System and method for directly accessing data from a data storage medium

• US 7,565,695 B2
• Filed: 04/12/2005
• Issued: 07/21/2009
• Est. Priority Date: 04/12/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Burtscher, Michael
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/104,202
• Publication Number:
  US 20060230291A1
• Time in Patent Office: 1,561 Days
• Field of Search: 713/182, 713/188, 726/22, 726/23, 726/24, 717/127, 717/131
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

Systems and methods for scanning files for pestware on a protected computer are described. In one variation, locations of each of a plurality of files in a file storage device of the protected computer are identified while substantially circumventing an operating system of the protected computer. Information from each of the plurality of files is retrieved and analyzed so as to determine whether any of the plurality of files are potential pestware files. In variations, the operating system is circumvented while the information from each of the plurality of files is retrieved. In other variations, before information is retrieved from each of the plurality of files, a listing of the plurality of files is sorted according to the locations of the files on the storage device so as to reduce, even further, the time required to access the plurality of files.

Claims

1. A method for scanning files on a protected computer for pestware, the method comprising:

identifying a location of each of at least a first file, a second file, and a third file on a file storage device of the protected computer;

sorting a listing of the first, second, and third files in accordance with their respective physical locations on the storage device to generate a sorted list;

retrieving, while circumventing an operating system of the protected computer, information from the first, second, and third files by directly and sequentially accessing the first, second, and third files in the order the first, second, and third files are listed in the sorted list;

analyzing the information from the first, second, and third files to determine whether or not each of the first, second, and third files is a potential pestware file; and

reporting results of the analyzing to a user.

2. The method of claim 1, wherein the identifying includes identifying the location of each of at least the first file, the second file, and the third file while circumventing the operating system.

3. The method of claim 2, wherein the identifying includes:

accessing a master file table of the file storage device while circumventing the operating system; and

identifying the location of each of at least the first file, the second file, and the third file by analyzing the data of the master file table.

4. The method of claim, 1 wherein the identifying includes utilizing the operating system to identify the first file, the second file, and the third file.

5. The method of claim 1, wherein the identifying includes identifying a cluster number of each of the first file, the second file, and the third file on a disk drive of the protected computer.

6. A method for scanning files on a protected computer for pestware, the method comprising:

identifying, while circumventing an operating system of the protected computer, a location of each of a plurality of files on a file storage device of the protected computer;

sorting, by location on the file storage device, a listing of the plurality of files to generate a sorted list;

retrieving information from each of the plurality of files by directly and sequentially accessing each of the plurality of files in the order the plurality of files are listed in the sorted list;

analyzing the information from each of the plurality of files to determine whether any of the plurality of files are potential pestware files; and

reporting results of the analyzing to a user.

7. The method of claim 6, wherein the identifying includes:

accessing a master file table of the file storage device while circumventing the operating system; and

identifying the location of each of the plurality of files by analyzing the data of the master file table.

8. The method of claim 6, wherein the retrieving includes utilizing the operating system to retrieve information from each of the plurality of files.

9. The method of claim 6, wherein the identifying includes identifying a cluster number of each of the plurality of files on a disk drive of the protected computer.

10. A system for managing pestware, the system comprising:

a processor; and

a memory including a plurality of program instructions, the plurality of program instructions including;

a pestware detection module configured to cause the processor to detect pestware on a file storage device of a protected computer; and

a sweep speedup module configured to cause the processor to;

identify, while circumventing an operating system of the protected computer, a location of each of a plurality of files on the file storage device;

sort, by location on the file storage device, a listing of the plurality of files to generate a sorted list; and

retrieve information from each of the plurality of files by directly and sequentially accessing each of the plurality of files in the order the plurality of files are listed in the sorted list;

wherein the pestware detection module is configured to analyze the information from each of the plurality of files to determine whether any of the plurality of files are potential pestware files and to report results of the analysis to a user.

13. The system of claim 10, wherein the sweep speedup module is configured to cause the processor to identify a cluster number of each of the plurality of files on a disk drive of the protected computer.

11. The system of claim l0, wherein the sweep speedup module is configured to cause the processor to:

access, while circumventing the operating system, a master file table of the file storage device; and

identify the location of each of the plurality of files by analyzing the data of the master file table.

12. The system of claim l0, wherein the sweep speedup module is configured to cause the processor to utilize the operating system to retrieve information from each of the plurality of files.

14. The system of claim l0, wherein the protected computer includes a plurality of file storage devices, and wherein the plurality of files are distributed among the plurality of file storage devices.