# US 2019/0318120 A1 · Data loss prevention > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318120 A1 - Document ID: US20190318120A1 - Status: Published application - Kind: A1 - Application number: 16/448,338 - Filed: 2019-06-21 - Published: 2019-10-17 - Earliest claimed: 2016-12-29 - Assignees: Noblis, Inc. - Applicants: Noblis, Inc. - Inventors: Matthew K. MONACO; Daniel NEGRON; Brian SATIRA - Web page: https://patentgrep.com/patent/US20190318120A1 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 3/0608: {Saving storage space on storage systems} - G06F 3/064: {Management of blocks} - G06F 16/1727: {Details of free space management performed by the file system (saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 2221/2107: File encryption - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for providing data loss prevention, including data exfiltration prevention and crypto-ransomware prevention, are provided. In some embodiments, a slack-space file system is created by using a modified packing algorithm to increase and/or optimize an amount of slack space created by files stored in a standard file system. A program for accessing and indexing the slack-space file system may be stored, and requests by a user to store data on a storage medium of a computer system may cause the information to be stored in the slack-space file system, where it may be protected from destructive malware that operates solely on the standard file system. In some embodiments, sensitive information may be hidden by storing the information in an alternate data stream of a file and by replacing the information in the unnamed data stream of the file with non-sensitive information that may appear to be sensitive. ## Claims ### Claim 1 A computer system for storing data, comprising: one or more processors; and memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for: implementing a packing algorithm configured to store a first set of files in a first file system to create an amount of slack space on a storage medium, wherein the slack space comprises space in the storage medium between the end of a file in the first set of files and the end of a cluster allocated by the first file system to store the file, wherein the cluster is a predetermined minimum amount of contiguous space that can be allocated by the first file system; receiving a request to store data on the storage medium; and in response to receiving the request: determining whether to use the first file system or a second file system to store the data, wherein the second file system is configured to store a second set of files in the slack space of the first file system; in response to determining to use the second file system, determining, based on an index of the second set of files that are stored in the slack space, a location in the slack space on the storage medium in which to store the data; and storing the data at the determined location in the slack space. ### Claim 2 (depends on 1) The system of claim 1, wherein the index of the second set of files is stored, along with instructions for storing and reading the second set of files from the slack space, as a slack-space file-system program. ### Claim 3 (depends on 2) The system of claim 2, wherein the slack-space file-system program is stored in a registry of the system. ### Claim 4 (depends on 2) The system of claim 2, wherein the slack-space file-system program is encrypted and compressed. ### Claim 5 (depends on 2) The system of claim 2, wherein the one or more programs include instructions for initializing the slack-space file-system program via a loader program, and wherein the loader program is stored as a library of the system. ### Claim 6 (depends on 5) The system of claim 5, wherein the loader program is stored as a first dynamic-link library. ### Claim 7 (depends on 6) The system of claim 6, wherein the loader program is configured to be executed when the first dynamic-link library is called by a second dynamic-link library. ### Claim 8 A method for storing data, performed at a computer system comprising one or more processors and memory, the method comprising: implementing a packing algorithm configured to store a first set of files in a first file system to create an amount of slack space on a storage medium, wherein the slack space comprises space in the storage medium between the end of a file in the first set of files and the end of a cluster allocated by the first file system to store the file, wherein the cluster is a predetermined minimum amount of contiguous space that can be allocated by the first file system; receiving a request to store data on the storage medium; and in response to receiving the request: determining whether to use the first file system or a second file system to store the data, wherein the second file system is configured to store a second set of files in the slack space of the first file system; in response to determining to use the second file system, determining, based on an index of the second set of files that are stored in the slack space, a location in the slack space on the storage medium in which to store the data; and storing the data at the determined location in the slack space. ### Claim 9 (depends on 8) The method of claim 8, wherein the index of the second set of files is stored, along with instructions for storing and reading the second set of files from the slack space, as a slack-space file-system program. ### Claim 10 (depends on 9) The method of claim 9, wherein the slack-space file-system program is stored in a registry of the system. ### Claim 11 (depends on 9) The method of claim 9, wherein the slack-space file-system program is encrypted and compressed. ### Claim 12 (depends on 9) The method of claim 9, comprising initializing the slack-space file-system program via a loader program, wherein the loader program is stored as a library of the system. ### Claim 13 (depends on 12) The method of claim 12, wherein the loader program is stored as a first dynamic-link library. ### Claim 14 (depends on 13) The method of claim 13, wherein the loader program is configured to be executed when the first dynamic-link library is called by a second dynamic-link library. ### Claim 15 A non-transitory computer-readable storage medium storing one or more programs configured to be executed by one or more processors of a device with one or more processors and memory, the one or more programs including instructions for: implementing a packing algorithm configured to store a first set of files in a first file system to create an amount of slack space on a storage medium, wherein the slack space comprises space in the storage medium between the end of a file in the first set of files and the end of a cluster allocated by the first file system to store the file, wherein the cluster is a predetermined minimum amount of contiguous space that can be allocated by the first file system; receiving a request to store data on the storage medium; and in response to receiving the request: determining whether to use the first file system or a second file system to store the data, wherein the second file system is configured to store a second set of files in the slack space of the first file system; in response to determining to use the second file system, determining, based on the index of a second set of files that are stored in the slack space, a location in the slack space on the storage medium in which to store the data; and storing the data at the determined location in the slack space. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the index of the second set of files is stored, along with instructions for storing and reading the second files from the slack space, as a slack-space file-system program. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the slack-space file-system program is stored in a registry of the system. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the slack-space file-system program is encrypted and compressed. ### Claim 19 (depends on 16) The non-transitory computer-readable storage medium of claim 16, the one or more programs including instructions for initializing the slack-space file-system program via a loader program, wherein the loader program is stored as a library of the system. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the loader program is stored as a first dynamic-link library. ### Claim 21 (depends on 20) The non-transitory computer-readable storage medium of claim 20, wherein the loader program is configured to be executed when the first dynamic-link library is called by a second dynamic-link library. ### Claim 22 A computer system for storing sensitive data in an alternate data stream (ADS), comprising: one or more processors; and memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for: storing sensitive data in an alternate data stream of a file; storing non-sensitive data in an unnamed data stream of the file, wherein the non-sensitive data comprises one or more indicators that the non-sensitive data includes sensitive data that is not included in the non-sensitive data. ### Claim 23 (depends on 1) The system of claim 1, wherein the index of the second set of files that are stored in the slack space of the first file system is inaccessible to the first file system.