Automated reconstruction and attribution of data modifications

1 . A method comprising:

determining, using a first backup of information that was stored in a storage system during a first time period and a second backup of information that was stored in the storage system during a second time period, two or more net modifications between the first backup and the second backup;

attributing, for each of the two or more net modifications, the net modification to an entity from a plurality of entities and that made a most recent change reflected in the net modification, wherein the attributing is performed based on a schema indicating which entities of the plurality of entities have access to one or more accounts and one or more sets of information stored in the storage system;

determining, for an event of interest and using first data that indicates the net modifications attributed to each of the corresponding entities, a likelihood that a modification during the event of interest is attributable to a first entity from the plurality of entities, wherein the likelihood that the modification is attributable to the first entity is calculated based on a ratio of contributing and detracting attribution factors corresponding to the first entity, and wherein the event of interest comprises an access to information in the storage system;

determining whether the likelihood satisfies a likelihood criterion; and

performing, in response to determining that the likelihood satisfies the likelihood criterion, an action for the event of interest using the second backup of information for the first entity and the modification.

2 . The method of claim 1 , wherein determining the likelihood comprises:

detecting, from the plurality of entities and using the first data that indicates the net modifications attributed to each of the corresponding entities, a subset of entities that each made at least one modification from the two or more net modifications between the first backup and the second backup; and

determining, for two or more entities in the subset of entities, a corresponding likelihood that the modification during the event of interest is attributable to the corresponding entity.

3 . The method of claim 2 , wherein the likelihood criterion comprises a likelihood threshold or a highest likelihood from the corresponding likelihoods for the subset of entities.

4 . The method of claim 2 , wherein detecting the subset of entities comprises detecting the subset of entities that each likely made at least one modification during the event of interest.

5 . The method of claim 1 , further comprising:

determining, for the event of interest and using the first data that indicates the net modifications attributed to each of the corresponding entities, a second likelihood that a second modification during the event of interest is attributable to a second entity from the plurality of entities;

determining whether the second likelihood satisfies the likelihood criterion; and

using a result of the determination whether the second likelihood satisfies the likelihood criterion, determining whether to perform a second action for the event of interest using third data for the second entity and the second modification.

6 . The method of claim 1 , wherein performing the action comprises:

restoring, to a current version of the storage system and using the second backup of information for the first entity and the modification, information that was modified by the modification.

7 . The method of claim 1 , comprising:

determining, for each of one or more entity attribution factors, whether the corresponding factor applies to the likelihood that the modification is attributable to the first entity, wherein determining the likelihood that the modification during the event of interest is attributable to the first entity from the plurality of entities uses a result of the determination, for each of the one or more entity attribution factors, whether the corresponding factor applies to the likelihood that the modification is attributable to the first entity.

8 . The method of claim 7 , wherein determining whether the corresponding factor applies includes:

determining a value that represents the one or more entity attribution factors; and

determining the likelihood that the modification during the event of interest is attributable to the first entity from the plurality of entities using the value that represents the one or more entity attribution factors.

9 . The method of claim 7 , further comprising:

selecting, using at least one of a system for the backup or a context for the backup and from a plurality of entity attribute factors, the one or more entity attribution factors.

10 . The method of claim 7 , wherein determining whether the corresponding factor applies includes:

determining at least one of whether a single entity has been given permission to access an account, whether the account was accessed from a single device during the event of interest, or whether access to the account is limited to the single entity.

11 . The method of claim 7 , wherein determining, for each of the one or more entity attribution factors, whether the corresponding factor applies to the likelihood that the modification is attributable to the first entity comprises:

determining whether one or more other modifications likely performed by the first entity satisfy a similarity threshold for the modification.

