US 2011/0258164 A1 · Detecting Inadvertent or Malicious Data Corruption in Storage Subsystems and Recovering Data

Abstract

Embodiments of the invention detect inadvertent or malicious data corruption and for recovering data including receiving a query specifying corrupted application data; analyzing transaction logs to find update operations related to the data; determining where the data are stored, by mapping the table data to locations within the file system and mapping the file system locations to volume logical blocks; and analyzing snapshot volume bitmaps to determine if the bitmaps show changes to the table data stored in the volume logical blocks. Changes which are reflected in the bitmaps for the data, but which do not have corresponding entries in the transaction logs are flagged as unauthorized changes. Snapshots of the data, from a time prior to the time at which a flagged snapshot was taken, are identified for use in restoring data to its status prior to the unauthorized change.

Claims20

Dependent claims

A method for automatically detecting at least one inadvertent write to data to restore comprising steps of:

receiving a query specifying a corrupt application data set, said set comprising data information about at least one corrupt data object and time information temporally locating said corrupt data object;
locating one or more bitmaps for snapshots for said at least one data object, said bitmaps having at least one bitmap entry;
locating a transaction log for said data objects based on said time information, said transaction log having at least one transaction log entry;
comparing at least one transaction log entry to said at least one bitmap entry for said one or more bitmaps;
and
detecting an inadvertent write when a change to a bitmap entry does not have a corresponding transaction log entry.

3 more elements

A computer program product for automatically detecting inadvertent writes to data to restore, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to manage a snapshot schedule for creating and storing snapshots of available volumes of data and for periodically storing bitmaps of said snapshots;
computer readable program code configured to receive a query specifying a corrupt application data set, said set comprising data information about at least one corrupt data object and time information temporally locating said corrupt data object;
computer readable program code configured to locate one or more bitmaps for snapshots for said at least one data object, said bitmaps having at least one bitmap entry;
computer readable program code configured to locate a transaction log for said data objects based on said time information, said transaction log having at least one transaction log entry;
computer readable program code configured to compare at least one transaction log entry to said at least one bitmap entry for said one or more bitmaps;
and
computer readable program code configured to detect an inadvertent write when a change to a bitmap entry does not have a corresponding transaction log entry.

5 more elements

Dependencies are inferred from the claim text.

Detecting Inadvertent or Malicious Data Corruption in Storage Subsystems and Recovering Data

Life of this patent

Detecting Inadvertent or Malicious Data Corruption in Storage Subsystems and Recovering Data

Life of this patent

Abstract

Claims20