Systems and methods for cloud-integrated persistent file protection in endpoint detection and response

1 . A system for persistent file protection for an incident for a file, comprising:

a persistent file cache (PFC) configured to track file changes and store validated pre-incident file information across system restart, the validated pre-incident file information including a pre-incident file extent hash;

a memory and at least one processor operably coupled to the memory; and

instructions that, when executed by the at least one processor, cause the at least one processor to implement:

an archive verifier configured to:

access a cloud-based backup archive and retrieve recent backup slices from the cloud-based backup archive,

mount a last backup slice before the incident from the recent backup slices as a local volume using an archive mount driver,

determine at least one file extent from the local volume,

hash the at least one file extent, and

compare the hash of the at least one file extent to the pre-incident file extent hash to identify matching extents between the last backup slice and the pre-incident file including by determining at least a start, an end, and a location of the at least one file extent from the local volume and compare the start, end, and location to the validated pre-incident file information, the validated pre-incident file information further comprising a pre-incident start, a pre-incident end, and a pre-incident location of the file;

a remediation handler configured to reconstruct the file as a reconstructed file by combining unaltered file extents retrieved from the local volume with extents stored in the PFC or validated extents from the backup slices from the cloud-based backup archive.

2 . The system of claim 1 , wherein the archive verifier comprises a kernel-level driver configured to mount the last backup slice as a local volume comprising a read-only virtual disk.

3 . The system of claim 1 , wherein the instructions that, when executed by the at least one processor, cause the at least one processor to further implement:

a cache logic engine configured to expand the PFC to include metadata about the recent backup slices including which of the recent backup slices contain specific extents.

4 . The system of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to further implement:

a cache logic engine configured to delete the validated pre-incident file information from the PFC when a local storage quota is exceeded.

5 . The system of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to further implement:

when the hash of the at least one file extent does not match the pre-incident file hash, searching for alternative backup slices in the recent backup slices using the metadata about the recent backup slices including which of the recent backup slices contain specific extents.

6 . The system of claim 5 , wherein when the hash of the at least one file extent does not match the pre-incident file hash as a mismatch, the PFC is further configured to change tracking of file changes according to the mismatch.

7 . The system of claim 1 , wherein mounting the last backup slice before the incident from the plurality of backup slices as the local volume is executed on a computing device without blocking other computing device operations.

8 . The system of claim 1 , wherein the remediation handler is configured to reconstruct the file using the pre-incident file information and the plurality of backup slices including by selectively retrieving file extents from the mounted local volume that have been modified based on the comparing of the hash of the at least one file extent to the pre-incident file extent hash.

9 . A method of persistent file protection for an incident for a file using a persistent file cache (PFC) configured to track file changes and store validated pre-incident file information across system restart, the validated pre-incident file information including a pre-incident file extent hash, the method comprising:

retrieving a plurality of backup slices from a most recent cloud-based backup archive;

mounting a last backup slice before the incident from the plurality of backup slices as a local volume;

determining at least one file extent from the local volume;

hashing the at least one file extent;

comparing the hash of the at least one file extent to the pre-incident file extent hash to identify matching extents between the last backup slice and the pre-incident file including by determining at least a start, an end, and a location of the at least one file extent from the local volume and compare the start, end, and location to the validated pre-incident file information, the validated pre-incident file information further comprising a pre-incident start, a pre-incident end, and a pre-incident location of the file; and

reconstructing the file as a reconstructed file using the pre-incident file information by combining unaltered file extents retrieved from the local volume with extents stored in PFC or validated extents from the plurality of backup slices.

10 . The method of claim 9 , wherein the last backup slice is mounted as a local volume comprising a read-only virtual disk by a kernel-level driver.

11 . The method of claim 9 , further comprising:

expanding the PFC to include metadata about the plurality of backup slices including which of the plurality of backup slices contain specific extents.

12 . The method of claim 9 , further comprising:

deleting the validated pre-incident file information from the PFC when a local storage quota is exceeded.

13 . The method of claim 9 , further comprising:

when the hash of the at least one file extent does not match the pre-incident file hash, searching for alternative backup slices in the plurality of backup slices using the metadata about the plurality of backup slices including which of the plurality of backup slices contain specific extents.

14 . The method of claim 13 , wherein when the hash of the at least one file extent does not match the pre-incident file hash as a mismatch, changing tracking of file changes according to the mismatch in the PFC.

15 . The method of claim 9 , wherein mounting the last backup slice before the incident from the plurality of backup slices as the local volume is executed in system background without blocking other system operations.

16 . The method of claim 9 , wherein reconstructing the file using the pre-incident file information and the plurality of backup slices includes selectively retrieving file extents from the mounted local volume that have been modified based on the comparing of the hash of the at least one file extent to the pre-incident file extent hash.

17 . A system for persistent file protection, comprising:

computing hardware including at least one processor and memory operably coupled to the at least one processor;

a cloud-based backup device comprising storage for a plurality of backup slices for a computing device backup;

kernel-mode computing device instructions that, when executed by the at least one processor, cause the kernel-mode computing device instructions to:

retrieve a plurality of backup slices from a most recent cloud-based backup archive,

mount a last backup slice before the incident from the plurality of backup slices as a local volume,

determine at least one file extent from the local volume,

hash the at least one file extent,

compare the hash of the at least one file extent to a pre-incident file extent hash to identify matching extents between the last backup slice and the pre-incident file including by determining at least a start, an end, and a location of the at least one file extent from the local volume and compare the start, end, and location to validated pre-incident file information, the validated pre-incident file information further comprising a pre-incident start, a pre-incident end, and a pre-incident location of the file; and

user-mode computing device instructions that, when executed when executed by at least one processor, cause the user-mode computing device instructions to:

reconstruct the file as a reconstructed file using by combining unaltered file extents retrieved from the local volume with extents stored in PFC or validated extents from the plurality of backup slices from the most recent cloud-based backup archive.

18 . The system of claim 17 , wherein the kernel-mode computing device instructions to mount the last backup slice before the incident from the plurality of backup slices as the local volume are executed in system background to not block other operations while the last backup slice is mounted.

19 . The system of claim 2 , wherein the kernel-level driver is further configured to initialize the read-only virtual disk and populate one or more sectors of the read-only virtual disk with data retrieved from the last backup slice.

20 . The method of claim 10 , further comprising:

initializing the read-only virtual disk; and

populating one or more sectors of the read-only virtual disk with data retrieved from the last backup slice.