Techniques for recovering data from cold images

• US 8,140,906 B1
• Filed: 12/29/2008
• Issued: 03/20/2012
• Est. Priority Date: 12/29/2008
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Searls, Kirk, Payne, Michael
• Primary Examiner(s): Wilson, Yolanda L
• Application Number:
  US12/345,008
• Time in Patent Office: 1,177 Days
• Field of Search: 714/5, 714/6, 714/36, 714/5.11, 714/6.3, 714/6.1
• US Class Current: 714/36
• CPC Class Codes: G06F 11/1469 Backup restoration techniques

Abstract

Techniques for recovering data from cold images are disclosed. In one particular exemplary embodiment, the techniques may be realized as a computer implemented method for recovering data from cold images comprising searching storage associated with a target recovery device, identifying one or more data structures on the storage, parsing the one or more identified data structures, and recovering one or more portions of the one or more parsed data structures.

Claims

1. A computer implemented method for recovering data from cold images comprising:

searching primary storage of a target recovery device having an operating system stored on the primary storage that is not running;

identifying one or more structures on the primary storage;

parsing, using at least one computer processor, the one or more identified data structures; and

recovering one or more portions of the one or more parsed data structures, wherein recovery comprises reading the one or more portions of the one or more parsed data structures from the primary storage of the target recovery device.

2. The computer implemented method of claim 1, wherein the one or more data structures are associated with a virtual machine image file.

3. The computer implemented method of claim 1, further comprising:

booting the target recovery device using an alternative boot process.

4. The computer implemented method of claim 3, wherein the alternative boot process comprises booting from instructions stored in a location not specified as a default boot location of the target recovery device.

5. The computer implemented method of claim 3, wherein the alternative boot process comprises booting from instructions stored on at least one of:

a CD, a DVD, flash memory, a floppy disk, a hard disk, network accessible storage, and magnetic tape.

6. The computer implemented method of claim 1, wherein the one or more data structures comprise data structures associated with an application.

7. The computer implemented method of claim 1, wherein the one or more data structures comprise at least one of:

a data structure associated with a database, a data structure associated with Microsoft Exchange, and a data structure associated with Microsoft Active Directory.

8. The computer implemented method of claim 1, wherein identifying one or more data structures on the primary storage comprises:

utilizing metadata associated with an application to identify one or more data structures associated with storage of application data.

9. The computer implemented method of claim 8, wherein the metadata comprises at least one of:

a file name, a directory name, a path, a registry entry, a system variable, a file extension, a date stamp, and one or more portions of a file header.

10. The computer implemented method of claim 1, further comprising using data from the one or more parsed data structures to identify one or more additional data structures associated with an application.

11. The computer implemented method of claim 1, wherein parsing the one or more identified data structures comprises at least one of:

reading data in an application specific format, using an executable component associated with an application to parse data stored in an application specific format, and parsing data stored in a standardized format.

12. The computer implemented method of claim 1, wherein the one or more recovered portions of the one or more parsed data structures comprise a full recovery.

13. The computer implemented method of claim 1, wherein the one or more recovered portions of the one or more parsed data structures comprise a partial recovery.

14. At least one non-transitory processor readable storage medium for storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1.

15. An article of manufacture for recovering data from cold images, the article of manufacture comprising:

at least one non-transitory processor readable storage medium; and

instructions carried on the at least one storage medium;

wherein the instructions are configured to be readable from the at least one storage medium by at least one processor and thereby cause the at least one processor to operate so as to;

search primary storage associated with a target recovery device having an operating system stored on the primary storage that is not running;

identify one or more data structures on the primary storage;

parse the one or more identified data structures; and

recover one or more portions of the one or more parsed data structures, wherein recovery comprises reading the one or more portions of the one or more parsed data structures from the primary storage of the target recovery device.

16. A system for recovering data from cold images comprising:

one or more processors configured to;

search primary storage associated with a target recovery device having an operating system stored on the primary storage that is not running;

identify one or more data structures on the primary storage;

parse the one or more identified data structures; and

recover one or more portions of the one or more parsed data structures, wherein recovery comprises reading the one or more portions of the one or more parsed data structures from the primary storage of the target recovery device.

17. The system of claim 16, wherein the data structures on the primary storage are associated with a virtual machine image file.

18. The system of claim 16, wherein the one or more processors are further configured to:

boot the target recovery device using an alternative boot process.

19. The system of claim 16, wherein the data structures on the primary storage are associated with an application.

20. The system of claim 16, wherein the one or more processors are further configured to:

utilize metadata associated with an application to identify one or more data structures associated with storage of application data.