12 . A non-transitory computer-readable medium having instructions stored thereon that are capable of causing a computing device to implement operations comprising:

determining, using a first backup of information that was stored in a storage system during a first time period and a second backup of information that was stored in the storage system during a second time period, two or more net modifications between the first backup and the second backup;

attributing, for each of the two or more net modifications, the net modification to an entity from a plurality of entities and that made a most recent change reflected in the net modification, wherein the attributing is performed based on a schema indicating which entities of the plurality of entities have access to one or more accounts and one or more sets of information stored in the storage system;

determining, for an event of interest and using first data that indicates the net modifications attributed to each of the corresponding entities, a likelihood that a modification during the event of interest is attributable to a first entity from the plurality of entities, wherein the likelihood that the modification is attributable to the first entity is calculated based on a ratio of contributing and detracting attribution factors corresponding to the first entity, and wherein the event of interest comprises an access to information in the storage system;

determining whether the likelihood satisfies a likelihood criterion; and

performing, in response to determining that the likelihood satisfies the likelihood criterion, an action for the event of interest using second information for the first entity and the modification.

13 . The non-transitory computer-readable medium of claim 12 , wherein determining the likelihood comprises:

detecting, from the plurality of entities and using the first data that indicates the net modifications attributed to each of the corresponding entities, a subset of entities that each made at least one modification from the two or more net modifications between the first backup and the second backup; and

determining, for two or more entities in the subset of entities, a corresponding likelihood that the modification during the event of interest is attributable to the corresponding entity.

14 . The non-transitory computer-readable medium of claim 13 , wherein the likelihood criterion comprises a likelihood threshold or a highest likelihood from the corresponding likelihoods for the subset of entities.

15 . The non-transitory computer-readable medium of claim 13 , wherein detecting the subset of entities comprises detecting the subset of entities that each likely made at least one modification during the event of interest.

16 . The non-transitory computer-readable medium of claim 12 , wherein the operations further comprise:

determining, for the event of interest and using the first data that indicates the net modifications attributed to each of the corresponding entities, a second likelihood that a second modification during the event of interest is attributable to a second entity from the plurality of entities;

determining whether the second likelihood satisfies the likelihood criterion; and

using a result of the determination whether the second likelihood satisfies the likelihood criterion, determining whether to perform a second action for the event of interest using third data for the second entity and the second modification.

17 . The non-transitory computer-readable medium of claim 12 , wherein performing the action comprises:

restoring, to a current version of the storage system and using the second backup of information for the first entity and the modification, information that was modified by the modification.

18 . The non-transitory computer-readable medium of claim 12 , wherein the operations comprise:

determining, for each of one or more entity attribution factors, whether the corresponding factor applies to the likelihood that the modification is attributable to the first entity, wherein determining the likelihood that the modification during the event of interest is attributable to the first entity from the plurality of entities uses a result of the determination, for each of the one or more entity attribution factors, whether the corresponding factor applies to the likelihood that the modification is attributable to the first entity.

19 . The non-transitory computer-readable medium of claim 18 , wherein determining whether the corresponding factor applies includes:

determining a value that represents the one or more entity attribution factors; and

determining the likelihood that the modification during the event of interest is attributable to the first entity from the plurality of entities using the value that represents the one or more entity attribution factors.

20 . A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

determining, using a first backup of information that was stored in a storage system during a first time period and a second backup of information that was stored in the storage system during a second time period, two or more net modifications between the first backup and the second backup;

attributing, for each of the two or more net modifications, the net modification to an entity from a plurality of entities and that made a most recent change reflected in the net modification, wherein the attributing is performed based on a schema indicating which entities of the plurality of entities have access to one or more accounts and one or more sets of information stored in the storage system;

determining, for an event of interest and using first data that indicates the net modifications attributed to each of the corresponding entities, a likelihood that a modification during the event of interest is attributable to a first entity from the plurality of entities, wherein the likelihood that the modification is attributable to the first entity is calculated based on a ratio of contributing and detracting attribution factors corresponding to the first entity, and wherein the event of interest comprises an access to information in the storage system;

determining whether the likelihood satisfies a likelihood criterion; and performing, in response to determining that the likelihood satisfies the likelihood criterion, an action for the event of interest using second information for the first entity and the modification.