Method and system for efficient file indexing by reverse mapping changed sectors/blocks on an NTFS volume to files

A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors, the program code comprising instructions to:

• receive a plurality of block identifiers, each block identifier a first numerical value and a second numerical value, the first numerical value being a starting location of a block on a storage volume where data content backed up to a backup volume in a last backup is located and the second numerical value being a length of the block;
• determine a starting block location of a file table zone for a file table and a length of the file table zone for the file table by parsing a first record, wherein the file table comprises the first record and a plurality of second records, each of the second records being associated with a file and comprising a timestamp indicating a time the file associated with the second record was last modified;
• identify a subset of second records of the file table by comparing the starting block location of the file table zone and the length of the file table zone with the starting location of the block and the length of the block included in each of the plurality of received block identifiers, the subset of the second records being an intersection of common records, wherein each record in the subset is associated with a block from the file table zone that corresponds to a block specified by the plurality of block identifiers;
• extract, for each record in the selected subset of the second records, the timestamp indicating the time the file associated with the second record was last modified;
• compare the extracted timestamps from each record in the selected subset of the second records with a date of a next-to-last backup of the storage volume;
• identify at least one file as having one or more blocks that were backed up in the last backup when the comparison indicates the at least one file was modified after the date of the next-to-last backup;
• derive a file path to the at least one file by:
• i) extracting from the file table a first record number value and a second record number value associated with the at least one file and joining the first record number value and second record number value to form a file reference number (FRN), ii) using the FRN through a first Application Program interface (API) to obtain a handle to the at least one file, and iii) using the handle through a second API to obtain the file path;
• and
• provide the file path to an indexing engine, the indexing engine indexing the at least one file without re-indexing other files having one or more other blocks not backed up in the last backup.

A system for reverse mapping changed blocks on a file system volume to files, the system comprising:

• a processor-based database management system executed on a computer system and configured to:
• receive a plurality of block identifiers, each block identifier a first numerical value and a second numerical value, the first numerical value being a starting location of a block on a storage volume where data content backed up to a backup volume in a last backup is located and the second numerical value being a length of the block;
• determine a starting block location of a file table zone for a file table and a length of the file table zone for the file table by parsing a first record, wherein the file table comprises the first record and a plurality of second records, each of the second records being associated with a file and comprising a timestamp indicating a time the file associated with the second record was last modified;
• identify a subset of second records of the file table by comparing the starting block location of the file table zone and the length of the file table zone with the starting location of the block and the length of the block included in each of the plurality of received block identifiers, the subset of the second records being an intersection of common records, wherein each record in the subset is associated with a block from the file table zone that corresponds to a block specified by the plurality of block identifiers;
• extract, for each record in the selected subset of the second records, the timestamp indicating the time the file associated with the second record was last modified;
• compare the extracted timestamps from each record in the selected subset of the second records with a date of a next-to-last backup of the storage volume;
• identify at least one file as having one or more blocks that were backed up in the last backup when the comparison indicates the at least one file was modified after the date of the next-to-last backup;
• derive a file path to the at least one file by:
• i) extracting from the file table a first record number value and a second record number value associated with the at least one file and joining the first record number value and second record number value to form a file reference number (FRN), ii) using the FRN through a first Application Program interface (API) to obtain a handle to the at least one file, and iii) using the handle through a second API to obtain the file path;
• and
• provide the file path to an indexing engine, the indexing engine indexing the at least one file without re-indexing other files having one or more other blocks not backed up in the last backup.