Granted Patent B2

US 8,893,277 · App. 12/783,899 · Granted Nov 18, 2014

Abstract

Claims (33)

1. A method of operating a data identification system, the method comprising:

identifying a first plurality of changed blocks in a first virtual machine file stored on a physical storage system;

processing the first plurality of changed blocks to generate a first plurality of fingerprints;

scanning a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks;

identifying a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item;

identifying a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file;

processing the second plurality of changed blocks to generate a second plurality of fingerprints; and

identifying a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

2. The method of claim 1 further comprising adding the first reference fingerprint to an infected fingerprint list.

3. The method of claim 2 further comprising scanning a first target data item of a second plurality of data items to identify a second infected data item, wherein the first target data item corresponds to the first target fingerprint of the second plurality of fingerprints.

4. The method of claim 3 further comprising scanning a subset of data items of the second plurality of data items not including the first target data item to identify another infected data item of the subset of data items of the second plurality of data items.

5. The method of claim 4 further comprising adding another fingerprint from the second plurality of fingerprints corresponding to the another infected data item of the subset of data items of the second plurality of files to the infected fingerprint list.

6. The method of claim 4 further comprising adding the second plurality of fingerprints to the infected fingerprint list if the first target fingerprint from the second plurality of fingerprints matches the first reference fingerprint from the first plurality of fingerprints.

7. The method of claim 4 further comprising adding the first plurality of fingerprints not including the first reference fingerprint from the first plurality of fingerprints to a non-infected fingerprint list.

8. The method of claim 7 further comprising comparing each fingerprint of the second plurality of fingerprints to each fingerprint of the non-infected fingerprint list if each fingerprint of the second plurality of fingerprints does not match a fingerprint of the infected fingerprint list.

9. A data identification system, the system comprising:

an interface configured to receive a scan request a scan request; and

a processor in communication with the interface and configured to receive the scan request, identify a first plurality of changed blocks in a first virtual machine file stored on a physical storage system, process the first plurality of changed blocks to generate a first plurality of fingerprints, scan a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks, identify a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item, identify a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file, process the second plurality of changed blocks to generate a second plurality of fingerprints, and identify a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

10. The data identification system of claim 9 the processor further configured to add the first reference fingerprint to an infected fingerprint list.

11. The data identification system of claim 10 the processor further configured to scan a first target data item of a second plurality of data items to identify a second infected data item, wherein the first target data item corresponds to the first target fingerprint of the second plurality of fingerprints.

12. The data identification system of claim 11 the processor further configured to scan a subset of data items of the second plurality of data items not including the first target data item to identify another infected data item of the subset of data items of the second plurality of data items.

13. The data identification system of claim 12 the processor further configured to add another fingerprint from the second plurality of fingerprints corresponding to the another infected data item of the subset of data items of the second plurality of files to the infected fingerprint list.

14. The data identification system of claim 12 the processor further configured to add the second plurality of fingerprints to the infected fingerprint list if the first target fingerprint from the second plurality of fingerprints matches the first reference fingerprint from the first plurality of fingerprints.

15. The data identification system of claim 12 the processor further configured to add the first plurality of fingerprints not including the first reference fingerprint from the first plurality of fingerprints to a non-infected fingerprint list.

16. The data identification system of claim 15 the processor further configured to compare each fingerprint of the second plurality of fingerprints to each fingerprint of the non-infected fingerprint list if each fingerprint of the second plurality of fingerprints does not match a fingerprint of the infected fingerprint list.

17. A non-transitory computer readable medium having program instructions stored thereon for operating a data identification system that, when executed by a data identification system, direct the data identification system to:

identify a first plurality of changed blocks in a first virtual machine file stored on a physical storage system;

process the first plurality of changed blocks to generate a first plurality of fingerprints;

scan a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks;

identify a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item;

identify a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file;

process the second plurality of changed blocks to generate a second plurality of fingerprints; and

identify a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

Assignments (13)