System and method of inspecting archive slices for malware
Disclosed herein are systems and method for inspecting archived slices for malware. In one exemplary aspect, the method comprises mounting, to a disk, a first slice of a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time. The method further comprises detecting a modified block of the mounted, identifying at least one file in the mounted first slice that corresponds to the detected modified block, and scanning the at least one file for viruses and malicious software. In response to detecting that the at least one file is infected, the method comprises generating a cured slice that comprises the user data of the mounted first slice without the at least one file.
1. A method for inspecting archive slices for malware, the method comprising:
mounting, to a disk, a first slice of a plurality of slices in a backup archive, wherein the first slice is an image of the user data at a first time;
detecting a modified block of the mounted first slice by comparing blocks of the mounted first slice to blocks of a second slice of the plurality of slices, wherein the second slice is an image of the user data captured before the first time;
identifying, on a file system of the disk, at least one file in the mounted first slice that corresponds to the detected modified block;
scanning the at least one file for viruses and/or malicious software;
in response to detecting that the at least one file is infected with a virus and/or malicious software, generating a cured slice that comprises the user data of the mounted first slice without the at least one file;
scanning a third slice of the plurality of slices in the backup archive for viruses and malicious software, wherein the third slice is an image of the user data captured before a creation time of the second slice; and
in response to detecting, in the third slice, an infected file of the at least one file, marking a subset of the plurality of slices captured subsequent to a creation time of the third slice as unsuitable for data recovery, wherein the subset comprises the second slice and the first slice.
2. The method of claim 1 , wherein generating the cured slice comprises removing the at least one file from the mounted first slice.
3. The method of claim 1 , wherein a plurality of modified blocks relative to the second slice exist for the mounted first slice, and wherein generating the cured slice comprises:
generating a copy of the second slice; and
transferring, to the copy of the second slice, all files corresponding to the plurality of modified blocks and not including the at least one file, wherein the copy of the second slice is the cured slice.
4. The method of claim 1 , wherein the second slice is mounted to the disk prior to or concurrently with the mounted first slice.
5. The method of claim 1 , further comprising adding the new cured slice to the backup archive.
6. The method of claim 1 , further comprising:
identifying a block of the third slice that corresponds to the infected file;
mounting the second slice and the first slice to the disk;
tracking the block and determining whether the infected file exists on any one of the second slice and the first slice; and
removing the infected file from the any one of the second slice and the first slice by generating respective cured slices.
7. The method of claim 1 , wherein the first slice is mounted as a virtual disk.
8. The method of claim 1 , wherein a correspondence of the at least one file and the modified block is determined using a block map of the backup archive.
9. A system for inspecting archive slices for malware, the system comprising: a hardware processor configured to:
mount, to a disk, a first slice of a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time;
detect a modified block of the mounted first slice by comparing blocks of the mounted first slice to blocks of a second slice of the plurality of slices, wherein the second slice is an image of the user data captured before the first time;
identify, on a file system of the disk, at least one file in the mounted first slice that corresponds to the detected modified block;
scan the at least one file for viruses and/or malicious software;
in response to detecting that the at least one file is infected with a virus and/or malicious software, generate a cured slice that comprises the user data of the mounted first slice without the at least one file;
scan a third slice of the plurality of slices in the backup archive for viruses and malicious software, wherein the third slice is an image of the user data captured before a creation time of the second slice; and
in response to detecting, in the third slice, an infected file of the at least one file, mark a subset of the plurality of slices captured subsequent to a creation time of the third slice as unsuitable for data recovery, wherein the subset comprises the second slice and the first slice.
10. The system of claim 9 , wherein the hardware processor is configured to generate the cured slice by removing the at least one file from the mounted first slice.
11. The system of claim 9 , wherein a plurality of modified blocks relative to the second slice exist for the mounted first slice, and wherein the hardware processor is configured to generate the cured slice by:
generating a copy of the second slice; and
transferring, to the copy of the second slice, all files corresponding to the plurality of modified blocks and not including the at least one file, wherein the copy of the second slice is the cured slice.
12. The system of claim 9 , wherein the second slice is mounted to the disk prior to or concurrently with the mounted first slice.
13. The system of claim 9 , wherein the hardware processor is further configured to add the new cured slice to the backup archive.
14. The system of claim 9 , wherein the hardware processor is further configured to:
identify a block of the third slice that corresponds to the infected file;
mount the second slice and the first slice to the disk;
track the block and determining whether the infected file exists on any one of the second slice and the first slice; and
remove the infected file from the any one of the second slice and the first slice by generating respective cured slices.
15. The system of claim 9 , wherein the first slice is mounted as a virtual disk.
16. The system of claim 9 , wherein a correspondence of the at least one file and the modified block is determined by the hardware processor using a block map of the backup archive.
17. A non-transitory computer readable medium storing thereon computer executable instructions for inspecting archive slices for malware, including instructions for:
mounting, to a disk, a first slice of a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time;
detecting a modified block of the mounted first slice by comparing blocks of the mounted first slice to blocks of a second slice of the plurality of slices, wherein the second slice is an image of the user data captured before the first time;
identifying, on a file system of the disk, at least one file in the mounted first slice that corresponds to the detected modified block;
scanning the at least one file for viruses and/or malicious software;
in response to detecting that the at least one file is infected with a virus and/or malicious software, generating a cured slice that comprises the user data of the mounted first slice without the at least one file;
scanning a third slice of the plurality of slices in the backup archive for viruses and malicious software, wherein the third slice is an image of the user data captured before a creation time of the second slice; and
in response to detecting, in the third slice, an infected file of the at least one file, marking a subset of the plurality of slices captured subsequent to a creation time of the third slice as unsuitable for data recovery, wherein the subset comprises the second slice and the first slice.