A system and method for selectively restoring a computer system to an operational state.

Abstract

To provide a method and system that selectively restore a computer system into an operational state.SOLUTION: When a computer system performs monitoring, a recovery controller 202 calls a backup / recovery agent 205, starts a backup job 304, creates a backup image of a machine 204, and stores the backup image in a backup archive 214 of a cold storage 210. The backup job 304 stores a data block accessed during a startup, namely a hot block 302, in a permanent cache 216 of a hot storage server 212. Meanwhile, all data blocks, including a minimum data block to restore into an operational state, are stored in the backup archive 214 of the cold storage 210.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention generally relates to the field of data restoration, and more particularly, to systems and methods for selectively restoring an operating computer system.

Background Art

[0002] Conventionally, recovery of a computer system and data of a computer system (e.g., disaster recovery) is most often performed by obtaining data from a pre-made backup copy that includes an image of the system to be restored. In many cases, the system must be restored to an operational state as soon as possible during recovery from a computer failure or occurrence of a disaster. However, when restoring the system and data from a backup copy, data blocks from the backup copy are read sequentially, e.g., in the order in which the data blocks were saved in the backup copy. Data restoration is not performed in the order in which data is needed for the fastest possible recovery of the system.

[0003] Furthermore, during recovery, not all of the data blocks stored in the archive may be needed. However, searching for and recovering those blocks that are needed for restoration and startup can take a significant amount of time, especially if the archive is very large. For example, an archive as shown in FIG. 1 includes a backup archive (or image) 100 such as a computer or a server. The recovery agent starts the recovery process from the first block and proceeds with the recovery of data in order to the last data. However, in the initial recovery of the system, only a few blocks (e.g., 3, 7, 12, etc.) may be needed for the boot and startup of the system. Since these blocks are scattered randomly (not at the beginning of the archive 100, but in the middle or at the end of the archive) within the archive 100, it may take a very long time for the recovery agent to restore the archive.

[0004] Therefore, system operation will only be restored after all 100 archives and all blocks within them have been restored. Only then can the system be loaded and operated. Consequently, the system restoration time during recovery needs to be reduced. [Overview of the project] [Problems that the invention aims to solve]

[0005] To address these challenges, aspects of this disclosure describe methods and systems for selectively restoring a computer system to an operational state. [Means for solving the problem]

[0006] In an exemplary embodiment, the method may create a backup image of the computer system containing a set of data blocks and store the backup image of the computer system in an archive storage database. The method may determine a subset of data blocks from the backup image that is necessary to maintain the operation of the computer system. Depending on the determination that the computer system needs to be restored, the method may restore a subset of data blocks so that the computer system is operational during startup, and then restore the remaining set of data blocks from the backup image after the computer system has started.

[0007] In some embodiments, the method may determine a subset by creating and starting a virtual machine based on a backup image, monitoring data blocks accessed from the backup image during the virtual machine startup, identifying the monitored data blocks within the subset, and placing those monitored data blocks into a persistent data cache.

[0008] In some embodiments, the method may use a filter driver to monitor data blocks.

[0009] In some configurations, the data blocks to be monitored are requested by the virtual disk of the virtual machine from the backup image.

[0010] In some embodiments, the method may determine a subset by detecting that the computer system has begun initial startup, monitoring data blocks read from the computer system's disk during initial startup, and identifying the monitored data blocks within the subset.

[0011] In some embodiments, the backup image is stored in a first type of storage device of the computer system, and the method may involve placing the monitored data blocks into a second type of storage device.

[0012] In some embodiments, the first type of storage device is cold storage, and the second type of storage device is hot storage. Here, the data read / write speed of the second type of storage device is faster than the data read / write speed of the first type of storage device.

[0013] In some embodiments, the method may determine the subset by evaluating the criticality of events occurring during the initial startup of data blocks and the computer system, creating a set of rules based on the evaluated criticality, and applying the set of rules to the data blocks to divide the data blocks into a subset and the remaining set.

[0014] In some embodiments, the method may arrange the data blocks in the order in which they will be read during the restoration process, and then perform the data block restoration based on that arrangement.

