Patent ID: 11886606
Assignee: DATTO, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. One or more non-transitory computer-readable storage media configured to store instructions that, in response to being executed, cause a system to perform operations, the operations comprising:
receiving incremental or differential backup metadata for a computer or network of computers via an electronic network, the incremental or differential backup metadata identifying files of the computer or network of computers which are new, modified, or deleted since a last incremental or last full backup of the computer or network of computers;
via the electronic network, receiving file content including (i) copies of the files identified in the incremental or differential backup metadata as new since the last incremental or last full backup of the computer or network of computers and (ii) at least changes for the files identified in the incremental or differential backup metadata as modified since the last incremental or last full backup of the computer or network of computers;
extracting file metadata from the received incremental or differential backup metadata for the files which are new or deleted since the last incremental or last full backup of the computer or network of computers;
identifying candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files, the candidate new and candidate deleted files being identified using the extracted file metadata and not using the received file content; and
performing RWA remediation including at least disabling the computer or network of computers via the electronic network in response to one of:
(i) the identified candidate new and candidate deleted files meeting a RWA alert criterion, or
(ii) the identified candidate new and candidate deleted files meeting the RWA alert criterion and a RWA verification subsequently performed on the received file content of at least a sample of the candidate new files.