Granted Patent B2

US 12,393,690 · App. 17/980,752 · Granted Aug 19, 2025

Inventors: Adam Gee (San Francisco, CA); Kunal Sean Munshani (Fremont, CA); Benjamin Travis Meadowcroft (Lincoln, CA); Guilherme Vale Ferreira Menezes (Los Gatos, CA); Karthick Raja Ravichandran (Sunnyvale, CA); William Michael Davis (Brisbane, AU); Andrew William Draper (Newcastle-upon-Tyne, GB); Haijin He (South Setauket, NY); Xiaoyang Zhao (Fremont, CA)

Assignee: Rubrik, Inc.

G06F21/568

Abstract

Claims (70)

1. A method, comprising:

storing a plurality of snapshots of a target object that is within a computing system, the plurality of snapshots corresponding to a plurality of versions of the target object;

obtaining an indication that information associated with the target object is flagged for quarantine;

storing, based at least in part on the indication that the information associated with the target object is flagged for quarantine, one or more indications that the information, as included in one or more snapshots from among the plurality of snapshots, is flagged for quarantine;

receiving, after storing the one or more indications, a request to restore a snapshot of the target object, the snapshot of the target object included in the plurality of snapshots;

determining, in response to the request to restore the snapshot of the target object, whether the snapshot of the target object is prohibited from being restored based at least in part on the one or more stored indications that the information in the one or more snapshots from among the plurality of snapshots is flagged for quarantine; and

determining whether to initiate a restoration operation in response to the request to restore the snapshot of the target object based at least in part on whether the snapshot of the target object is prohibited from being restored.

2. The method of claim 1 , wherein determining whether the snapshot of the target object is prohibited from being restored comprises:

identifying, based at least in part on the request to restore the snapshot of the target object, a chain of snapshots for restoring the snapshot of the target object, the chain of snapshots including the snapshot of the target object; and

determining whether information in one or more snapshots of the chain of snapshots has been flagged for quarantine.

3. The method of claim 2 , wherein:

determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises determining that there is no stored indication that any snapshots of the chain of snapshots is flagged for quarantine; and

determining whether to initiate the restoration operation comprises initiating the restoration operation for the snapshot of the target object based at least in part on determining that there is no stored indication that any of the snapshots of the chain of snapshots is flagged for quarantine.

4. The method of claim 2 , wherein:

determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises obtaining, based at least in part on reading at least one of the one or more stored indications, a first indication that information in a snapshot of the chain of snapshots is flagged for quarantine; and

determining whether to initiate the restoration operation comprises preventing the restoration operation for the snapshot of the target object from being initiated based at least in part on obtaining the first indication.

5. The method of claim 4 , further comprising:

displaying an indication that the snapshot of the target object is prohibited from being restored based at least in part on preventing the restoration operation for the snapshot of the target object.

6. The method of claim 5 , further comprising:

receiving, in response to displaying the indication that the snapshot of the target object is prohibited, a command to restore the snapshot of the target object;

determining that the command is associated with a user having privileges that satisfy a threshold; and

restoring the snapshot of the target object into a sandboxed environment.

7. The method of claim 4 , further comprising:

initiating a partial restoration operation for the snapshot of the target object based at least in part on preventing the restoration operation for the snapshot of the target object, wherein the partial restoration operation prevents the information identified in the snapshot of the chain of snapshots from being restored.

8. The method of claim 2 , wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises:

determining whether a table comprises one or more entries identifying any snapshots of the chain of snapshots; and

for snapshots identified by a plurality of entries, determining whether a most recent entry indicates a quarantining or a release from quarantine.

9. The method of claim 8 , wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine further comprises:

determining that information in a snapshot of the chain of snapshots has been flagged for quarantine based at least in part on identifying an entry in the table that identifies that the snapshot of the chain of snapshots is currently flagged for quarantine.

10. The method of claim 2 , wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises:

determining whether a table comprises one or more entries identifying information included in any snapshots of the chain of snapshots.

11. The method of claim 2 , wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises:

determining whether a table comprises one or more entries identifying any snapshots of the chain of snapshots.

12. The method of claim 1 , wherein:

determining whether the snapshot of the target object is prohibited from being restored comprises determining whether a table comprises an entry identifying the snapshot of the target object.

