Restoration of a computer to a previous working state

• US 6,802,025 B1
• Filed: 06/30/2000
• Issued: 10/05/2004
• Est. Priority Date: 06/30/1999
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Thomas, Anil Francis, Soy, Nirmal R., Harder, Barbara, Chavez, Anthony, Marok, Kwanjalit S.
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US09/607,740
• Time in Patent Office: 1,558 Days
• Field of Search: 714/15, 714/16, 714/13, 714/6, 714/7, 714/20, 714/21, 714/42, 714/47, 714/54, 711/133, 711/134, 711/159
• US Class Current: 714/15
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44552 Conflict resolution, i.e. enabling coexistence of conflicting executables
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99954 Version management

Abstract

Methods and systems for backing up and restoring the state of a computer system are disclosed. Computer resource use is minimized by combining the backup methods of file copying and file logging. During backup, copies are stored of those files that are expected to change frequently. For other files, changes are noted in a change log and backup copies may be made if they would be useful when later restoring the files. Restoration proceeds by overwriting the frequently-changing files with stored copies and by undoing the changes to the logged files.

Claims

1. A method for restoring files that have previously been subjected to a backup process on a computer, wherein the backup process stores copies of some files and records changes made to other files, the method comprising:

for files copied during the backup process, overwriting current versions of the files with copies stored during the backup process; and

for files whose changes were recorded during the backup process, undoing the changes.

2. The method of claim 1 further comprising:

monitoring some files to prevent unauthorized changes; and

authorizing changes to the monitored files when made in the course of the restore process.

3. The method of claim 1 wherein for files whose changes were recorded during the backup process:

examining the recorded changes to select only those changes that, either singly or in combination with other changes, affect the current state of the file; and

undoing only the selected changes.

4. A computer-readable medium having computer-executable instructions for performing the method of claim 1.

5. A method for monitoring access to a file, comprising:

intercepting a call to the file system;

if the intercepted call involves the monitored file, calling a monitoring routine; and

upon completion of the monitoring routine, passing the intercepted call to the file system for execution.

6. The method of claim 5 wherein intercepting is run in kernel mode.

7. The method of claim 5 wherein if the intercepted call has the potential for changing the monitored file, then creating a copy of the monitored file.

8. The method of claim 7 wherein if the intercepted call is not successfully executed by the file system, deleting the copy of the monitored file.

9. The method of claim 5 wherein if the intercepted call has the potential for changing the monitored file, recording the change.

10. The method of claim 9 wherein if the intercepted call is not successfully executed by the file system, deleting the record of the change.

11. The method of claim 5 further comprising deciding, based upon the type of the intercepted call, whether to copy the monitored file or to record the change.

12. A computer-readable medium having computer-executable instructions for performing the method of claim 5.

13. A computer-readable medium having stored thereon a data structure, comprising:

a first data field containing data representing a file that a file system monitoring routine should monitor;

a second data field containing data representing a file operation in response to which the file system monitoring routine will log the file operation; and

a third data field containing data representing a file operation in response to which the file system monitoring routine will copy the monitored file and record the copying operation.

14. A method for backing up and restoring a state of a computer file system associated with a restore point, the method comprising:

for each file in a first group of files, making a copy of a version of the file associated with the restore point and recording the making of the copy in a restore log;

monitoring files in a second group of files for changes and recording the changes in the restore log;

monitoring some files to prevent unauthorized changes, and authorizing changes to the monitored files when made in the course of restoring the state of the file system;

for each file in the first group of files, overwriting a current version of the file with the copy of the version associated with the restore point; and

for each file in the second group of files, undoing the changes recorded in the restore log.

15. A computer-readable medium having computer-executable instructions and computer-readable data for performing the method of claim 14.

16. A method for backing up and restoring a state of a computer file system associated with a restore point, the method comprising:

for each file in a first group of files, making a copy of a version of the file associated with the restore point and recording the making of the copy in a restore log;

monitoring files in a second group of files for changes and recording the changes in the restore log;

for each file in the first group of files, overwriting a current version of the file with the copy of the version associated with the restore point; and

for each file in the second group of files, (1) examining the recorded changes to select those changes that, either singly or in combination with other changes, affect a current state of the file, and (2) undoing the selected changes.

17. A computer-readable medium having computer-executable instructions and computer-readable data for performing the method of claim 16.

18. A method for backing up and restoring a state of a computer file system associated with a restore point, the method comprising:

for each file in a first group of files, making a copy of a version of the file associated with the restore point and recording the making of the copy in a restore log;

monitoring files in a second group of files for changes and recording the changes in the restore log;

monitoring some files to prevent unauthorized changes, and authorizing changes to the monitored files when made in the course of restoring the state of the file system;

for each file in the first group of files, overwriting a current version of the file with the copy of the version associated with the restore point; and

for each file in the second group of files, (1) examining the recorded changes to select those changes that, either singly or in combination with other changes, affect a current state of the file, and (2) undoing the selected changes.

19. A computer-readable medium having computer-executable instructions and computer-readable data for performing the method of claim 18.