Patent ID: 8607342
Filing Date: 2013-12-10
Classification: G06F

Abstract:
1. A computer having computer-readable program code configured to be executed by a processor of the computer, the computer-readable program code being stored non-transitory in a computer-readable storage medium and comprising: first computer-readable program code for accessing contents of a plurality of snapshots, each snapshot in the plurality of snapshots being an incremental backup of a data storage device and indicating modified sectors of the data storage device of the computer, the modified sectors indicated in each snapshot in the plurality of snapshots containing a portion of a file, each snapshot in the plurality of snapshots containing information on a plurality of files; and second computer-readable program code configured to determine if a modified sector of the data storage device noted in a snapshot in the plurality of snapshots have been modified by malicious code, the modified sector being selected for determination of modification by malicious code based on information from an incremental backup included in the snapshots; wherein the first computer-readable program code selects the snapshot together with a full backup of the data storage device to restore the data storage device based on scanning of the modified sector of the data storage device and corresponding data in the snapshot for malicious codes.