[0015] In some embodiments, the method may determine that a computer system needs to be restored based on the detection of at least one of the following: (1) a malware attack on the computer system, (2) a disaster recovery request, and (3) an event that is causing the computer system to crash.

[0016] In some embodiments, a computer system is considered operational when a plurality of pre-identified applications and critical data associated with those applications are functional and accessible on the computer system.

[0017] It should be noted that the above method may be performed on systems that include a hardware processor. Alternatively, the method may be performed using computer-executable instructions on non-temporary computer-readable media.

[0018] The above abridged summary of exemplary embodiments is provided to give a basic understanding of the present disclosure. This summary is not intended to be an extensive overview of all intended embodiments, nor to identify the main or important elements of all embodiments, nor to describe the scope of any or all embodiments of the invention. Its sole purpose is to present one or more embodiments in abridged form as an introduction to the more detailed description of the present disclosure below. To achieve the above purpose, one or more embodiments of the invention include features described and illustratively presented in the claims. [Brief explanation of the drawing]

[0019] The accompanying drawings incorporated herein and constituting part thereof illustrate one or more exemplary embodiments of the Disclosure, along with modes for carrying out the invention, and are provided to illustrate their principles and implementations.

[0020] [Figure 1] This is a diagram of a data archive containing backup images of a computer or server. [Figure 2] FIG. 1 is a block diagram showing a system that selectively restores a computer system to an operable state according to an exemplary aspect of the present disclosure. [Figure 3] FIG. 2 is a block diagram showing another system that selectively restores a computer system to an operable state according to an exemplary aspect of the present disclosure. [Figure 4] FIG. 3 is a flowchart showing a method of selectively restoring a computer system to an operable state according to an exemplary aspect of the present disclosure. [Figure 5] FIG. 4 is a block diagram of a computer system in which the disclosed system and method may be implemented according to an exemplary aspect. DETAILED DESCRIPTION OF THE INVENTION

[0021] Exemplary aspects are described herein in the context of a system, method, and computer program product that selectively restore a computer system to an operable state. It will be understood by those skilled in the art that the following description is for illustrative purposes only and is not intended to be limiting in any way. Other aspects will be readily apparent to those skilled in the art by using the effects of the present disclosure. Reference numerals are assigned to each item in the implementation form of the exemplary aspect shown in the accompanying drawings. The same reference numerals are used throughout the drawings and the following description to refer to the same or similar items.

[0022] To start a computing device or system that must be recovered as quickly as possible, the data blocks necessary for booting must be identified as soon as possible. In the case of emergency recovery where fast recovery is desired, these identified data blocks must be recovered first without waiting for the remaining blocks to be restored. Therefore, the recovery process may start not from the first block of the machine's backup image, but from the third block, then the seventh block, the twelfth block, and so on, as shown in Figure 1 in this example. Thus, the blocks necessary for recovery are collected and stored in faster storage (hot storage), while the entire archive is stored in relatively slower "cold storage" due to storage costs (i.e., cold storage is cheaper than hot storage).

[0023] In an exemplary aspect, cold storage is designed for long-term storage of data and, in particular, for archives that are not targeted for frequent access. Thus, cold storage sacrifices the read and search speed of data and prioritizes secure data storage, significantly reducing the cost of cold storage. On the other hand, hot storage refers to a storage device that prioritizes quick access to frequently used data and can provide a much faster search than cold storage because of its faster read and / or write speed. In particular, for hot storage, the processing requirements for the speed of data access and search, and in some cases data writing, are minimal. Therefore, hot storage is much more costly than cold storage and stores only data that must be accessed quickly and is thus critical to the user or business. In some aspects, hot storage may mean a local storage disk, while in some aspects, cold storage may mean cloud storage, etc., but the aspects of the present disclosure are not limited thereto. At a more technical level, any type of storage device where the time to access a data block is longer than a predetermined time threshold (e.g., 500 milliseconds) can be classified as cold storage, regardless of whether it is due to physical limitations of the disk or internet connection speed. If the access time is shorter than the predetermined time threshold, that type of storage device can be classified as hot storage.

