US 11,755,420 B2
Recovery point objective optimized file recovery
Milind Borate, Pune (IN); Anand Apte, Pune (IN); and Neeraj Thakur, Pune (IN)
Assigned to Druva Inc., Santa Clara, CA (US)
Filed by Druva Inc., Santa Clara, CA (US)
Filed on Nov. 18, 2020, as Appl. No. 16/951,579.
Claims priority of application No. 202041042054 (IN), filed on Sep. 28, 2020.
Prior Publication US 2022/0100378 A1, Mar. 31, 2022
Int. Cl. G06F 11/00 (2006.01); G06F 11/14 (2006.01); G06F 21/56 (2013.01)
CPC G06F 11/1458 (2013.01) [G06F 11/1446 (2013.01); G06F 11/1469 (2013.01); G06F 21/565 (2013.01); G06F 21/568 (2013.01); G06F 2221/033 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
receiving a request to restore a device that is potentially malware affected, the device associated with a plurality of backup snapshots that capture states of the device at different times;
retrieving a first backup snapshot of the device;
determining that a first file stored in the first backup snapshot is malware affected;
checking one or more corresponding versions of the first file captured in one or more previous backup snapshots to identify a clean version of the first file, wherein checking one or more corresponding versions of the first file captured in one or more previous backup snapshots to identify the clean version of the first file comprises:
identifying a previous version of the first file stored in a previous backup snapshot by:
comparing data stored in the first backup snapshot to data stored in the previous backup snapshot,
identifying an amount of deleted data based on the comparison, the deleted data being stored within the previous backup snapshot,
associating the deleted data stored within the previous backup snapshot with the first file based in part on metadata of the first file, and
based on the association, identifying the previous version of the first file stored in the previous backup snapshot; and
checking the identified previous version of the first file to identify whether the identified previous version of the first file is the clean version of the first file;
determining that a second file stored in the first backup snapshot is clean; and
restoring data in the device, the restored data comprising the clean version of the first file restored from a previous backup snapshot and the second file restored from the first backup snapshot.