Patent ID: 9135266
Filing Date: 2015-09-15
Classification: G06F

Abstract:
1. A non-transitory computer-accessible storage medium storing program instructions executable by one or more processors to: receive backup data from a file server computer, wherein the backup data includes file data for a plurality of files on the file server computer; receive event data specifying a plurality of file access events that have occurred on the file server, wherein the event data indicates a respective user and a respective file with which each of the file access events is associated; create mapping information based on the event data and the backup data, wherein in creating the mapping information, the program instructions are executable by the one or more processors to perform the following for each respective file access event of at least a subset of the plurality of file access events specified by the event data: a) determine the respective file with which the respective file access event is associated; b) determine respective file data in the backup data that corresponds to the respective file with which the respective file access event is associated; and c) store information mapping the respective file access event to the respective file data in the backup data; wherein the event data specifies a first file access event for a particular file, wherein the first file access event indicates that the particular file was accessed by a first user at a first time, wherein the event data also specifies a second file access event for the particular file, wherein the second file access event indicates that the particular file was accessed by a second user at a second time, wherein the mapping information maps the first file access event and the second file access event to the respective file data for the particular file in the backup data; receive backup catalog information for the backup data, wherein the backup catalog information specifies where the file data for each file of the plurality of files is stored in the backup data; receive user input specifying a search query to perform on the backup data; match the search query to one or more of the file access events in the at least a subset of the plurality of file access events; and for each respective file access event of the one or more file access events matching the search query, use the mapping information to lookup the respective file data in the backup data that corresponds to the respective file with which the respective file access event is associated; wherein said receiving the user input specifying the search query comprises receiving user input requesting to search the backup data to find files deleted by a particular user during a particular time period; wherein said matching the search query to the one or more file access events comprises determining that each of the one or more file access events specifies that a particular file was deleted by the particular user during the particular time period; wherein the one or more file access events matching the search query include the first file access event indicating that the particular user performed a read access on the particular file at the first time, wherein the particular file corresponds to particular file data in the backup data, wherein the program instructions are executable by the one or more processors to examine the backup catalog information to lookup the particular file data in the backup data in response to determining that the first file access event matches the search query.