[0024] FIG. 2 is a block diagram showing a system 200 that selectively restores a computer system to an operable state according to an exemplary aspect of the present disclosure.

[0025] System 200 includes a recovery controller 202, a machine 204 to be recovered, a test run virtual machine 206, a driver 208, cold storage 210, and hot storage 212. The recovery controller 202 controls the various components of System 200 to work together to recover machine 204 to a point where machine 204 can start (i.e., machine 204's operating system is operational and a user can use machine 204 by first restoring the data blocks necessary for machine 204 to be operational).

[0026] In some embodiments, a ready state means a state in which a machine can be used for any operation, or in some embodiments, for part of an operation. An administrator can define what a ready state is, which may be a state in which a machine is available to access, for example, installed applications and associated data stored on disk. In some embodiments, a ready state refers to a state in which critical data can be restored, which is used by a critical application and defined by the administrator and / or organizational security policy.

[0027] In an exemplary embodiment, the recovery controller 202 instructs the backup and recovery agent 205 to take a snapshot of machine 204 and save that snapshot to cold storage 210. Cold storage 210 is any data storage device that stores large amounts of data that may not be immediately needed in the recovery process of a computing device (used synonymously with "computer system"). In an exemplary embodiment, snapshots of machines in the network and full data backups are saved by the backup and recovery agent 205 to backup archives 214 in cold storage 210. In some exemplary embodiments, cold storage 210 may contain only inactive data, or data that is not requested by the computer or organization within a predetermined timeframe (e.g., the first 10 minutes of startup). In this way, cold storage 210 allows an enterprise to retain inactive data offsite and access it only when needed in bulk, thereby reducing network congestion and local network storage.

[0028] There may be instances where, after backup and recovery agent 205 performs a tasked image backup of machines on the network, including machine 204, an event occurs that causes machine 204 and / or other computing devices on the network to shut down. Machine 204 may contain critical corporate data or be a server handling critical client requests for services or data. If machine 204, or any other machine, goes down, customers, business users, and administrators may be unable to perform job-critical functions, potentially reducing overall organizational efficiency.

[0029] Therefore, in one embodiment, to speed up the recovery of a critical machine, for example, machine 204, the recovery controller 202 determines which parts of the data from the snapshot are necessary to restore machine 204 to an operational state. In this example, machine 204 is considered operational (used synonymously with "become operational") when several pre-identified applications and the critical data associated with those pre-identified applications are functional and accessible on machine 204. For example, machine 204 may be configured to receive data, filter that data, and output processed data. Assume the filter removes empty entries from the input dataset. The filter may be an application manually identified by an administrator as an application that needs to be functional and accessible on machine 204. Therefore, all data that enables the filter application to execute is considered critical data, and this may include operating system files that run the operating system (sequentially executing the filter application) and DLL files. It should be noted that not all data associated with pre-identified applications is actually critical data. For example, a print plugin on a Word editor application may not be necessary to enable Word editing functionality within the application. Consequently, this plugin is not critical data. In some embodiments, the recovery controller 202 may identify a subset of data blocks containing critical data and store that subset in hot storage.

[0030] In one embodiment, the recovery controller 202 may maintain a list of data portions (for example, data blocks of a backup image or snapshot used when starting or restoring the computer to an operational state). In an exemplary embodiment, the number of data portions is kept to the minimum number necessary to fully restore the machine 204 to an operational state. Thus, the recovery controller 202 determines the subset of data blocks of the backup image required to maintain the operation of the computer system.

[0031] In this embodiment, the administrator can configure which services or functions are available on machine 204 so that it is considered operational. In another embodiment, machine learning may be deployed to monitor machine 204 and learn which data is accessed first and which is accessed later during startup, as well as which data portions are used when starting a particular service, and the order in which each service starts. The data may change over time, with the history of restore operations taken into consideration and a new list of data considered "critical" or data blocks required to restore the machine to an operational state being updated and maintained.

