| CPC G06F 12/0638 (2013.01) [G06F 9/4401 (2013.01); G06F 12/0284 (2013.01)] | 14 Claims |

|
1. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor of a computing device, cause the processor to:
maintain, via execution of a write filter executable on the computing device, an overlay region for a protected volume, the overlay region having a first size that occupies a portion of a system memory;
retrieve historical data that describes past behavior of the computing device with respect to the overlay region and a non-overlay region of the system memory, the historical data including historical usage data associated with the overlay region and historical usage data associated with the non-overlay region;
compute a percentage usage of the overlay region at defined intervals based on the historical usage data associated with the overlay region;
compute a percentage usage of the non-overlay region at the defined intervals based on the historical usage data associated with the non-overlay region;
determine a second size for the overlay region based on the percentage usage of the overlay region and the percentage usage of the non-overlay region at the defined intervals; and
prior to a boot of the computing device, store an instruction to modify the first size of the overlay region in accordance with the determined second size.
|