Cloning-based cyber recovery

A system comprising:

• a processor;
• and memory configured to store one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
• maintaining, at a destination site, a key value store (KVS) comprising pages of a B+ tree holding file metadata of first and second files that belong to a logical partition of a filesystem, the pages being associated with keys, the keys comprising KVS keys, each KVS key comprising a logical partition identifier (id), a snapshot id, and a page number, wherein the snapshot id corresponds to a current snapshot id at a time the pages were written to the KVS;
• creating, at the destination site, a clone of the logical partition, the logical partition now being a parent, and the clone now being a child, wherein the parent is assigned a first logical partition ID, the child is assigned a second logical partition id, and the current snapshot id is incremented upon creation of the clone;
• receiving, at the destination site from a source site, a plurality of changes made at the source site since a last replication cycle, the plurality of changes comprising all changes made to the first file, and all changes made to the second file, wherein the changes made to the first file comprises a write to a first page in the parent, the first page being associated with a first KVS key, and
• wherein the changes made to the second file comprises a write to a second page in the child, the second page being associated with a second KVS key;
• applying, at the destination site, all changes made to the first and second files, the applying comprising examining the first and second KVS keys, first and second logical partition ids, and incremented current snapshot ID to determine whether a copy-on-write (COW) operation should be performed for one or more of the first page in the parent or the second page in the child;
• determining that application of one of all changes made to the first or second files has finished before application of another of the one of all changes made to the first or second files;
• and
• scanning the now updated one of the first or second files for viruses while all changes made to the other of the one of the first or second files continue to be applied.

A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method comprising:

• maintaining, at a destination site, a key value store (KVS) comprising pages of a B+ tree holding file metadata of first and second files that belong to a logical partition of a filesystem, the pages being associated with keys, the keys comprising KVS keys, each KVS key comprising a logical partition identifier (id), a snapshot id, and a page number, wherein the snapshot id corresponds to a current snapshot id at a time the pages were written to the KVS;
• creating, at the destination site, a clone of the logical partition, the logical partition now being a parent, and the clone now being a child, wherein the parent is assigned a first logical partition ID, the child is assigned a second logical partition id, and the current snapshot id is incremented upon creation of the clone;
• receiving, at the destination site from a source site, a plurality of changes made at the source site since a last replication cycle, the plurality of changes comprising all changes made to the first file, and all changes made to the second file, wherein the changes made to the first file comprises a write to a first page in the parent, the first page being associated with a first KVS key, and
• wherein the changes made to the second file comprises a write to a second page in the child, the second page being associated with a second KVS key;
• applying, at the destination site, all changes made to the first and second files, the applying comprising examining the first and second KVS keys, first and second logical partition ids, and incremented current snapshot ID to determine whether a copy-on-write (COW) operation should be performed for one or more of the first page in the parent or the second page in the child;
• determining that application of one of all changes made to the first or second files has finished before application of another of the one of all changes made to the first or second files;
• and
• scanning the now updated one of the first or second files for viruses while all changes made to the other of the one of the first or second files continue to be applied.