[0032] In one exemplary embodiment, the recovery controller 202 may start a test run virtual machine 206 using a snapshot or archive of machine 204 saved in a backup archive 214. In this example, the recovery controller 202 may mount a virtual disk 207 and start a filter or file driver 208 to monitor requests made from the test VM 206 to the virtual disk 207. In an exemplary embodiment, the virtual disk 207 may be in VHD, VHDX, VMDK format, etc., but is not limited to these. Subsequently, the recovery controller 202 monitors via the driver 208 which data blocks of the snapshot or archive are accessed during machine startup or until the test VM 206 reaches an operational state defined by an administrator, such as through machine learning.

[0033] In some embodiments, the data blocks accessed during boot-up or until VM206 reaches an operational state are referred to as the minimum data portion, or "minimum" data blocks, in that these are the smallest blocks used for booting machine 204. These data blocks are then stored in hot storage 212 as lists or any type of data structure in a persistent cache 216, which is maintained even in the event of events such as malicious attacks or natural disasters that crash the network or machines on the network. In some exemplary embodiments, hot storage 212 is replicated and / or stored offsite to isolate the persistent cache 216 from attacks or disasters. In other embodiments, the data blocks themselves are not stored in the persistent cache 216, but links to the data blocks in a backup archive 214 are stored in the persistent cache. Storing the minimum data blocks in cold storage 210 requires a longer time to recover to an operational state, but in some cases, it may be desirable to reserve space in hot storage 212 for potentially more critical data.

[0034] In some embodiments, the recovery controller 202 can further reduce recovery time by rearranging the list of data blocks in the persistent cache 216 in the order they were accessed during the boot-up process to bring the computer to an operational state. In other embodiments, a test VM may be invoked after each newly scheduled backup of machine 204. Since data blocks may be modified or updated (deleted or added), the contents of the persistent cache are updated each time. In an exemplary embodiment, the persistent cache 216 is stored in hot storage 212, for example, as a data file or a set of data files (i.e., the persistent cache 216 is stored in hard disk memory). However, in some other embodiments, the hot storage 212 and therefore the persistent cache 216 may reside in RAM, provided that losslessness of RAM is ensured or the possibility of such loss due to server restart or power loss is below a predetermined threshold. In this case, the persistent cache 216 can be restored from the backup archive 214.

[0035] Another aspect of this disclosure is shown in Figure 3. In this aspect, instead of starting a test VM 206 to determine the minimum number of data blocks, the recovery controller 202 deploys a monitoring driver 300 to monitor the startup whenever machine 204 starts up. When monitoring, the recovery controller 202 calls a backup and recovery agent 205 to start a backup job 304, which creates a backup image of machine 204 and saves the backup image to a backup archive 214 in cold storage 210. The backup job 304 saves the data blocks accessed during startup, i.e., hot blocks 302, to a persistent cache 216 in the hot storage server 212, while all data blocks, including the minimum number of data blocks needed to restore to an operational state, are saved to the backup archive 214 in cold storage 210. In one variation of this aspect, the recovery controller 202 saves only "cold" blocks, e.g., data blocks that are not hot blocks 302, to cold storage 210.

[0036] In another exemplary embodiment relating to the embodiment shown in Figure 3, a machine learning (ML) module 310 is invoked by the recovery controller 202 to collect information and events occurring on machine 204 and other machines on the network. In some embodiments, the information and events include data about files and other objects requested during specific events, such as computer startup, application or service initiation, etc. Based on the collected information and events, the ML module 310 can create a set of rules for how to divide data blocks into blocks containing critical data and therefore need to be stored in hot storage, and blocks that can be recovered after the recovery of critical data blocks (e.g., blocks in cold storage). In exemplary embodiments, the set of rules is based on preliminary data classifications regarding the criticality and / or usefulness of specific data, determined by different criteria. Criteria may include data location (e.g., dedicated folder or disk), access frequency, and data ownership.

[0037] For example, a rule can classify whether a specified data block should be included in a subset of multiple data blocks or in the remaining subset of multiple data blocks. In some embodiments, rules may be formalized using if-else statements. Some exemplary rules may be: (1) "Place the specified data block in a subset if it contains files for a pre-identified critical application; otherwise, place it in the remaining set"; (2) "Place the specified data block in a subset if it contains files included in the initial startup of the computer system; otherwise, place it in the remaining set"; or (3) "Place the specified data block in a subset if it contains files accessed within a time threshold before restoration; otherwise, place it in the remaining set."

