Granted Patent B2

US 12,561,428 · App. 17/409,130 · Granted Feb 24, 2026

Inventors: Paul R Massiglia (Colorado Springs, CO); Ronald Karr (Palo Alto, CA); John Colgrove (Los Altos, CA)

Assignee: Pure Storage, Inc.

G06F21/554G06F11/0727G06F11/0751G06F11/079

Abstract

Claims (34)

1 . A method comprising:

detecting, by a controller of a storage system, an anomaly associated with a file written to one or more storage structures included in the storage system, the detecting the anomaly comprises determining that the file has an entropy above a threshold;

transmitting, by the controller of the storage system based on the detecting of the anomaly, a copy of only a header of the file and only a portion of a payload of the file to a data analysis system remote from the storage system and communicatively coupled to the storage system by way of a network, the data analysis system configured to use the copy of the header of the file and the portion of the payload of the file to perform a corruption analysis of the file;

performing, by the controller of the storage system based on the corruption analysis of the file, an operation with respect to the file; and

generating, based on the detecting of the anomaly, a recovery dataset for data maintained by the storage system.

2 . The method of claim 1 , wherein the detecting the anomaly comprises determining that the file has a format that is unrecognizable by the storage system.

3 . The method of claim 1 , wherein the detecting the anomaly comprises:

identifying a format of the file; and

determining that a content of the file does not match what would be expected to be received by the storage system for the identified format.

4 . The method of claim 1 , wherein the detecting the anomaly comprises determining that the file is encrypted.

5 . The method of claim 1 , further comprising preventing, by the storage system based on the detecting of the anomaly, a prior version of the file from being deleted or modified.

6 . The method of claim 1 , further comprising quarantining, by the storage system, the file until the corruption analysis is performed.

7 . The method of claim 1 , wherein:

the corruption analysis indicates that the file is not corrupt; and

the performing the operation comprises one or more of releasing the file from quarantine or deleting a recovery dataset associated with data maintained by the storage system.

8 . The method of claim 1 , wherein:

the corruption analysis indicates that the file is corrupt; and

the performing the operation comprises one or more of quarantining the file, using a recovery dataset to perform a data recovery process for data maintained by the storage system, preventing a host that provided a request to write the data to the storage system from accessing the storage system, or disabling the storage system.

9 . The method of claim 1 , further comprising:

receiving, by the storage system from the data analysis system, corruption analysis data representative of a result of the corruption analysis;

wherein the performing of the operation with respect to the file is based on the corruption analysis data.

10 . A storage system comprising:

one or more storage structures; and

a controller communicatively coupled to the one or more storage structures and configured to:

detect an anomaly associated with a file written to the one or more storage structures, the detecting the anomaly comprises determining that the file has an entropy above a threshold;

transmit, based on the detecting of the anomaly, a copy of only a header of the file and only a portion of a payload of the file to a data analysis system remote from the storage system and communicatively coupled to the storage system by way of a network, the data analysis system configured to use the copy of the header of the file and the portion of the payload of the file to perform a corruption analysis of the file;

perform, based on the corruption analysis of the file, an operation with respect to the file; and

generate, based on the detecting of the anomaly, a recovery dataset for data maintained by the storage system.

11 . The storage system of claim 10 , wherein:

the corruption analysis indicates that the file is not corrupt; and

the performing the operation comprises one or more of releasing the file from quarantine or deleting a recovery dataset associated with data maintained by the storage system.

12 . The storage system of claim 10 , wherein:

the corruption analysis indicates that the file is corrupt; and

the performing the operation comprises one or more of quarantining the file, using a recovery dataset to perform a data recovery process for data maintained by the storage system, preventing a host that provided a request to write the file to the storage system from accessing the storage system, or disabling the storage system.

Assignments (1)

Continuity (4)

References Cited (400)