Patent ID: 12248374

DETAILED DESCRIPTION OF SOME EXAMPLE EMBODIMENTS

Embodiments of the present invention generally relate to data protection systems and data protection operations. More particularly, at least some embodiments of the invention relate to systems, hardware, software, computer-readable media, and methods for accessing backups.

In general, example embodiments of the invention relate to data protection operations including, but not limited to, data protection operations, backup operations, snapshot operations, restore/recover operations, point-in-time backup/recover operations, malware response operations, encryption operations, backup protection operations, vault or storage operations or the like or combinations thereof.

The term malware as used herein and by way of example, may refer to ransomware, viruses, rootkits, spyware, adware, trojans, worms, phishing attacks, or other unwanted software or cyber-attacks. Malware may also be referred to as a computing process or application.

Embodiments of the invention relate to enabling access to a backup when a key required to read or access an encrypted backup has been lost, deleted, or is otherwise unavailable.

Backup systems can be arranged in different manners and configurations.FIG.1discloses aspects of a data protection system.FIG.1illustrates a datacenter102in which production systems114and118may operate. The production system114may include production storage104configured to store production data106, which may be generated by a production computing system. The datacenter102or the production systems114and118may also host applications associated with the data in the respective systems. The production data106may include data required or accessed by users, applications, or the like. The data106may include files, objects, blocks, a database, emails, images, videos, documents, spreadsheets, presentations, or the like or combination thereof.

AlthoughFIG.1illustrates production storage104of a production system114, the production storage104may be an on-premise storage system, an edge system storage, a cloud-based system or the like or combination thereof. The production storage104may include storage devices such as hard disk drives. The datacenter102may also include another production system118that may be associated with its own production storage and which may be backed up by the appliance120(or the backup appliance118). In this example, the backup116of the production system118is stored in a backup system136, which may be an example of the vault120. In another example, the production systems114and118may be applications of the same production system that are backed up to different vaults or to different backup systems.

More specifically, a backup appliance108(or other backup device or application or virtual backup device, virtual appliance, or application) is configured to generate and store backups of the data106(and/or applications), represented as the backup110, for the production system114. The backup110may be or include a full backup, a synthetic backup, incremental backups, snapshots, or the like. The backup appliance108may be a virtual appliance or a physical appliance. The backup appliance108may coordinate with other backup appliances at remote locations. This allows backups to be stored remotely.

More generally, the backup appliance108may protect data, applications, or the like. The backup appliance108may transmit the backup110to a vault120, which may be protected by an air gap112controlled by the vault120. This allows a backup122(e.g., a backup) of the data106to be stored in the vault120only when a connection is available (e.g., the air gap112is configured to allow communications). After ingestion into the vault120, the backup122is locked to generate a locked backup124. The locked backup124is immutable in one example. The vault120may be created in the datacenter102or in another location that is remote from the data106and/or the backup appliance108. In other examples, backups may be stored in storage systems that are not protected by an air gap mechanism. For example, the backup appliance108or120may regularly transmit backups to a backup system136in the cloud or other location. The backup system136, however, may also be an air gap protected vault.

During a recovery operation, the data106may be recovered from the locked backup124(or other backup in the vault120). The vault120may store point in time (PiT) copies as well. In some examples, the data106may be recovered from the backup122if necessary. In one example, the backup110may be a namespace that is backed up to a namespace in the vault120. The backup110may be transmitted to a namespace in the vault120as the backup122. Next, the backup122may be copied to another namespace and retention locked, which results in the locked backup124.

The air gap112may not be required but provides a more secure backup environment. Once the locked backup124is generated and retention locked, the immutability is guaranteed in one example. For example, the locked backup124is secure from attack vectors that adversely impact backups because the vault120may not be accessible, due to the air gap112, which is controlled from inside the vault120in one example.

In one example, the vault120may be a target site configured to store backups received from the backup appliance108. The vault120may be associated with a corresponding appliance that may be configured to store the backups in the target site and also perform restore or recover operations. In one example, the air gap112is not present and the value120may simply represent backup storage that stores backups received from the backup appliance108.

In one example, the vault120and the backup system136, particularly when implemented as a vault, are kept separate with no interaction. Embodiments of the invention, however, may store a backup122a, which is a backup of the production system114and corresponds to the backup122, in the backup system or vault136. This provides a way to recover the production system114or its data106when the locked backup124or backup122cannot be decrypted. For example, a key required to decrypt a backup in the vault120may be lost and the backup is not accessible. Storing the backup122ain a different vault using a different key may allow the recovery operation to proceed notwithstanding the loss of the key for backups in the vault120. In general, each vault may be associated with a single key. Different vaults may be associated with different keys. This helps ensure that the inability to access backups in one vault (e.g., decrypt a backup) do not necessarily impact the ability to access backups in a different vault.

