System and method for accessing data from a data storage medium

• US 20060230290A1
• Filed: 04/12/2005
• Published: 10/12/2006
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Burtscher, Michael
• Granted Patent: US 7,346,611 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/562 Static detection

Abstract

Systems and methods for managing multiple related pestware processes on a protected computer are described. One embodiment is configured to identify a location of each of a plurality of files in at least one file storage device of the protected computer and store a list of the location of each of the plurality of files. The list of the plurality of files is then sorted so as to generate a sorted list. Each of the plurality of files is then sequentially accessed as listed in the sorted list so as to retrieve information from each of the plurality of files. Information from the plurality of files is then analyzed to determine whether any of the plurality of files are potential pestware files. In variations, the files in the file storage device are enumerated, and information from the files is accessed, by circumventing the operating system of the protected computer.

Claims

1. A method for scanning files on a protected computer for pestware comprising:

identifying a location of each of at least a first file, a second file and a third file in at least one file storage device of the protected computer;

retrieving information from the first file;

analyzing the information from the first file to determine whether the first file is a potential pestware file;

accessing, after retrieving the information from the first file, the second file before accessing the third file in response to the time required to access the second file being less than the time required to access the third file;

retrieving information from the second file; and

analyzing the information from the second file to determine whether the second file is the potential pestware file.

2. The method of claim 1 including:

sorting, by location, the first file, the second file and the third file so as to generate a sorted list of files.

3. The method of claim 2 wherein the at least one file storage device is a disk drive, and wherein the sorting, by location, is sorting by the cluster numbers of the first file, the second file and the third file.

4. The method of claim 3 wherein the accessing the second file before accessing the third file is in response the second file having a cluster number that is closer to the first file than the third file.

5. The method of claim 1 wherein the identifying includes utilizing an operating system of the protected computer to identify the location of each of at least the first file, the second file and the third file.

6. The method of claim 1 wherein the identifying includes circumventing the operating system of the protected computer while identifying the location of each of at least the first file, the second file and the third file.

7. A system for managing pestware comprising:

a pestware detection module configured to detect pestware on a protected computer, the protected computer including at least one file storage device and a program memory; and

a sweep speedup module configured to;

identify a location of each of a first file, a second file and a third file in the at least one file storage device of the protected computer; and

retrieve information from each of the first file, the second file and the third file in an order determined by the respective locations of the first file, the second file and the third file in the file storage device;

wherein the pestware detection module is configured to analyze the retrieved information from each of the first file, the second file and the third file so as to determine whether each of the first file, the second file and the third file is a potential pestware file.

8. The system of claim 7 wherein the sweeup speedup module is configured to sort, by location, the first file, the second file and the third file so as to generate a sorted list of files.

9. The system of claim 8 wherein the sweep speedup module is configured to sequentially retrieve the first, the second and the third files in an order the first, the second and the third files appear in the sorted list of files.

10. The system of claim 8 wherein the at least one file storage device is a disk drive, and wherein the sweep speedup module is configured to sort the first file, the second file and the third file by the cluster numbers of the first file, the second file and the third file so as to generate the sorted list of files.

11. The system of claim 10 wherein the sweep speedup module is configured to sequentially retrieve the first, the second and the third files in an order the first, the second and the third files appear in the sorted list of files.

12. The method of claim 7 wherein the sweep speedup module is configured to identify each of the first, the second and the third files by utilizing an operating system of the protected computer to identify the location of each of at least the first file, the second file and the third file.

13. The method of claim 7 wherein the sweep speedup module is configured to identify each of the first, the second and the third files by circumventing the operating system of the protected computer while identifying the location of each of at least the first file, the second file and the third file.

14. A method for scanning files on a protected computer for pestware comprising:

identifying a location of each of a plurality of files in at least one file storage device of the protected computer;

storing a list of the location of each of the plurality of files;

sorting the list of the plurality of files so as to generate a sorted list;

accessing, sequentially, each of the plurality of files as listed in the sorted list so as to retrieve information from each of the plurality of files; and

analyzing the information from each of the plurality of files so as to determine whether any of the plurality of files are potential pestware files.

15. The method of claim 14 wherein the identifying includes utilizing an operating system of the protected computer to identify the location of each of the plurality of files.

16. The method of claim 14 wherein the identifying includes circumventing the operating system of the protected computer while identifying the location of each of the plurality of files.

17. The method of claim 14 wherein the identifying the location of each of a plurality of files includes identifying a cluster number of each of the plurality of files in a disk drive of the protected computer.

18. The method of claim 14 wherein the accessing includes accessing an operating system of the protected computer to access each of the plurality of files.

19. The method of claim 14 wherein the accessing includes circumventing an operating system of the protected computer while accessing each of the plurality of files.