# US 12,216,785 B2 · Systems and methods for generating file systems of data sources incompatible with anti-virus scanners > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,785 B2 - Document ID: US12216785B2 - Status: Granted - Kind: B2 - Application number: 17/949,571 - Filed: 2022-09-21 - Published: 2024-03-21 - Granted: 2025-02-04 - Earliest claimed: 2022-09-21 - Assignees: Acronis International GmbH - Applicants: Acronis International GmbH - Inventors: Vladimir Strogov; Serg Bell; Stanislav Protasov - Web page: https://patentgrep.com/patent/US12216785B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are systems and method for generating file systems of data sources incompatible with anti-virus scanners. In one exemplary aspect, the method includes: receiving, from an AV scanner, a request to scan a data source for malicious activity, wherein the data source includes a plurality of files, and wherein the AV scanner has a plurality of compatible file types that the AV scanner is capable of scanning; determining that the plurality of files are inaccessible to the AV scanner; generating a file system corresponding to the data source by parsing contents of the data source; generating a virtual volume including a plurality of sparse files corresponding to the plurality of files in the data source; populating at least one sparse file in the virtual volume with respective parsed content of a corresponding file in the data source; and instructing the AV scanner to scan the virtual volume. ## Claims ### Claim 1 A method for anti-virus (AV) scanning incompatible data sources, the method comprising: receiving, from an AV scanner, a request to scan a data source for malicious activity, wherein the data source comprises a plurality of files, and wherein the AV scanner has a plurality of compatible file types that the AV scanner is capable of scanning; determining that the plurality of files are inaccessible to the AV scanner in response to determining that a file type of the data source is not in the plurality of compatible file types; generating a file system corresponding to the data source by parsing contents of the data source using a software development kit (SDK) associated with the data source; generating a virtual volume comprising a plurality of sparse files corresponding to the plurality of files in the data source; populating at least one sparse file in the virtual volume with respective parsed content of a corresponding file in the data source; and instructing the AV scanner to scan the virtual volume. ### Claim 2 (depends on 1) The method of claim 1, wherein populating the at least one sparse file is in response to receiving a request to scan the corresponding file from the AV scanner. ### Claim 3 (depends on 1) The method of claim 1, further comprising: in response to receiving, from the AV scanner, an indication that the populated at least one sparse file is malicious, removing the corresponding file in the data source. ### Claim 4 (depends on 1) The method of claim 1, further comprising: in response to receiving, from the AV scanner, an indication that the populated at least one sparse file is not malicious, removing the respective parsed content from the populated at least one sparse file. ### Claim 5 (depends on 1) The method of claim 1, wherein the virtual volume represents a slice of the data source at first time, further comprising: generating another virtual volume corresponding to the data source at a second time after the first time; mounting the another virtual volume; and instructing the AV scanner to scan the another virtual volume. ### Claim 6 (depends on 5) The method of claim 5, further comprising: receiving, from the AV scanner, an indication that a file in the another virtual volume is malicious; determining whether the file was in the data source during the first time by mounting the virtual volume; and in response to determining that the file was in the data source during the first time, marking the slice as unsuitable for backup recovery. ### Claim 7 (depends on 1) The method of claim 1, wherein the data source is one of: a relational database management system (RDBMS), a content management system (CMS), and a mail database. ### Claim 8 (depends on 1) The method of claim 1, where each respective sparse file in the virtual volume is empty and has a virtual size corresponding to a size of a respective file in the data source that corresponds to the respective sparse file. ### Claim 9 A system for anti-virus (AV) scanning incompatible data sources, comprising: a memory; and a hardware processor communicatively coupled with the memory and configured to: receive, from an AV scanner, a request to scan a data source for malicious activity, wherein the data source comprises a plurality of files, and wherein the AV scanner has a plurality of compatible file types that the AV scanner is capable of scanning; determine that the plurality of files are inaccessible to the AV scanner in response to determining that a file type of the data source is not in the plurality of compatible file types; generate a file system corresponding to the data source by parsing contents of the data source using a software development kit (SDK) associated with the data source; generate a virtual volume comprising a plurality of sparse files corresponding to the plurality of files in the data source; populate at least one sparse file in the virtual volume with respective parsed content of a corresponding file in the data source; and instruct the AV scanner to scan the virtual volume. ### Claim 10 (depends on 9) The system of claim 9, wherein populating the at least one sparse file is in response to receiving a request to scan the corresponding file from the AV scanner. ### Claim 11 (depends on 9) The system of claim 9, further comprising: in response to receiving, from the AV scanner, an indication that the populated at least one sparse file is malicious, removing the corresponding file in the data source. ### Claim 12 (depends on 9) The system of claim 9, further comprising: in response to receiving, from the AV scanner, an indication that the populated at least one sparse file is not malicious, removing the respective parsed content from the populated at least one sparse file. ### Claim 13 (depends on 9) The system of claim 9, wherein the virtual volume represents a slice of the data source at first time, further comprising: generating another virtual volume corresponding to the data source at a second time after the first time; mounting the another virtual volume; and instructing the AV scanner to scan the another virtual volume. ### Claim 14 (depends on 13) The system of claim 13, further comprising: receiving, from the AV scanner, an indication that a file in the another virtual volume is malicious; determining whether the file was in the data source during the first time by mounting the virtual volume; and in response to determining that the file was in the data source during the first time, marking the slice as unsuitable for backup recovery. ### Claim 15 (depends on 9) The system of claim 9, wherein the data source is one of: a relational database management system (RDBMS), a content management system (CMS), and a mail database. ### Claim 16 (depends on 9) The system of claim 9, where each respective sparse file in the virtual volume is empty and has a virtual size corresponding to a size of a respective file in the data source that corresponds to the respective sparse file. ### Claim 17 A non-transitory computer readable medium storing thereon computer executable instructions for anti-virus (AV) scanning incompatible data sources, including instructions for: receiving, from an AV scanner, a request to scan a data source for malicious activity, wherein the data source comprises a plurality of files, and wherein the AV scanner has a plurality of compatible file types that the AV scanner is capable of scanning; determining that the plurality of files are inaccessible to the AV scanner in response to determining that a file type of the data source is not in the plurality of compatible file types; generating a file system corresponding to the data source by parsing contents of the data source using a software development kit (SDK) associated with the data source; generating a virtual volume comprising a plurality of sparse files corresponding to the plurality of files in the data source; populating at least one sparse file in the virtual volume with respective parsed content of a corresponding file in the data source; and instructing the AV scanner to scan the virtual volume.