Efficient isolation of backup versions of data objects affected by malicious software

1. A system, comprising:

one or more processors; and

memory coupled to the one or more processors, wherein the memory comprises program instructions executable by the one or more processors to implement a backup manager configured to:

attempt an input/output (I/O) operation with a live version of a data object;

receive an I/O error code in response to the attempted I/O operation, wherein the I/O error code indicates that the live version of the data object is infected by malicious software;

after receiving the I/O error code, compare a signature of the live version of the data object with respective signatures of one or more backup versions of the data object to identify at least one backup version of the data object; and

store metadata in a backup catalog, wherein the metadata indicates that the identified at least one backup version of the data object is to be excluded from use during a subsequent restoration of the data object.

2. The system as recited in claim 1 , wherein the backup manager is further configured to:

store one or more backup versions of the data object, including the identified at least one backup version, prior to receiving the I/O error code; and

in response to the I/O error code, perform an analysis of the stored one or more backup versions to identify the at least one version.

3. The system as recited in claim 2 , wherein to perform the analysis, the backup manager is further configured to:

determine whether a given backup version of the stored one or more backup versions differs from the live version of the data object according to one or more difference criteria;

if the backup version does not differ from the live version of the data object according to the one or more difference criteria, determine that the given backup version is to be excluded from the subsequent restoration of the data object; and

if the backup version differs from the live version of the data object according to the one or more difference criteria, determine that the given backup version is not to be excluded from the subsequent restoration of the data object.

4. The system as recited in claim 3 , wherein to determine whether the backup version differs from the live version of the data object, the backup manager is further configured to:

compare values of one or more attributes of the backup version with corresponding values of one or more attributes of the live version of the data object.

5. The system as recited in claim 4 , wherein the compared values include one or more of a file size, a file modification time, a last user of a file, file ownership information, file read/write permissions.

6. The system as recited in claim 4 , wherein the compared values include one or more of a data object size, a data object modification time, a backup time of a data object.

7. The system as recited in claim 1 , wherein the I/O error is a generic error indication, and wherein, in response to the generic error indication, the backup manager is configured to:

perform one or more additional operations to determine a cause of the generic error indication, wherein a result of the one or more additional operations indicates that the live version of the data object is infected by the malicious software.

8. The system as recited in claim 1 , wherein the I/O operation comprises at least one of (a) a request to write a copy of the backup version into the live data set and (b) a request to read the live version of the data object.

9. The system as recited in claim 1 , wherein I/O error code comprises a notification from a malicious-software detection tool.

10. The system as recited in claim 1 , wherein the backup manager is further configured to:

in response to a restore request received after the I/O error code, identify a different backup version of the data object to be used to restore the live version of the data object, wherein the different backup version is not infected by the malicious software.

11. The system as recited in claim 1 , wherein the data object is a file, a directory, a logical volume, an object of a object-based storage device (OBSD), or a database management system (DBMS) object.

12. The system of claim 1 , wherein the I/O operation is a read operation or a write operation of the live version of the data object.

13. A computer-implemented method, comprising:

attempting an input/output (I/O) operation with a live version of a data object;

receiving an I/O error code in response to the attempted I/O operation, wherein the I/O error code indicates that the live version of the data object is infected by malicious software; after receiving the I/O error code, comparing a signature of the live version of the data object with respective signatures of one or more backup versions of the data object to identify at least one backup version of the data object; and

store metadata in a backup catalog, wherein the metadata indicates that the identified at least one backup version of the data object is to be excluded from use during a subsequent restoration of the data object.

14. The method as recited in claim 13 , further comprising:

storing one or more backup versions of the data object, including the identified at least one backup version, prior to receiving the I/O error code; and

in response to the I/O error code, performing an analysis of the stored one or more backup versions to identify the at least one backup version.

15. The method as recited in claim 14 , wherein said performing the analysis comprises:

determining whether a given backup version of the stored one or more backup versions differs from the live version of the data object according to one or more difference criteria;

if the backup version does not differ from the live version of the data object according to the one or more difference criteria, determining that the given backup version is to be excluded from the subsequent restoration of the data object; and

if the backup version differs from the live version of the data object according to the one or more difference criteria, determining that the given backup version is not to be excluded from the subsequent restoration of the data object.

16. The method as recited in claim 13 , further comprising:

in response to a restore request received after the I/O error code, identifying a different backup version of the data object to be used to restore the live version of the data object, wherein the different backup version is not infected by the malicious software.

17. The computer implemented method as recited in claim 13 , wherein the data object is a file, a directory, a logical volume, an object of a object-based storage device (OBSD), or a database management system (DBMS) object.

18. A non-transitory computer-readable medium comprising program instructions, wherein the instructions are computer-executable to implement a backup manager configured to:

receive an error code indicating that a live version of a data object is infected by malicious software;

after receiving the error code, compare a signature of the live version of the data object with respective signatures of one or more backup versions of the data object to identify at least one backup version of the data object; and

store an indication that the identified at least one backup version of the data object is to be excluded from use during a subsequent restoration of the data object.

19. The computer-readable medium as recited in claim 18 , wherein the backup manager is further configured to:

store one or more backup versions of the data object, including the identified at least one backup version, prior to receiving the error code; and

in response to the error code, perform an analysis of the stored one or more backup versions to identify the at least one backup version.

20. The computer-readable medium as recited in claim 19 , wherein, to perform the analysis, the backup manager is further configured to:

determining whether a given backup version of the stored one or more backup versions differs from the live version of the data object according to one or more difference criteria;

if the backup version does not differ from the live version of the data object according to the one or more difference criteria, determining that the given backup version is to be excluded from the subsequent restoration of the data object; and

if the backup version differs from the live version of the data object according to the one or more difference criteria, determining that the given backup version is not to be excluded from the subsequent restoration of the data object.

21. The computer-readable medium as recited in claim 18 , wherein the backup manager is further configured to:

in response to a restore request received after the error code, identify a different backup version of the data object to be used to restore the live version of the data object, wherein the different backup version is not infected by the malicious software.

22. The computer-readable medium as recited in claim 18 , wherein the data object is a file, a directory, a logical volume, an object of a object-based storage device (OBSD), or a database management system (DBMS) object.