FIG.2discloses aspects of backups in accordance with embodiments of the invention.FIG.2illustrates an example of backups220that may be stored in a backup storage system or in a vault200. The vault200stores backups220of a production system or of a set of application. In this example, the backups220include a backup202, an incremental backup204, an incremental backup206, and another backup208. The backups202and208may be full backups or full snapshots.

The backups204and206are incremental backups. Thus, to recover to the backup represented by the incremental backup206, the backup202and intervening incremental backups (the incremental backup204) are needed. The backup208can be recovered without any prior incremental backups.

The backup202is encrypted with a key210and the backup208is encrypted with the same key210. The incremental backups204and206are unencrypted in this example. The incremental backups204and206, in addition, are actual difference incremental backups rather than new data-based backups. More specifically, the backup202may be generated at time t1and the incremental backup204may be generated at time t2. The incremental backup t2may be a difference between contents of production data (e.g., a volume) at t2less contents of the production data (the volume) at time t2. This is distinct from an incremental backup that includes new data written to the volume or the production data between times t1and t2.

By making the incremental backups204and206difference backups, an attacker may have more difficulty reading or making sense of the incremental backups204and206even when not encrypted. If they were new data backups, the new data could be easily read if unencrypted.

In one example, the key210may be lost or unavailable for other reasons (e.g., deleted by an attacker). This may cause the backup202to be unrecoverable. Further the incremental backups204and206may not be useful without the backup202.

FIG.3is discussed with reference to backups such as full backups and incremental backups. Full snapshots and incremental snapshots are examples of, respectively, full backups and incremental backups.FIG.3discloses aspects of storing backups that allow backups to be recovered in the event that a key is lost, deleted, or unavailable for other reasons.FIG.3illustrates an example of recovering a backup when a key required to decrypt the backup is unavailable.

FIG.3illustrates two vaults300and310. The vaults300and310may cooperate to protect the same data, application, or set of applications. The vaults300and310may share the workload of protecting the data and may have no need to communicate. In general, the vaults300and310may not have direct overlap. For example, the backups and incremental backups in the vault300are distinct from the backups and incremental backups in the vault310. The vaults300and310may store data associated with different points in time. As a result, there is little need for the vault300to interact with the vault310. Because they are vaults in this example, there should be little to no communication or access from one of the vaults300and310to the other of the vaults300and310. There would be little reason to communicate even if they were separate backup storage systems rather than vaults. However, the vaults may be used as a last resort recovery mechanism.

In this example, the vaults300and310share a data protection workload and the backups stored by these vaults, including full and/or incremental backups (or snapshots), correspond to different points in time in some examples.

More specifically, the vault300includes an encrypted backup302and unencrypted incremental backup304. The vault310is separate and independent of the vault300but shares the same timestamp. The vault310stores an encrypted backup320that is encrypted with a key332and associated unencrypted incremental backup322. As previously discussed, the backup302and the backup320are different backups that correspond to different points in time. Further, the incremental backups304and322are distinct and correspond to different points in time and different to different full backups. A recovery operation may need to use both of the vaults300and310to successfully recover a production system.

In the vault300, the incremental backups associated with the backup302include at least a bridge backup340and an incremental backup304. In the vault310, the incremental backups associated with the backup320include at least an incremental backup322and a bridge backup350.

In this example, the bridge backup340and the bridge backup350correspond to the same point in time or the same timestamp. Further, the bridge backups340and350are, inFIG.3, incremental backups. These incremental backups are references as bridge backups340and350, by way of example, because they refer to the same point in time. The arrow connecting the bridge backups340and350illustrate that they have the same timestamp and allow a recovery operation to bridge from one vault to another vault. However, the bridge backup340and the bridge backup350may be different types. For instance, although the bridge backup350is illustrated as an incremental backup, the bridge backup350may be a full backup. Further, even if both the bridge backups340and350are incremental backups, their content may be different.

Generally, because the vaults300and310cooperate to generate backups (e.g., the vaults300and310generate full backups at different timestamps), the bridge backups in one vault may be different from the bridge backups in another vault. For example, the bridge backup350in the vault310may have a timestamp that is identical or the same as a timestamp of the bridge backup340in the vault300. As previously stated, the bridge backup350is not necessarily a copy of the bridge backup340because the vaults300and310are configured to cooperate, as previously stated, in the process of protecting a system rather than generate identical backup copies. More specifically, the bridge backups340and350, even though corresponding to the same point in time, may be different because they are difference incremental backups from the previous point in time backup in their respective vaults. For example, the bridge backup340having a timestamp of t6may be an incremental backup based on a previous incremental (or full) backup with a timestamp of t5. The bridge backup350also has a timestamp of t6but is based on an incremental (or full) backup with a timestamp of t4. Thus, the bridge backups340and350have the same timestamp but different content. However, embodiments of the invention ensure that each of the vaults300and310include a backup of some time with a timestamp that is the same as a timestamp of a backup of the other vault.

