# US 11,029,987 B2 · Recovery of state, configuration, and content for virtualized instances > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,029,987 B2 - Document ID: US11029987B2 - Status: Granted - Kind: B2 - Application number: 15/929,847 - Filed: 2020-05-26 - Published: 2021-04-08 - Granted: 2021-06-08 - Earliest claimed: 2019-10-08 - Assignees: CyberArk Software Ltd. - Applicants: CyberArk Software Ltd. - Inventors: Asaf Hecht - Web page: https://patentgrep.com/patent/US11029987B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F 9/485: {Task life-cycle, e.g. stopping, restarting, resuming execution (G06F9/4881 takes precedence)} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 2009/45575: {Starting, stopping, suspending or resuming virtual machine instances} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed embodiments relate to systems and methods for enabling recovery of deactivated virtual computing instances that were previously instantiated in a dynamic virtualized computing environment. Techniques include identifying a status change for a virtual computing instance; archiving a plurality of environment properties representing a chain of activities comprising a plurality of activities executed by a processor of the virtual computing instance; and reactivating the virtual computing instance. Reactivating the virtual computing instance may include reinstantiation of the virtual computing instance based on the plurality of environment properties and chain of activities such that the virtual computing instance is reinstantiated to a state at a time of the status change. ## Claims ### Claim 1 A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for enabling storage and analysis of data associated with virtual computing instances, the operations comprising: identifying a virtual computing instance; archiving, in at least one data storage system, delta data for the virtual computing instance, the delta data representing a plurality of differences between a first state of the virtual computing instance and a second state of the virtual computing instance, wherein the plurality of differences are based on a plurality of operations performed on the virtual computing instance; reinstantiating the virtual computing instance based on the archived delta data; simulating, based on the reinstantiated virtual computing instance, one or more previous states of the virtual computing instance; and performing a forensics operation on the reinstantiated virtual computing instance. ### Claim 2 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the archived delta data is stored in the at least one data storage system in association with time information indicating when the plurality of operations were performed. ### Claim 3 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the delta data is archived without storing a full image of the second state of the virtual computing instance. ### Claim 4 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise archiving state data associated with the second state of the virtual computing instance. ### Claim 5 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise: identifying a request for a historic state of the virtual computing instance; retrieving archived delta data associated with the historic instance; and providing the retrieved delta archived data. ### Claim 6 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the forensics operation includes performing at least one of: an audit, a compliance check, or a security check on the archived data. ### Claim 7 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the forensics operation includes analyzing the archived data based on a past event. ### Claim 8 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise: deallocating the virtual computing instance; and accessing the archived delta data associated with the deallocated virtual computing instance. ### Claim 9 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise: performing an audit on the virtual computing instance. ### Claim 10 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise: performing a security check on the reinstantiated virtual computing instance. ### Claim 11 A computer-implemented method for enabling storage and analysis of data associated with virtual computing instances, the method comprising: identifying a virtual computing instance; archiving, in at least one data storage system, delta data for the virtual computing instance, the delta data representing a plurality of differences between a first state of the virtual computing instance and a second state of the virtual computing instance, wherein the plurality of differences are based on a plurality of operations performed on the virtual computing instance; reinstantiating the virtual computing instance based on the archived delta data; simulating, based on the reinstantiated virtual computing instance, one or more previous states of the virtual computing instance; and performing a forensics operation on the reinstantiated virtual computing instance. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the archiving further comprises compressing the plurality of differences between the first state of the virtual computing instance and the second state of the virtual computing instance into a chain of activities. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the operations further comprise archiving multiple versions of the chain of activities, each version being associated with a different state of the virtual computing instance. ### Claim 14 (depends on 11) The computer-implemented method of claim 11, wherein the plurality of differences between the first state of the virtual computing instance and the second state of the virtual computing instance comprise at least one of: image information associated with the virtual computing instance, memory contents associated with the virtual computing instance, or configuration information associated with the virtual computing instance. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the configuration information comprises one or more parameters of the virtual computing instance. ### Claim 16 (depends on 11) The computer-implemented method of claim 11, wherein performing the forensics operation comprises sandboxing the reinstantiated virtual computing instance and performing an audit of the sandboxed virtual computing instance. ### Claim 17 (depends on 11) The computer-implemented method of claim 11, wherein the archiving is performed on a periodic basis. ### Claim 18 (depends on 11) The computer-implemented method of claim 11, wherein the performing the forensics operation comprises recovering a specific virtual computing instance state of the reinstantiated virtual computing instance, and wherein the specific virtual computing instance state comprises a plurality of environment properties of the reinstantiated virtual computing instance at a specified time. ### Claim 19 (depends on 11) The computer-implemented method of claim 11, further comprising continually archiving the delta data upon identification of a state change for the virtual computing instance. ### Claim 20 (depends on 11) The computer-implemented method of claim 11, wherein the storage system comprises a remote data warehouse.