniques, including a method, system and computer program product for restoring encrypted files are disclosed. The method includes accessing a file table record for an encrypted file. The file table record includes an encrypted file stream and extent information identifying a location of one or more portions of the encrypted file in a virtual machine image. In response to accessing the file table record a consecutive data stream is stored. Storing the consecutive data stream includes encapsulating the encrypted file stream and the one or more portions of the encrypted file.

Method and system for restoring encrypted files from a virtual machine image

A file backup method, which can be implemented on a virtual machine system or applied to backup files of a virtual machine, is herein described. The virtual machine system may include a virtual machine server and be associated with a backup server. Changes to a storage media are tracked through change block tracking. A location where file system records reside on the storage media is identified. Changed file system records are identified among the tracked changes to the storage media. Copies are made of the files that the changed file system records are pointing to.

Method and apparatus for file backup

Techniques for managing virtual machine backups are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for managing virtual machine backups comprising opening a file containing a virtual disk of a virtual machine, parsing the file to identify one or more partitions of the virtual disk, determining file system type for each of one or more partitions, identifying a boot partition in the file, parsing, using at least one computer processor, file system information of the boot partition to identify volume information; and generating volume composition information using the identified volume information.

Techniques for managing virtual machine backups

Techniques for managing non-snappable volumes are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for managing non-snappable volumes comprising identifying a virtual disk associated with a virtual machine, identifying a non-snappable volume associated with the virtual disk, analyzing the non-snappable volume, using at least one computer processor, to determine whether the non-snappable volume contains application data, and performing one or more responsive actions in the event the non-snappable volume is determined to contain application data.

Techniques for managing non-snappable volumes

A computer-implemented method for creating optimized synthetic backup images may include (1) transferring a backup image that represents a virtual machine at a specific point in time to a server that stores the backup image, (2) identifying a subsequent backup image that represents at least a portion of the virtual machine at a subsequent point in time, (3) creating a data stream that includes (i) at least one changed data block captured in the subsequent backup image and (ii) at least one reference that identifies where at least one unchanged data block is located within the backup image stored on the server, and then (4) transferring the data stream to the server to enable the server to create an optimized synthetic backup image of the virtual machine. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for creating optimized synthetic backup images

A method and apparatus for creating a map of files related to a virtual disk of a virtual machine comprising inspecting file system entries within at least one volume of the virtual disk; converting information related to file system entries into a map, where the map comprises file locations within a physical disk for the files related to the virtual disk.

Method and apparatus for mapping virtual drives

An optimized backup image of a virtual machine is generated. The virtual machine is associated with a virtual disk. The virtual disk includes one or more virtual volumes. Generating the optimized backup image includes excluding one or more invalid sectors of the virtual disk from the optimized backup image.

Optimized image archiving

A method and apparatus for creating and utilizing a map of files related to a virtual disk of a virtual machine. In one embodiment, the method comprises inspecting file system entries within at least one volume of the virtual disk; converting information related to file system entries into a map, where the map comprises file locations within a physical disk for the files related to the virtual disk. In another embodiment, the method comprises examining a map of an image of at least a portion of a virtual disk, accessing the image, extracting and utilizing at least one file. In yet another embodiment, the method comprises creating a map related to an image representing stored files in a virtual disk, storing the map and the image, selecting a file, examining the map, accessing the image, extracting the file from the image and restoring the file to a storage system.

Embodiments of the present invention include a method and apparatus for performing incremental mapping of virtual machine incremental images. The method and apparatus comprise creating a map of the base file as well as the incremental file, utilizing at least a portion of the file tables contained in the various images. This map indicates the type of change (i.e., whether the file is contained completely in an incremental image, is contained in the base image, or is contained in both). In another embodiment, the map may also contain the location of the change or the location of the file within the sequentially stored images upon the backup media.

Method and apparatus for mapping virtual machine incremental images

A method and apparatus for mapping virtual drives is described. In one embodiment, the method for mapping virtual drives comprises processing first locations of a plurality of file system objects within a virtual volume and converting the first locations of the plurality of file system objects within the virtual volume into second locations of the plurality of file system objects relative to a virtual drive of at least one virtual drive, wherein the at least one virtual drive form a portion of the virtual volume.

In one embodiment, a backup application transmits a remote request to a virtual machine that includes an application to be backed up. The request solicits metadata from the application that describes a structure of the data stored by the application on the virtual storage devices of the virtual machine. Using the metadata, the backup application may identify objects within the virtual machine. Accordingly, a granular restore of data to the virtual machine may be possible without installing backup software within the virtual machine.

Remote, granular restore from full virtual machine backup

In one embodiment, a backup application is disclosed which is configured to detect that one or more incremental virtual disk files are provided in a virtual machine image. The backup application may invoke a merge function in the virtual machine monitor, and may merge the incremental virtual disk files into the base virtual disk file. Redundant data is thus eliminated, and may reduce the amount of archive media needed to store the backed-up virtual machine image.

Efficient management of archival images of virtual machines having incremental snapshots

A computer has a storage device that is infected with malicious software (malware). The malware uses stealth or rootkit techniques to hide itself in the storage device. A security module within the storage device detects the malware by comparing the files read from the storage device to those reported by the operating system. Upon detecting the malware, the security module prepares the computer for malware obfuscation by storing information describing the location of the malware, deploying an executable file, and configuring it to run on reboot. The executable file executes upon reboot and locates the data on the storage device associated with the malware. The executable file obfuscates the data so that the malware no longer loads at boot time, thereby disabling the rootkit technique. The computer reboots and the security module remediates the malware infection.

Growing community of inventors

Longmont, CO, United States of America

Timothy Michael Naftel