System and method for modeling data change over time

A method comprising:

• receiving, by a system for analyzing file system events, a first file system object from a first backup image of a file system;
• determining, by the system for analyzing file system events, if the first file system object is located in a second backup image of the file system;
• if the first file system object is not located in the second backup image, then determining that the first file system object was deleted from the file system;
• if the first file system object is located in the second backup image, then applying a hash function to the first file system object from the first backup image to generate a first hash result;
• applying a hash function to the first file system object from the second backup image to generate a second hash result;
• solving the longest common subsequence problem for the first hash result and the second hash result to determine the differences between the first hash result and the second hash result;
• and
• using the results from the determining and solving steps to generate a model of the file system.

A computer program product, comprising a non-transitory computer usable medium having a computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a method for analyzing file system events, said method comprising:

• receiving a first backup image of a file system, the first backup image having at least one backed up file system object;
• receiving a second backup image of the file system, the second backup image having at least one backed up file system object, the second backup image created after the first backup image;
• selecting a first file system object from the first backup image;
• comparing the first file system object and a second version of the first file system object to determine the differences if the second version of the first file system object is located in the second backup image, if the second version of the first file system object is not located in the second backup image, then determining that the first file system object was deleted from the file system or was created in the file system at a time interval between a creation of the first backup image and a creation of the second backup image;
• and
• using the results from the comparing step to generate a model of the file system.

A computer program product, comprising a non-transitory computer usable medium having a computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a method for analyzing file system events, said method comprising:

• receiving a first file system object from a first backup image of a file system;
• determining if the first file system object is located in a second backup image of the file system;
• if the first file system object is not located in the second backup image, then determining that the first file system object was deleted from the file system;
• if the first file system object is located in the second backup image, then applying a hash function to the first file system object from the first backup image to generate a first hash result;
• applying a hash function to the first file system object from the second backup image to generate a second hash result;
• solving the longest common subsequence problem for the first hash result and the second hash result to determine the differences between the first hash result and the second hash result;
• and
• using the results from the determining and solving steps to generate a model of the file system.

A method for analyzing file system events comprising:

• receiving, by a system for analyzing file system events, a first backup image of a file system;
• receiving, by the system for analyzing file system events, a second backup image of the file system, the second backup image created after the first backup image;
• selecting a first file system object from the first backup image;
• if a copy of the first file system object is located in the second backup image, then comparing the first file system object and the copy of the file system object to determine the differences and storing the results in a data structure;
• if the first file system object is not located in the second backup image, then determining that the first file system object was deleted from the file system and storing in the data structure the fact that the file system object was deleted;
• and
• using the data structure to generate a model of the file system.

A method for analyzing file system events comprising:

• receiving, by a system for analyzing file system events, a first backup image of a file system;
• receiving, by the system for analyzing file system events, a second backup image of the file system, the second backup image created before the first backup image;
• selecting a first file system object from the first backup image;
• if a copy of the first file system object is located in the second backup image, then comparing the first file system object and the copy of the file system object to determine the differences and storing the results in a data structure;
• if the copy of the first file system object is not located in the second backup image, then storing in the data structure the fact that the file system object was created after the first backup image;
• and
• using the data structure to generate a model of the file system.