Method and system for restoring encrypted files from a virtual machine image
Various techniques, including a method, system and computer program product for restoring encrypted files are disclosed. The method includes accessing a file table record for an encrypted file. The file table record includes an encrypted file stream and extent information identifying a location of one or more portions of the encrypted file in a virtual machine image. In response to accessing the file table record a consecutive data stream is stored. Storing the consecutive data stream includes encapsulating the encrypted file stream and the one or more portions of the encrypted file.
1. A method comprising:
creating a copy of a virtual machine image during a backup operation, wherein
the copy of the virtual machine image is created by writing a plurality of files from the virtual machine image to the copy of the virtual machine image,
the copy of the virtual machine image is stored as a single file distinct from the virtual machine image,
the plurality of files in the copy of the virtual machine image comprises a plurality of encrypted files, and
each encrypted file in the copy of the virtual machine image comprises a plurality of encrypted file extents;
in response to initiating the backup operation, generating mapping information identifying a location of each of the encrypted files within the copy of the virtual machine image, wherein
the mapping information for each of the encrypted files in the copy of the virtual machine image comprises information identifying
an encrypted file stream for each of the encrypted files,
metadata for each of the encrypted files, and
the plurality of encrypted file extents that collectively constitute each of the encrypted files, and
the generating the mapping information comprises parsing the plurality of encrypted files;
transmitting a data structure to a catalog, wherein
the data structure represents the mapping information identifying the location of each of the encrypted files within the copy of the virtual machine image; and
storing the data structure as catalog data in the catalog, wherein
the generating the mapping information and the storing the data structure collectively facilitate restoration of the plurality of encrypted file extents that collectively constitute at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image;
receiving a request to restore the plurality of encrypted files from the copy of the virtual machine image;
accessing the catalog data, in response to receiving the request to restore the plurality of encrypted files from the copy of the virtual machine image; and
retrieving the metadata and information regarding the encrypted file stream for the plurality of encrypted files using the catalog data, wherein
the creating the copy of the virtual machine image, the generating the mapping information, the transmitting the data structure, the storing the data structure, the receiving the request, the accessing the catalog data, and the retrieving the metadata are performed by one or more modules being executed by at least one processor.
2. The method of claim 1 , wherein the mapping information is generated in response to receiving a mapping request related to the backup operation.
3. The method of claim 1 , wherein the generating the mapping information further comprises:
collecting a primary data stream for at least a first file of the plurality of files; and
collecting an alternate data stream for at least a second file of the plurality of files.
4. The method of claim 1 , wherein the catalog data comprises:
an indication as to whether each of the plurality of files in the virtual machine image is encrypted, and
a public encryption key.
5. The method of claim 1 , further comprising:
restoring the plurality of encrypted file extents that collectively constitute the at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image, wherein
restoring the plurality of encrypted file extents is performed using the catalog data.
6. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing instructions that when executed by a processor cause the processor to perform a method comprising:
creating a copy of a virtual machine image during a backup operation, wherein
the copy of the virtual machine image is created by writing a plurality of files from the virtual machine image to the copy of the virtual machine image,
the copy of the virtual machine image is stored as a single file distinct from the virtual machine image,
the plurality of files in the copy of the virtual machine image comprises a plurality of encrypted files, and
each encrypted file in the copy of the virtual machine image comprises a plurality of encrypted file extents;
in response to initiating the backup operation, generating mapping information
identifying a location of each of the encrypted files within the copy of the virtual machine image, wherein
the mapping information for each of the encrypted files in the copy of the virtual machine image comprises information identifying
an encrypted file stream for each of the encrypted files,
metadata for each of the encrypted files, and
the plurality of encrypted file extents that collectively constitute each of the encrypted files, and
the generating the mapping information comprises parsing the plurality of encrypted files;
transmitting a data structure to a catalog, wherein
the data structure represents the mapping information identifying the location of each of the encrypted files within the copy of the virtual machine image;
storing the data structure as catalog data in the catalog, wherein
the generating the mapping information and the storing the data structure collectively facilitate restoration of the plurality of encrypted file extents that collectively constitute at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image;
receiving a request to restore the plurality of encrypted files from the copy of the virtual machine image;
accessing the catalog data, in response to receiving the request to restore the plurality of encrypted files from the copy of the virtual machine image; and
retrieving the metadata and information regarding the encrypted file stream for the plurality of encrypted files using the catalog data.
