System and method of inspecting archive slices for malware using empty sparse files

A system for inspecting archive slices for malware, the system comprising:

• a hardware processor configured to:
• generate a backup slice that reflects a state of data at a first time, wherein the backup slice is stored in a backup archive;
• generate a virtual volume comprising a list of files in the backup slice and associated file information, wherein the virtual volume does not store the files referenced in the list of files;
• mount the virtual volume to a disk;
• create, in the virtual volume, empty sparse files that are placeholders of the files reference in the list of files;
• for each respective empty sparse file:
• compare file information associated with the respective empty sparse file with file information associated with a corresponding file in another backup slice reflecting the state of data at a second time;
• and
• in response to detecting a change between the respective empty sparse file and the corresponding file:
• retrieve content associated with the respective empty sparse file from the backup slice;
• and
• store the content in the virtual volume in place of the respective empty sparse file;
• scan the virtual volume for viruses and/or malicious software;
• and
• in response to detecting that at least one file in the virtual volume is infected with a virus and/or malicious software, generate a cured slice that replaces the backup slice in the backup archive.

A non-transitory computer readable medium storing thereon computer executable instructions for inspecting archive slices for malware, including instructions for:

• generating a backup slice that reflects a state of data at a first time, wherein the backup slice is stored in a backup archive;
• generating a virtual volume comprising a list of files in the backup slice and associated file information, wherein the virtual volume does not store the files referenced in the list of files;
• mounting the virtual volume to a disk;
• creating, in the virtual volume, empty sparse files that are placeholders of the files reference in the list of files;
• for each respective empty sparse file:
• comparing file information associated with the respective empty sparse file with file information associated with a corresponding file in another backup slice reflecting the state of data at a second time;
• and
• in response to detecting a change between the respective empty sparse file and the corresponding file:
• retrieving content associated with the respective empty sparse file from the backup slice;
• and
• storing the content in the virtual volume in place of the respective empty sparse file;
• scanning the virtual volume for viruses and/or malicious software;
• and
• in response to detecting that at least one file in the virtual volume is infected with a virus and/or malicious software, generating a cured slice that replaces the backup slice in the backup archive.