System and method for directly accessing data from a data storage medium

• US 20060230291A1
• Filed: 04/12/2005
• Published: 10/12/2006
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Burtscher, Michael
• Granted Patent: US 7,565,695 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

Systems and methods for scanning files for pestware on a protected computer are described. In one variation, locations of each of a plurality of files in a file storage device of the protected computer are identified while substantially circumventing an operating system of the protected computer. Information from each of the plurality of files is retrieved and analyzed so as to determine whether any of the plurality of files are potential pestware files. In variations, the operating system is circumvented while the information from each of the plurality of files is retrieved. In other variations, before information is retrieved from each of the plurality of files, a listing of the plurality of files is sorted according to the locations of the files on the storage device so as to reduce, even further, the time required to access the plurality of files.

Claims

1. A method for scanning files on a protected computer for pestware comprising:

identifying a location of each of at least a first file, a second file and a third file in a file storage device of the protected computer;

retrieving, while substantially circumventing an operating system of the protected computer, information from the first file; and

analyzing the information from the first file to determine whether the first file is a potential pestware file.

2. The method of claim 1 wherein the identifying includes identifying the location of each of at least the first file, the second file and the third file while substantially circumventing the operating system.

3. The method of claim 2 wherein the identifying includes:

accessing a master file table of the file storage device, while substantially circumventing the operating system; and

identifying the location of each of at least the first file, the second file and the third file by analyzing the data of the master file table.

4. The method of claim 1 wherein the identifying includes utilizing the operating system to identify the first file, the second file and the third file.

5. The method of claim 1 wherein the identifying includes identifying a cluster number of each of the a first file, a second file and a third file in a disk drive of the protected computer.

6. The method of claim 1 including:

sorting, by location on the file storage device, the first, second and third files so as to generated a sorted list, wherein the retrieving includes retrieving information from the first, the second and the third files by sequentially accessing the first, second and third files in the order the first, second and third files are listed in the sorted list.

7. A method for scanning files on a protected computer for pestware comprising:

identifying, while substantially circumventing an operating system of the protected computer, a location of each of a plurality of files in a file storage device of the protected computer;

retrieving information from each of the plurality of files; and

analyzing the information from each of the plurality of files so as to determine whether any of the plurality of files are potential pestware files.

8. The method of claim 7 wherein the identifying includes:

accessing a master file table of the file storage device, while substantially circumventing the operating system; and

identifying the location of each of the plurality of files by analyzing the data of the master file table.

9. The method of claim 7 wherein the retrieving includes utilizing the operating system to retrieve information from each of the plurality of files.

10. The method of claim 7 wherein the identifying includes identifying a cluster number of each of the plurality of files in a disk drive of the protected computer.

11. The method of claim 7 including:

sorting, by location on the file storage device, the plurality of files so as to generate a sorted list, wherein the retrieving includes retrieving information from each of the plurality of files by sequentially accessing each of the plurality of files in the order the plurality of files are listed in the sorted list.

12. A system for managing pestware comprising:

a pestware detection module configured to detect pestware on a protected computer, the protected computer including at least one file storage device and a program memory; and

a sweep speedup module configured to;

identify, while substantially circumventing an operating system of the protected computer, a location of each of a plurality of files in the at least one file storage device of the protected computer;

retrieve information from each of the plurality of files;

wherein the pestware detection module is configured to analyze the information from each of the plurality of files so as to determine whether any of the plurality of files are potential pestware files.

13. The system of claim 12 wherein the sweep speedup module is configured to:

access, while substantially circumventing the operating system, a master file table of the file storage device; and

identify the location of each of the plurality of files by analyzing the data of the master file table.

14. The system of claim 12 wherein the sweep speedup module is configured to utilize the operating system to retrieve information from each of the plurality of files.

15. The system of claim 12 wherein the sweep speedup module is configured to identify a cluster number of each of the plurality of files in a disk drive of the protected computer.

16. The system of claim 12 wherein the sweep speedup module is further configured to:

sort, by location on the file storage device, the plurality of files so as to generate a sorted list, wherein the sweep speedup module is configured to retrieve information from each of the plurality of files by sequentially accessing each of the plurality of files in the order the plurality of files are listed in the sorted list.

17. The system of claim 12 wherein the protected computer includes a plurality of storage devices, and wherein the plurality of files are distributed among the plurality of storage device.