In this example, the bridge backup350is an incremental backup and is, as a result, unencrypted. However, a full backup that is encrypted with the key332may also be the bridge backup. For a system being recovered and by way of example, the vault300may be a first vault and the vault310may be a second vault, for example when the point in time to be recovered is in the vault300.

For example, there may be a need to perform a recovery to a point in time represented by the incremental backup304. In the event that the key306, used to decrypt the backup302, is lost and the backup302cannot be recovered, the recovery operation cannot recover the production system to the point in time represented by the incremental backup304.

Embodiments of the invention allow the backups in the vault310to aid in the recovery operation. Recovering to the incremental backup304using the vault310may include identifying the bridge backups340and350. Generally, the timestamp of the bridge backups may be earlier in time than the timestamp of point in time selected for recovery.

Embodiments of the invention may thus configure the data protection workload to ensure that the vault310includes at least one bridge backup340and that the vault300includes at least one bridge backup340.

For example, a decision may be made to recover to the incremental backup304. Because the key306is lost or unavailable, the bridge backups340and350are identified. Next, the backup320is identified based on the bridge backup350in the vault310. Once the backup320is identified, the recovery operation may begin by recovering the production system using the backup320and all incremental backups up to the bridge backup350. This may result in a partially recovered production system.

Next, the recovery operation continues and switches back to the backups in the vault300. Thus, the recovery operation applies all incremental backups from the bridge backup340to the incremental backup304. This allows the production system to be recovered to the point in time represented by the incremental backup304even though the full backup302is unavailable.

The bridge backups340and350, along with unencrypted incremental backups (difference backups in one example) ensure that a specific point of time from either of the vaults300and310can be recovered when one of the keys306and332is lost or unavailable. In one embodiment, there is at least one bridge backup between each two full backups.

Thus, the data protection system ensures that there is a bridge backup in each vault that has the same timestamp as a bridge backup in the other vault. The bridge backups can be of different types or of the same type. Even if of the same time, the content may differ. Rather, the recovery operation can recover up to the bridge backup in one vault and continue the recovery operation starting from the bridge vault in the other vault.

Embodiments of the invention thus host full snapshots or full backups of a system in their corresponding vault (or vaults) and/or on other backup storage systems. The full backups are associated with bridge backups. This allows recovery operations to specific points in time to be performed using backups (e.g., bridge backups) when a backup (the full backup) in the selected vault cannot be accessed.

FIG.4discloses aspects of a recovery operation. The method400includes initiating402a recovery operation. The recovery operation may be initiated for a variety of reasons such as corrupted data, faulty hardware, malware, or the like. During the recovery operation, the data protection system may determine404that a key required to decrypt a specific backup is unavailable. For example, the key may be lost or may have been deleted by an attacker.

More specifically, the recovery operation may have identified a particular backup to recover from a first or selected vault (or other backup storage system) that stores multiple backups. The recovery point to recover may correspond to a full backup and/or one or more incremental backups. After the recovery point is identified, the data protection system determines that the full backup (e.g., the full snapshot) cannot be accessed because the key needed for decryption is lost or unavailable.

Thus, the full backup from the selected or first vault cannot be used. The data protection system identifies406bridge backups. One of the bridge backups is in the selected or first vault and a corresponding bridge backup is stored in a different or second vault. This allows the recovery operation to be performed408using the bridge backups. The recovery process starts from the encrypted full backup associated with the bridge backup in the second vault. Thus, the encrypted full backup in the second vault is decrypted if necessary and any relevant incremental backups the second vault up to the bridge backup are applied to the decrypted full backup to generate a partially recovered production system. The recovery operation then reverts to the first vault to continue the recovery operation by applying incremental backups up to the recovery point stored in the first vault after the bridge backup in the first vault. This allows the recovery operation to be successfully performed408even though the key was unavailable for the backup stored in the first vault.

Embodiments of the invention thus allow the backups stored on other vaults to be used for last-resort access and to perform a recovery operation when a selected vault cannot be used, for example due to key unavailability.