7. The non-transitory computer-readable storage medium of claim 6 , wherein
the mapping information is generated in response to receiving a mapping request related to the backup operation.
8. The non-transitory computer-readable storage medium of claim 6 , wherein the generating the mapping information further comprises:
collecting a primary data stream for at least a first file of the plurality of files; and
collecting an alternate data stream for at least a second file of the plurality of files.
9. The non-transitory computer-readable storage medium of claim 6 , wherein the catalog data comprises:
an indication as to whether each of the plurality of files in the virtual machine image is encrypted, and
a public encryption key.
10. The non-transitory computer-readable storage medium of claim 6 , wherein the method further comprises:
restoring the plurality of encrypted file extents that collectively constitute the at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image, wherein
restoring the plurality of encrypted file extents is performed using the catalog data.
11. An apparatus comprising:
at least one processor;
a computer-readable storage medium;
a first module configured to create a copy of a virtual machine image during a backup operation, wherein
the copy of the virtual machine image is created by writing a plurality of files from the virtual machine image to the copy of the virtual machine image,
the copy of the virtual machine image is stored as a single file distinct from the virtual machine image,
the plurality of files in the copy of the virtual machine image comprises a plurality of encrypted files, and
each encrypted file in the copy of the virtual machine image comprises a plurality of encrypted file extents;
a second module configured to generate mapping information, in response to initiating the backup operation, identifying a location of each of the encrypted files within the copy of the virtual machine image, wherein
the mapping information for the plurality of files in the copy of the virtual machine image comprises information identifying
an encrypted file stream for each of the encrypted files,
metadata for each of the encrypted files, and
the plurality of encrypted file extents that collectively constitute each of the encrypted files, and
generating the mapping information comprises parsing the plurality of encrypted files;
a third module configured to transmit a data structure to a catalog, wherein
the data structure represents the mapping information identifying the location of each of the encrypted files within the copy of the virtual machine image;
a fourth module configured to store the data structure as catalog data in the catalog, wherein
the generation the mapping information and storage of the mapping information collectively facilitate restoration of the plurality of encrypted file extents that collectively constitute at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image, and
the first, second, third, and fourth modules are each executed by at least one of the at least one processor;
a fifth module configured to receive a request to restore the plurality of encrypted files from the copy of the virtual machine image;
a sixth module configured to access the catalog data, in response to receiving the request to restore the plurality of encrypted files from the copy of the virtual machine image; and
a seventh module configured to retrieve the metadata and information regarding the encrypted file stream for the plurality of encrypted files using the catalog data, wherein.
12. The apparatus of claim 11 , wherein the mapping information is generated in response to receiving a mapping request related to the backup operation.
13. The apparatus of claim 11 , wherein the second module that is configured to generate the mapping information is further configured to:
collect a primary data stream for at least a first file of the plurality of files; and
collect an alternate data stream for at least a second file of the plurality of files.
14. The apparatus of claim 11 , wherein the catalog data comprises:
an indication as to whether each of the plurality of files in the copy of the virtual machine image is encrypted, and
a public encryption key.
15. The apparatus of claim 11 , further comprising:
an eighth module configured to restore the plurality of encrypted file extents that collectively constitute the at least one encrypted file from the copy of the virtual machine image, without restoring all of the plurality of files in the copy of the virtual machine image, wherein
restoring the plurality of encrypted file extents is performed using the catalog data.