13. The method of claim 1 , wherein:

determining whether the snapshot of the target object is prohibited from being restored comprises determining that information in the snapshot of the target object is not flagged for quarantine based at least in part on the one or more stored indications;

determining whether to initiate the restoration operation comprises determining to initiate the restoration operation for the snapshot of the target object based at least in part on determining that information in the snapshot of the target object is not flagged for quarantine; and

the method further comprises initiating the restoration operation for the snapshot of the target object based at least in part on determining to initiate the restoration operation.

14. The method of claim 1 , wherein:

determining whether the snapshot of the target object is prohibited from being restored comprises determining that information in the snapshot of the target object has been flagged for quarantine based at least in part on the one or more stored indications indicating that the snapshot of the target object is flagged for quarantine;

determining whether to initiate the restoration operation comprises determining not to initiate the restoration operation for the snapshot of the target object based at least in part on determining that information in the snapshot of the target object has been flagged for quarantine; and

the method further comprises preventing the restoration operation for the snapshot of the target object based at least in part on determining not to initiate the restoration operation.

15. The method of claim 14 , further comprising:

displaying an indication that the snapshot of the target object is prohibited from being restored based at least in part on preventing the restoration operation for the snapshot of the target object.

16. An apparatus, comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the apparatus to:

store a plurality of snapshots of a target object that is within a computing system, the plurality of snapshots corresponding to a plurality of versions of the target object;

obtain an indication that information associated with the target object is flagged for quarantine;

store, based at least in part on the indication that the information associated with the target object is flagged for quarantine, one or more indications that the information, as included in one or more snapshots from among the plurality of snapshots, is flagged for quarantine;

receive, after storing the one or more indications, a request to restore a snapshot of the target object, the snapshot of the target object included in the plurality of snapshots;

determine, in response to the request to restore the snapshot of the target object, whether the snapshot of the target object is prohibited from being restored based at least in part on the one or more stored indications that the information in the one or more snapshots from among the plurality of snapshots is flagged for quarantine; and

determine whether to initiate a restoration operation in response to the request to restore the snapshot of the target object based at least in part on whether the snapshot of the target object is prohibited from being restored.

17. The apparatus of claim 16 , wherein, to determine whether the snapshot of the target object is prohibited from being restored, the instructions are further executable by the processor to cause the apparatus to:

identify, based at least in part on the request to restore the snapshot of the target object, a chain of snapshots for restoring the snapshot of the target object, the chain of snapshots including the snapshot of the target object; and

determine whether information in one or more snapshots of the chain of snapshots has been flagged for quarantine.

18. The apparatus of claim 16 , wherein, to determine whether the snapshot of the target object is prohibited from being restored, the instructions are further executable by the processor to cause the apparatus to:

determine whether a table comprises an entry identifying the snapshot of the target object.

19. The apparatus of claim 16 , wherein:

to determine whether the snapshot of the target object is prohibited from being restored, the instructions are further executable by the processor to cause the apparatus to determine that information in the snapshot of the target object is not flagged for quarantine based at least in part on the one or more stored indications;

to determine whether to initiate the restoration operation, the instructions are further executable by the processor to cause the apparatus to determine to initiate the restoration operation for the snapshot of the target object based at least in part on determining that information in the snapshot of the target object is not flagged for quarantine; and

the instructions are further executable by the processor to cause the apparatus to initiate the restoration operation for the snapshot of the target object based at least in part on determining to initiate the restoration operation.

20. A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

store a plurality of snapshots of a target object that is within a computing system, the plurality of snapshots corresponding to a plurality of versions of the target object;

obtaining an indication that information associated with the target object is flagged for quarantine;

store, based at least in part on the indication that the information associated with the target object is flagged for quarantine, one or more indications that the information, as included in one or more snapshots from among the plurality of snapshots, is flagged for quarantine;

receive, after storing the one or more indications, a request to restore a snapshot of the target object, the snapshot of the target object included in the plurality of snapshots;

determine, in response to the request to restore the snapshot of the target object, whether the snapshot of the target object is prohibited from being restored based at least in part on the one or more stored indications that the information in the one or more snapshots from among the plurality of snapshots is flagged for quarantine; and

determine whether to initiate a restoration operation in response to the request to restore the snapshot of the target object based at least in part on whether the snapshot of the target object is prohibited from being restored.

Assignments (3)

Continuity (4)

References Cited (25)