Embodiments of the invention, such as the examples disclosed herein, may be beneficial in a variety of respects. For example, and as will be apparent from the present disclosure, one or more embodiments of the invention may provide one or more advantageous and unexpected effects, in any combination, some examples of which are set forth below. It should be noted that such effects are neither intended, nor should be construed, to limit the scope of the claimed invention in any way. It should further be noted that nothing herein should be construed as constituting an essential or indispensable element of any invention or embodiment. Rather, various aspects of the disclosed embodiments may be combined in a variety of ways so as to define yet further embodiments. For example, any element(s) of any embodiment may be combined with any element(s) of any other embodiment, to define still further embodiments. Such further embodiments are considered as being within the scope of this disclosure. As well, none of the embodiments embraced within the scope of this disclosure should be construed as resolving, or being limited to the resolution of, any particular problem(s). Nor should any such embodiments be construed to implement, or be limited to implementation of, any particular technical effect(s) or solution(s). Finally, it is not required that any embodiment implement any of the advantageous and unexpected effects disclosed herein.

It is noted that embodiments of the invention, whether claimed or not, cannot be performed, practically or otherwise, in the mind of a human. Accordingly, nothing herein should be construed as teaching or suggesting that any aspect of any embodiment of the invention could or would be performed, practically or otherwise, in the mind of a human. Further, and unless explicitly indicated otherwise herein, the disclosed methods, processes, and operations, are contemplated as being implemented by computing systems that may comprise hardware and/or software. That is, such methods processes, and operations, are defined as being computer-implemented.

The following is a discussion of aspects of example operating environments for various embodiments of the invention. This discussion is not intended to limit the scope of the invention, or the applicability of the embodiments, in any way.

In general, embodiments of the invention may be implemented in connection with systems, software, and components, that individually and/or collectively implement, and/or cause the implementation of, data protection operations which may include, but are not limited to, data replication operations, IO replication operations, data read/write/delete operations, data deduplication operations, data backup operations, data restore operations, data cloning operations, data archiving operations, and disaster recovery operations. More generally, the scope of the invention embraces any operating environment in which the disclosed concepts may be useful.

At least some embodiments of the invention provide for the implementation of the disclosed functionality in existing backup platforms, examples of which include the Dell-EMC NetWorker and Avamar platforms and associated backup software, and storage environments such as the Dell-EMC DataDomain storage environment. In general, however, the scope of the invention is not limited to any particular data backup platform or data storage environment.

New and/or modified data collected and/or generated in connection with some embodiments, may be stored in a data protection environment that may take the form of a public or private cloud storage environment, an on-premises storage environment, and hybrid storage environments that include public and private elements. Any of these example storage environments, may be partly, or completely, virtualized. The storage environment may comprise, or consist of, a datacenter which is operable to service read, write, delete, backup, restore, and/or cloning, operations initiated by one or more clients or other elements of the operating environment. Where a backup comprises groups of data with different respective characteristics, that data may be allocated, and stored, to different respective targets in the storage environment, where the targets each correspond to a data group having one or more particular characteristics.

Example cloud computing environments, which may or may not be public, include storage environments that may provide data protection functionality for one or more clients. Another example of a cloud computing environment is one in which processing, data protection, and other services may be performed on behalf of one or more clients. Some example cloud computing environments in connection with which embodiments of the invention may be employed include, but are not limited to, Microsoft Azure, Amazon AWS, Dell EMC Cloud Storage Services, and Google Cloud. More generally however, the scope of the invention is not limited to employment of any particular type or implementation of cloud computing environment.

In addition to the cloud environment, the operating environment may also include one or more clients that are capable of collecting, modifying, and creating, data. As such, a particular client may employ, or otherwise be associated with, one or more instances of each of one or more applications that perform such operations with respect to data. Such clients may comprise physical machines, containers, or virtual machines (VMs).

Particularly, devices in the operating environment may take the form of software, physical machines, containers, or VMs, or any combination of these, though no particular device implementation or configuration is required for any embodiment. Similarly, data protection system components such as databases, storage servers, storage volumes (LUNs), storage disks, replication services, backup servers, restore servers, backup clients, and restore clients, for example, may likewise take the form of software, physical machines, containers, or virtual machines (VM), though no particular component implementation is required for any embodiment. VM hard disks) for example.

As used herein, the term ‘data’ is intended to be broad in scope. Thus, that term embraces, by way of example and not limitation, data segments such as may be produced by data stream segmentation processes, data chunks, data blocks, atomic data, emails, objects of any type, files of any type including media files, word processing files, spreadsheet files, and database files, as well as contacts, directories, sub-directories, volumes, and any group of one or more of the foregoing.