[0038] Using one of the methods described above, the persistent cache 216 stores hot data blocks, or the minimum data blocks necessary to restore machine 204 to an operational state. In emergencies, such as during disaster recovery after a malicious attack, the recovery controller 202 restores hot blocks (e.g., minimum data blocks) identified in the list stored in the persistent cache 216 from a backup image. The recovery controller 202 then performs a computer system boot using the blocks related to restoring machine 204 to an operational state. After the computer system boot, the recovery controller 202 then restores the remaining set of blocks from the backup image.

[0039] Figure 4 is a flowchart illustrating a method 400 for selectively restoring a computer system to an operational state according to an exemplary embodiment of the present disclosure.

[0040] In step 402, the recovery controller 202 gives the backup and recovery agent 205 the task of creating a backup image of the computer system (for example, machine 40 shown in Figure 2), which includes a set of data blocks.

[0041] In 404, the recovery controller 202 controls the backup and recovery agent 205 to save a backup image of the computer system to an archive storage database. In some embodiments, the archive storage database is cold storage.

[0042] In 406, the recovery controller 202 identifies a data block from a set of data blocks. In 408, the recovery controller 202 determines whether the identified data block is necessary to maintain the operation of the computer system. In some embodiments, becoming operational is defined by machine learning, an administrator, or a combination thereof, when the computer has finished booting up, or when a number of pre-identified applications and the critical data associated with those pre-identified applications are functional and accessible on the computer system.

[0043] If the absence of a data block prevents the computer system from becoming operational, the recovery controller 202 identifies the data block as part of a subset of data blocks that need to be prioritized during the restore. In one embodiment, the subset of data blocks is determined by the recovery controller 202, which starts a test virtual machine and restores the backup image to the virtual disk of the test virtual machine. During boot, a filter driver intercepts requests from the virtual hard disk to the backup image to determine which data blocks are needed to restore the machine to an operational state (these data blocks are recorded and stored in a persistent cache). In an alternative embodiment, the recovery control starts a monitoring driver in machine 204 to monitor data blocks that are invoked during machine startup and boot-up. These invoked data blocks are determined to be "hot blocks" and are stored in a persistent cache for future rapid recovery.

[0044] When a virtual machine starts, the VM reads data from a virtual disk. The disk is virtualized (mounted) in a specific way using a driver so that data can be read directly from a backup archive (e.g., backup archive 214). Data that has already been read (or written by the VM) is placed on the "real" virtual disk so that it cannot be repeatedly read from the archive. Not all data necessary for further work is read during the VM startup. For example, an entire database cannot be read by either Exchange or SQL. The minimum set of data that the VM reads is what is considered to be the "workable state" as described above.

[0045] In an exemplary embodiment, a dedicated filter driver is used to track which sectors, data blocks, or files are used during the initial boot. This filter driver can be used to determine the files necessary to restore the machine to an operational state (according to a predetermined configuration). A virtual test machine provides a realistic environment in which such tracking can be performed.

[0046] However, if a data block is not needed, the recovery controller 202 identifies the data block as part of the rest of the set of data blocks (i.e., a block that does not need to be prioritized). At 414, the recovery controller 202 determines whether there are other data blocks in the set of data blocks that should be considered (this block was not evaluated at 408). If there are other data blocks that should be considered, method 400 returns to 406 to select another data block. The loop from 406 to 414 continues until all data blocks in the set have been classified.

[0047] In some embodiments, following the classification of each data block, the recovery controller 202 may store a subset of the data blocks in a persistent cache 216, while retaining the remaining set of data blocks in cold storage (e.g., a hard drive).

[0048] In 416, the recovery controller 202 determines that the computer system needs to be restored. In some embodiments, the determination that the computer system needs to be restored is based on the detection of at least one of the following: (1) a malware attack on the computer system, (2) a disaster recovery request, and (3) an event that is causing the computer system to crash.

[0049] In step 418, the recovery controller 202 restores a subset of data blocks so that the computer system can function during startup.

