File-system-independent malicious content detection

1. A method comprising:

receiving mapping information corresponding to a set of data, wherein the mapping information maps at least a portion of a file to a physical storage location;

reading the portion of the file from the physical storage location to which the mapping information mapped the at least the portion of the file, wherein the at least the portion of the file is read from the physical storage location without accessing a file system;

analyzing the portion of the file for evidence of malicious content, wherein the receiving, the reading, and the analyzing are performed by a detection program executing on a computing device;

determining that a portion of a second file contains data that are shared with the portion of the file, based on the mapping information indicating that the portion of the second file is stored in a same physical location as the portion of the file,

wherein the determining comprises comparing physical location information for the portion of the second file with physical location information for the portion of the file and the first file and the second file are different files; and

in response to the determining:

detecting that the detection program has analyzed the portion of the file and

using a result of analysis of the portion of the file as a result of analysis of the portion of the second file,

wherein the using the result of the analysis of the portion of the file as a result of analysis of the portion of the second file comprises:

comparing one or more entry states associated with the portion of the file with a current entry state, wherein the current entry state is a state of a virtual machine before the virtual machine processes the portion of the second file;

accessing information identifying an exit state, wherein the information is associated with the portion of the file and an entry state matching the current entry state; and

entering the exit state identified by the information, without processing the portion of the second file in the virtual machine.

2. The method of claim 1 , wherein the physical storage location is one of a plurality of physical storage locations storing a point-in-time copy of a plurality of files managed by the file system.

3. The method of claim 1 , further comprising:

causing a mapping catalog to be generated; and

searching the mapping catalog for an entry, wherein the entry identifies one or more storage locations storing the portion of the file.

4. The method of claim 3 , wherein the causing the mapping catalog to be generated comprises: making a copy of the set of data; and causing the copy of the set of data to be mounted as a device by a file system.

5. A computer program product comprising:

a computer readable medium tangibly embodying program instructions executable to implement a detection program, wherein the detection program is configured to:

receive mapping information, wherein the mapping information maps at least a portion of a file to a physical storage location;

read the portion of the file from the physical storage location to which the mapping information mapped the at least the portion of the file, wherein the at least the portion of the file is read from the physical storage location without accessing a file system; and

analyze the portion of the file for evidence of malicious content; and wherein the program instructions are further executable to:

determine that a portion of a second file contains data that are shared with the portion of the file, based on the mapping information indicating that the portion of the second file is stored in a same physical location as the portion of the file,

wherein a determination comprises comparing physical location information for the portion of the second file with physical location information for the portion of the file, and

the first file and the second file are different files; and

in response to the determination

detect that the detection program has analyzed the portion of the file, and

use a result of analysis of the portion of the file as a result of analysis of the portion of the second file,

wherein using the result of the analysis of the portion of the file as a result of analysis of the portion of the second file comprises:

comparing one or more entry states associated with the portion of the file with a current entry state, wherein the current entry state is a state of a virtual machine before the virtual machine processes the portion of the second file;

accessing information identifying an exit state, wherein the information is associated with the portion of the file and an entry state matching the current entry state; and

entering the exit state identified by the information, without processing the portion of the second file in the virtual machine.

6. The computer program product of claim 5 , wherein the physical storage location is one of a plurality of physical storage locations storing a point-in-time copy of a plurality of files managed by the file system.

7. A system comprising:

a processor; and

a memory coupled to the processor, wherein the memory stores program instructions executable by the processor to implement a detection program, wherein the detection program is configured to:

receive mapping information, wherein the mapping information maps at least a portion of a file to a physical storage location;

read the portion of the file from the physical storage location to which the mapping information mapped the at least the portion of the file, wherein the at least the portion of the file is read from the physical storage location without accessing a file system; and

analyze the portion of the file for evidence of malicious content; and wherein the program instructions are further executable to:

determine that a portion of a second file contains data that are shared with the portion of the file, based on the mapping information indicating that the portion of the second file is stored in a same physical location as the portion of the file,

wherein a determination comprises comparing physical location information for the portion of the second file with physical location information for the portion of the file, and the first file and the second file are different files; and

in response to the determination

detect that the detection program has analyzed the portion of the file, and

use a result of analysis of the portion of the file as a result of analysis of the portion of the second file,

wherein using the result of the analysis of the portion of the file as a result of analysis of the portion of the second file comprises:

comparing one or more entry states associated with the portion of the file with a current entry state, wherein the current entry state is a state of a virtual machine before the virtual machine processes the portion of the second file;

accessing information identifying an exit state, wherein the information is associated with the portion of the file and an entry state matching the current entry state; and

entering the exit state identified by the information, without processing the portion of the second file in the virtual machine.

8. The system of claim 7 , wherein the physical storage location is one of a plurality of physical storage locations storing a point-in-time copy of a plurality of files managed by the file system.

9. A system comprising:

computer readable storage means for storing mapping information;

means for receiving the mapping information, wherein the mapping information maps at least a portion of a file to a physical storage location;

means for reading the portion of the file from the physical storage location to which the mapping information mapped the at least the portion of the file, wherein the at least the portion of the file is read from the physical storage location without accessing a file system;

means for analyzing the portion of the file for evidence of malicious content;

means for determining that a portion of a second file contains data that are shared with the portion of the file, based on the mapping information indicating that the portion of the second file is stored in a same physical location as the portion of the file,

wherein a determination comprises comparing physical location information for the portion of the second file with physical location information for the portion of the file, and the first file and the second file are different files; and

means for detecting, in response to the determination, that the detection program has analyzed the portion of the file, and

in response to the determining, using a result of analysis of the portion of the file as a result of analysis of the portion of the second file, wherein a detection program on a computing device comprises the means for receiving, the means for reading, and the means for analyzing,

wherein using the result of the analysis of the portion of the file as a result of analysis of the portion of the second file comprises:

comparing one or more entry states associated with the portion of the file with a current entry state, wherein the current entry state is a state of a virtual machine before the virtual machine processes the portion of the second file;

accessing information identifying an exit state, wherein the information is associated with the portion of the file and an entry state matching the current entry state; and

entering the exit state identified by the information, without processing the portion of the second file in the virtual machine.