Systems and methods to detect deleted files

• US 9,390,109 B2
• Filed: 11/19/2013
• Issued: 07/12/2016
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Pawar, Rahul S., Kottomtharayil, Rajiv, Swallow, Douglas Cary, Varadharajan, Prakash
• Primary Examiner(s): Tran, Anh Tai
• Application Number:
  US14/083,763
• Publication Number:
  US 20140181037A1
• Time in Patent Office: 966 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1461 Backup scheduling policy
• CPC Class Codes: G06F 11/1474 in transactions G06F16/20 takes precedence
• CPC Class Codes: G06F 11/2056 by mirroring
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups
• CPC Class Codes: G06F 11/3034 where the computing system component is a storage system, e.g. DASD based or network based digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/3485 for I/O devices
• CPC Class Codes: G06F 16/119 Details of migration of file systems migration mechanisms in storage systems G06F3/0647
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/1865 Transactional file systems
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 2201/82 Solving problems relating to consistency ensuring consistency in mirrored systems G06F11/2064
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data

Abstract

A data storage system protects data identified for deletion which has been created or modified between scheduled data backups. For instance, the system monitors data operations and when the data operation is a delete, the system determines whether the data identified for deletion has been protected by a backup operation. Data that has not been backed up, such as newly created data, is copied to temporary storage before deletion. When the data has been protected, the system determines whether the data has been modified after the backup operation. Data modified after the backup operation is copied to temporary storage before deletion.

Claims

1. A method to protect data deleted between data protection operations in a data management system, the method comprising:

automatically monitoring, with a filter driver in a first computing device comprising computer hardware, data operations of a client computing device;

when the data operation is a deletion operation, automatically identifying, with the filter driver, deletion data associated with the deletion operation;

comparing, with the filter driver, a date/time of a last edit operation of the deletion data with a date/time of a previous data protection operation associated with the deletion data;

when the date/time of the previous data protection operation is before the date/time of the last edit operation, automatically converting, with the filter driver, the deletion data to a hidden file;

copying, with the filter driver, the hidden file to temporary storage;

identifying, with the filter driver, the copy of the hidden file in temporary storage for copying during a second data protection operation; and

migrating, with a data agent in a second computing device comprising computer hardware, during the second data protection operation, the identified copy of the hidden file stored in the temporary storage to secondary storage.

2. The method of claim 1 further comprising automatically deleting, with the filter driver, the deletion data from primary storage after the hidden file is copied to the temporary storage.

3. The method of claim 1 wherein the filter driver associated with the client computing device tracks the data operations that result from actions of a user.

4. The method of claim 1 further comprising:

automatically receiving, with the filter driver, the date/time of the previous data protection operation from a storage information manager; and

automatically receiving, with the filter driver, the edit date/time of the last edit operation of the deletion data from primary storage.

5. The method of claim 1 wherein the date/time of the last edit operation comprises a creation date/time when the deletion data comprises new data.

6. The method of claim 1 further comprising, when the date/time of the previous data protection operation is before the date/time of the last edit operation, automatically determining, with the filter driver, that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation.

7. The method of claim 1 further comprising automatically receiving, with the filter driver, an indication from a storage information manager that the deletion data has never been protected.

8. The method of claim 1 further comprising automatically receiving, with the filter driver, a Universal Sequence Number (USN) from a file system change journal associated with the client computing device to determine whether the deletion data is protected.

9. A system to protect data deleted between data protection operations in an information management cell, the system comprising:

computer hardware including one or more computer processors;

a filter driver in a first computing device comprising the computer hardware configured to automatically monitor data operations of a client computing device;

when the data operation is a deletion operation, the filter driver further configured to automatically identify deletion data associated with the deletion operation;

the filter driver further configured to compare a date/time of a last edit operation of the deletion data with a date/time of a previous data protection operation associated with the deletion data;

when the date/time of the previous data protection operation is before the date/time of the last edit operation, the filter driver further configured to automatically convert the deletion data to a hidden file;

the filter driver further configured to copy the hidden file to temporary storage;

the filter driver further configured to identify the copy of the hidden file in temporary storage for copying during a second data protection operation; and

a data agent in a second computing device comprising computer hardware configured to migrate, during the second data protection operation, the identified copy of the hidden file stored in the temporary storage to secondary storage.

10. The system of claim 9 wherein the filter driver is further configured to automatically delete the deletion data from primary storage after the hidden file is copied to the temporary storage.

11. The system of claim 9 wherein the filter driver associated with the client computing device tracks the data operations that result from actions of a user.

12. The system of claim 9 wherein the filter driver is further configured to automatically receive the date/time of the previous data protection operation from a storage information manager and automatically receive the date/time of the last recent edit operation of the deletion data from primary storage.

13. The system of claim 9 wherein the date/time of the last edit operation comprises a creation date/time when the deletion data comprises new data.

14. The system of claim 9 wherein when the date/time of the previous data protection operation is before the date/time of the last edit operation, the filter driver is further configured to automatically determine that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation.

15. The system of claim 9 wherein the filter driver is further configured to automatically receive an indication from a storage information manager that the deletion data has never been protected.

16. The system of claim 9 wherein the filter driver is further configured to automatically receive a Universal Sequence Number (USN) from a file system change journal associated with the client computing device to determine whether the deletion data is protected.