[0050] In step 420, the recovery controller 202 restores the remaining set of data blocks from the backup image after the computer system has started. In an exemplary embodiment, the recovery controller 202 accesses cold storage to retrieve the entire backup image and then compares the blocks of the image with the blocks in the persistent cache. If a block is present in the persistent cache 216, the block is ignored (as it has already been restored in step 418), and only the blocks not found in the persistent cache are restored to the computer system.

[0051] Figure 5 is a block diagram showing a computer system 20 in which an embodiment of a system and method for selectively restoring a computer system to an operational state may be implemented, according to an exemplary embodiment. It should be noted that computer system 20 may correspond to any component of system 100 as described above. Computer system 20 may be in the form of multiple computing devices, such as a desktop computer, notebook computer, laptop computer, mobile computing device, smartphone, tablet computer, server, mainframe, or embedded device, or in the form of a single computing device, or other forms of computing devices.

[0052] As shown, the computer system 20 includes a central processing unit (CPU) 21, system memory 22, and a system bus 23 connecting various system components, including memory associated with the central processing unit 21. The system bus 23 may include bus memory or a bus memory controller, peripheral buses, and local buses capable of interacting with any other bus architectures. Examples of each bus include PCI, ISA, PCI-Express, HyperTransport®, InfiniBand®, Serial ATA, and I. 2Examples include C and other suitable interconnects. The central processing unit 21 (also referred to as the processor) may include a set of one or more processors having one or more cores. The processor 21 may execute one or more computer executable codes that implement the technology of this disclosure. The system memory 22 may be any memory that stores data used in this specification and / or computer programs that can be executed by the processor 21. The system memory 22 may include volatile memory such as Random Access Memory (RAM) 25, and non-volatile memory such as Read Only Memory (ROM) 24, flash memory, or any combination thereof. The Basic Input / Output System (BIOS) 26 may store basic procedures for the transmission of information between the elements of the computer system 20 (for example, when loading an operating system using ROM 24).

[0053] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. One or more removable storage devices 27 and non-removable storage devices 28 are connected to the system bus 23 via a storage interface 32. In one embodiment, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, removable storage devices 27, and non-removable storage devices 28 may use various computer-readable storage media. Examples of computer-readable storage media include, for example, machine memory such as cache, SRAM, DRAM, zero-capacitor RAM, twin-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, and PRAM; flash memory or other memory technologies such as solid-state drives (SSDs) or flash drives; magnetic cassettes, magnetic tapes, and magnetic disk storage devices such as hard disk drives or floppy disks; optical storage devices such as compact disks (CD-ROMs) or digital versatile disks (DVDs); and any other media that can be used to store desired data and are accessible by the computer system 20.

[0054] The system memory 22, removable storage device 27, and non-removable storage device 28 of the computer system 20 may be used to store the operating system 35, additional program applications 37, other program modules 38, and program data 39. The computer system 20 may also include other peripheral devices such as printers or scanners via a peripheral interface 46 for communicating data from input devices 40, such as a keyboard, mouse, stylus, game controller, audio input device, or touch input device, or via one or more input / output ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display devices 47, such as one or more monitors, projectors, or integrated displays, may be connected to the system bus 23 via an output interface 48, such as a video adapter. In addition to the display devices 47, the computer system 20 may also include other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0055] The computer system 20 may operate in a network environment using network connections to one or more remote computers 49. The remote computer (or computer) 49 may be a local computer workstation or server, including most or all of the elements described above regarding the nature of the computer system 20. Other devices, such as routers, network stations, peer devices, or other network nodes, may be present in the computer network, but are not limited to these. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computers 49 over one or more networks, such as a local-area computer network (LAN) 50, a wide-area computer network (WAN), an intranet, and the internet. Examples of network interfaces 51 include Ethernet interfaces, frame relay interfaces, SONET interfaces, and wireless interfaces.

[0056] Aspects of this disclosure may be systems, methods, and / or computer program products. A computer program product may include one or more computer-readable storage media having computer-readable program instructions that cause a processor to execute aspects of this disclosure.

