Patent ID: 8397295
Filing Date: 2013-03-12
Classification: G06F

Abstract:
1. A method of using file system information to detect a rootkit, comprising: analyzing, via at least one computer processor, file system information associated with a plurality of files that form a volume, wherein a first portion of the file system information comprises metadata information for a master file table and a second portion comprises at least one master file table record; identifying an inconsistency within the file system information where the inconsistency indicates a modification to the file system information by a rootkit, wherein the rootkit enables a user to improperly obtain system administrator rights; wherein the identifying the inconsistency further comprises determining an invalid update sequence array, wherein the invalid update sequence array is an inconsistency; reporting the inconsistency within the file system information based on the modification to the file system information; and alerting a user as to the detection of the rootkit based on the identified inconsistency within the file system information.