File System Backup Remediation Preserving User Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus software solutions often fail to completely remove all artifacts of malware infections from computer systems, leading to potential data loss during remediation, as they may not be aware of all components and attack vectors used by viruses.
Innovation Solution
A method involving periodic backups of file systems, tracking changes, and scanning these backups to identify the most recent malware-free state, allowing for restoration of that state while preserving authorized user changes, thereby ensuring data remediation without loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software removes all infected data to eliminate malware, then the system becomes free from infection, but user data and system artifacts may be lost because the software cannot identify all malware components and attack vectors
Solution Approach 1:
The system performs preliminary actions by creating multiple backup copies of the file system at different time points before malware infection occurs. These backups are scanned and validated to identify the most recent clean state, establishing a safe restoration point before any remediation action is taken on the infected system.
Solution Approach 2:
The system creates multiple copies of the file system state through periodic backups. By scanning these backup copies to identify the most recent malware-free version, the system can restore from a known good state without losing user data that was created or modified after the backup was taken.
2Reliability
If the system restores from an older backup to ensure malware-free state, then infection is removed, but user-created files and authorized changes since the backup are lost
Solution Approach 1:
The system segments the file system into two categories: files present in the restored backup and files created or modified after the backup. By tracking file system changes between backup points, the system can identify and preserve authorized user changes while restoring the malware-free baseline state.
Solution Approach 2:
The system dynamically identifies the most recent malware-free backup by scanning multiple backup copies and comparing their infection status. This dynamic selection process ensures the system restores from the optimal backup point that maximizes data retention while guaranteeing malware removal.
3Loss of substance
If the system scans multiple backups to find the most recent malware-free state, then data loss is minimized, but the time and computational resources required increase
Solution Approach 1:
The system performs partial scanning of backup files by focusing only on detecting malware presence rather than full validation of each backup. This selective approach allows quick identification of malware-free backups without the time cost of comprehensive verification, enabling faster restoration decisions.
4Loss of information
If the system tracks all file changes between backups to preserve authorized changes, then user data is retained, but the complexity of tracking and verifying authorized versus malicious changes increases
Solution Approach 1:
The system implements feedback mechanisms by scanning backup files for malware and using the scan results to determine the most recent clean backup state. This feedback loop guides the restoration process, ensuring that only malware-free data is restored while authorized changes are preserved based on file system change tracking.
Data Source
AI summary
Disclosed herein are systems and methods for data remediation without data loss. In one exemplary aspect, the method comprises performing, at a first time, a first backup of a plurality of files on a file system of a computer system; tracking changes to any of the plurality of files on the file system after the first time; performing, at a second time, a second backup of the plurality of files on the file system; detecting, based on a scan of the second backup, an infection of the computer system caused by a malicious application; identifying, by the processor, a most recent backup of the file system that does not comprise the infection; in response to determining that the first backup is the most recent backup: restoring the first backup to the file system, and restoring a subset of files on the file system for which authorized changes.