[0057] A computer-readable storage medium may be a tangible device capable of holding and storing program code in the form of instructions or data structures, and accessible by the processor of a computing device such as a computer system 20. A computer-readable storage medium may be an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any preferred combination thereof. Examples of such computer-readable storage media include random access memory (RAM), read-only memory (ROM), EEPROM, portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), flash memory, hard disk, portable computer diskette, memory stick, floppy disk, or mechanically coded devices such as punch cards or raised structures on which instructions are recorded in grooves. As used herein, a computer-readable storage medium is not to be interpreted as itself a transient signal, such as, for example, a radio wave or other self-propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or transmission medium, or an electrical signal transmitted by a wire.

[0058] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing device, or to an external computer or external storage device via a network such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface of each computing device receives computer-readable program instructions from the network and transfers the computer-readable program instructions to the storage area of ​​the computer-readable storage medium inside the corresponding computing device.

[0059] The computer-readable program instructions for performing the operations of the Disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or source code or object code, written in any combination of one or more programming languages, including object-oriented programming languages ​​and conventional procedural programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be established to the external computer (e.g., via the Internet). In some embodiments, for example, an electronic circuit including a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) may, in order to implement an embodiment of the present disclosure, utilize state information of a computer-readable program instruction to execute the computer-readable program instruction and personalize the electronic circuit.

[0060] In various embodiments, the systems and methods described herein may be treated as modules. As used in the present invention, the term “module” means a real-world device, component, or mechanism of a component that is implemented using hardware such as an Application-Specific Integrated Circuit (ASIC) or FPGA, or as a combination of hardware and software such as a microprocessor system and a set of instructions for implementing the functionality of the module, which (in operation) translates the microprocessor system into a special-purpose device. A module may also be implemented as a combination of two functions: a specific function facilitated by hardware alone, and another function facilitated by a combination of hardware and software. In certain implementations, at least some, and possibly all, modules may be implemented by a processor of a computer system (e.g., as described in more detail in Figure 5 above). Thus, each module may be implemented in a variety of preferred configurations and should not be limited to any particular implementation illustrated herein.

[0061] For clarity, not all of the defining features of the embodiments are disclosed herein. It will be understood that in developing any actual implementation of this disclosure, a great many implementation-specific decisions will need to be made to achieve the developer's particular objectives, and these particular objectives will be modified by different implementations and different developers. Such development work may be complex and time-consuming, but it will still be understood as routine technical work for those skilled in the art using the benefits of this disclosure.

[0062] Furthermore, the expressions and terms used herein are for illustrative purposes only, not for limitation, and should be understood to be interpreted by those skilled in the art in conjunction with the knowledge of those skilled in the art and in light of the teachings and guidance presented herein. In addition, unless expressly stated otherwise, no terms in this specification or in the claims are intended to be considered non-generic or special in meaning.

[0063] The various embodiments disclosed herein include known modules and equivalents of present and future known equivalents. Furthermore, while embodiments and applications have been shown and described, it will be apparent to those skilled in the art using the benefits of this disclosure that many more modifications are possible without departing from the concept of the invention disclosed herein.

Claims

1. A method for selectively restoring a computer system to an operational state, Creating a backup image of the computer system, including a set of data blocks, The backup image of the computer system is stored in the archive storage database, A subset of the data blocks of the backup image required to maintain the operation of the computer system, A virtual machine is created and started based on the aforementioned backup image. The system monitors the data blocks accessed by the virtual machine from the backup image until the virtual machine reaches an operational state that includes a minimum number of data blocks that ensure multiple pre-identified applications and critical data associated with the multiple pre-identified applications are functional and accessible. Identifying the monitored data block as part of the subset. The decision will be made by, In accordance with the determination that the aforementioned computer system needs to be restored, To restore the subset of the data block so that the computer system can operate during startup, After the aforementioned computer system has started up, the remaining set of data blocks is restored from the backup image. Methods that include...

2. The method according to claim 1, further comprising placing the monitored data block into a persistent data cache.

3. The method according to claim 2, further comprising using a filter driver to monitor the aforementioned data block.

4. The method according to claim 2, wherein the monitored data blocks are requested by the virtual disk of the virtual machine from the backup image.

