Using intermediate mappings to prevent data loss from ransomware

Abstract

A storage driver for a storage space (e.g., hard disk volume) may use intermediate mappings for write, create, and delete requests to prevent data loss from ransomware. The storage driver receives a request to overwrite a data item (e.g., file or object) at a first location of a storage space and in response, writes data to a second location of the storage space. The storage driver also generates a write mapping that associates the first location with the second location. At a later point in time, the storage driver may determine whether to commit the request to overwrite the data item. If the storage driver determines not to commit the request to overwrite the data item (due to the data being the result of a ransomware attack), then the storage driver deletes the write mapping, preventing the first location from being overwritten (preventing data loss from a ransomware attack).