5. Determining the subset means The computer system is detected to have started its initial startup, During the initial startup, the data blocks read from the computer system's disk are monitored, Identifying the data blocks from the monitored disk as part of the subset, The method according to claim 1, including the method described in claim 1.

6. The backup image is stored in the first type of storage device of the computer system. The data blocks from the disk that were monitored are placed into a second type of storage device. The method according to claim 5, further comprising:

7. The method according to claim 6, wherein the first type of storage device is cold storage, the second type of storage device is hot storage, and the data read / write speed of the second type of storage device is faster than the data read / write speed of the first type of storage device.

8. Determining the subset means To evaluate the criticality of events occurring in data blocks and during the initial startup of the computer system, Applying the set of rules based on the evaluated criticality to the data block, the data block is divided into the subset and the remaining set. The method according to claim 1, further comprising:

9. The data blocks are arranged in the order in which they are read during restoration, Based on the above arrangement, the restoration of the data block is performed, The method according to claim 1, further comprising:

10. The method according to claim 1, wherein the determination that the backup image needs to be restored is based on the detection of at least one of the following: (1) a malware attack on the computer system, (2) a disaster recovery request, and (3) an event that is causing the computer system to crash.

11. A system for selectively restoring a computer system to an operational state, A backup image of the computer system is created, including a set of data blocks. The backup image of the computer system is stored in the archive storage database. A subset of the data blocks of the backup image required to maintain the operation of the computer system, A virtual machine is created and started based on the aforementioned backup image. The system monitors the data blocks accessed by the virtual machine from the backup image until the virtual machine reaches an operational state that includes a minimum number of data blocks that ensure multiple pre-identified applications and critical data associated with the multiple pre-identified applications are functional and accessible. By identifying the monitored data block as part of the subset, Decision made, In accordance with the determination that the aforementioned computer system needs to be restored, To enable the computer system to operate during startup, the subset of the data block is restored, A hardware processor configured to restore the remaining set of data blocks from the backup image after the aforementioned startup of the computer system, A system that includes this.

12. The aforementioned hardware processor is The system according to claim 11, further configured to place the monitored data block into a persistent data cache.

13. The system according to claim 12, wherein the hardware processor is configured to monitor the data block using a filter driver.

14. The system according to claim 12, wherein the monitored data blocks are requested by the virtual disk of the virtual machine from the backup image.

15. The aforementioned hardware processor is The computer system is detected to have started its initial startup, During the initial startup, the data blocks read from the computer system's disk are monitored, Identifying the data blocks from the monitored disk as part of the subset, The system according to claim 11, configured to determine the subset by

16. The system according to claim 15, wherein the backup image is stored in a first type of storage device of the computer system, and the hardware processor is further configured to put the monitored data blocks from the disk into a second type of storage device.

17. The system according to claim 16, wherein the first type of storage device is cold storage, the second type of storage device is hot storage, and the data read / write speed of the second type of storage device is faster than the data read / write speed of the first type of storage device.

18. The aforementioned hardware processor is To evaluate the criticality of events occurring in data blocks and during the initial startup of the computer system, Applying the set of rules based on the evaluated criticality to the data block, the data block is divided into the subset and the remaining set. The system according to claim 11, further configured to determine the subset by

19. A non-temporary computer-readable storage medium that stores computer executable instructions for selectively restoring a computer system to an operational state, A backup image of the computer system is created, including a set of data blocks. The backup image of the computer system is stored in the archive storage database. A subset of the data blocks of the backup image required to maintain the operation of the computer system, A virtual machine is created and started based on the aforementioned backup image. The system monitors the data blocks accessed by the virtual machine from the backup image until the virtual machine reaches an operational state that includes a minimum number of data blocks that ensure multiple pre-identified applications and critical data associated with the multiple pre-identified applications are functional and accessible. By identifying the monitored data block as part of the subset, Decision made, In accordance with the determination that the aforementioned computer system needs to be restored, To enable the computer system to operate during startup, the subset of the data block is restored, After the aforementioned computer system has started up, the remaining set of data blocks is restored from the backup image. A non-temporary, computer-readable storage medium containing instructions for use.

Images