Example embodiments of the invention are applicable to any system capable of storing and handling various types of objects, in analog, digital, or other form. Although terms such as document, file, segment, block, or object may be used by way of example, the principles of the disclosure are not limited to any particular form of representing and storing data or other information. Rather, such principles are equally applicable to any object capable of representing information.

As used herein, the term ‘backup’ is intended to be broad in scope. As such, example backups in connection with which embodiments of the invention may be employed include, but are not limited to, full backups, partial backups, clones, snapshots, and incremental or differential backups, difference backups or data-based difference backups.

It is noted that any operation(s) of any of these methods disclosed herein, may be performed in response to, as a result of, and/or, based upon, the performance of any preceding operation(s). Correspondingly, performance of one or more operations, for example, may be a predicate or trigger to subsequent performance of one or more additional operations. Thus, for example, the various operations that may make up a method may be linked together or otherwise associated with each other by way of relations such as the examples just noted. Finally, and while it is not required, the individual operations that make up the various example methods disclosed herein are, in some embodiments, performed in the specific sequence recited in those examples. In other embodiments, the individual operations that make up a disclosed method may be performed in a sequence other than the specific sequence recited.

Following are some further example embodiments of the invention. These are presented only by way of example and are not intended to limit the scope of the invention in any way.

Embodiment 1. A method comprising: initiating a recovery operation to recover a production system, identifying a point in time for the recovery operation, wherein the point in time is associated with an initial backup stored in a first vault associated with the production system, determining that a first key needed to decrypt the initial backup in the first vault is unavailable, identifying a starting backup in a second vault associated with the production system, identifying a second bridge backup stored in the second vault that is after the starting backup in the second vault, recovering the production system up to the second bridge backup using the starring backup and the second bridge backup in the second vault, and continuing to recover the production system from a first bridge backup stored in the first vault to incremental backup in the first vault corresponding to the point in time.

Embodiment 2. The method of embodiment 1, wherein the point in time for the recovery operation is associated with the initial backup and/or one or more incremental backups.

Embodiment 3. The method of embodiment 1 and/or 2, wherein the one or more incremental backups stored in the first vault are unencrypted.

Embodiment 4. The method of embodiment 1, 2, and/or 3, wherein each of the one or more incremental backups is a difference incremental backup and wherein the initial backup and the starting backup are full backups.

Embodiment 5. The method of embodiment 1, 2, 3, and/or 4, wherein the second bridge backup stored in the second vault corresponds to a same point in time as the first bridge backup stored in the first vault.

Embodiment 6. The method of embodiment 1, 2, 3, 4, and/or 5, wherein the bridge backups include one or more of difference backups and/or full backups.

Embodiment 7. The method of embodiment 1, 2, 3, 4, 5, and/or 6, wherein the first vault is connected via an air gap to a backup appliance that generates backups of the production system.

Embodiment 8. The method of embodiment 1, 2, 3, 4, 5, 6, and/or 7, wherein the first vault comprises a backup storage system.

Embodiment 9. The method of embodiment 1, 2, 3, 4, 5, 6, 7, and/or 8, further comprising recovering the backup using the starting backup from the second vault and incremental backups from the first vault and/or the second vault, wherein the starting backup is a full snapshot and wherein the one or more incremental backups are incremental snapshots.

Embodiment 10. The method of embodiment 1, 2, 3, 4, 5, 6, 7, 8, and/or 9, wherein the second key is known to the second vault.

Embodiment 11 A system, comprising hardware and/or software, operable to perform any of the operations, methods, or processes, or any portion of any of these, disclosed herein.

Embodiment 12 A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising the operations of any one or more of embodiments 1-11.

The embodiments disclosed herein may include the use of a special purpose or general-purpose computer including various computer hardware or software modules, as discussed in greater detail below. A computer may include a processor and computer storage media carrying instructions that, when executed by the processor and/or caused to be executed by the processor, perform any one or more of the methods disclosed herein, or any part(s) of any method disclosed.

As indicated above, embodiments within the scope of the present invention also include computer storage media, which are physical media for carrying or having computer-executable instructions or data structures stored thereon. Such computer storage media may be any available physical media that may be accessed by a general purpose or special purpose computer.

By way of example, and not limitation, such computer storage media may comprise hardware storage such as solid state disk/device (SSD), RAM, ROM, EEPROM, CD-ROM, flash memory, phase-change memory (“PCM”), or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other hardware storage devices which may be used to store program code in the form of computer-executable instructions or data structures, which may be accessed and executed by a general-purpose or special-purpose computer system to implement the disclosed functionality of the invention. Combinations of the above should also be included within the scope of computer storage media. Such media are also examples of non-transitory storage media, and non-transitory storage media also embraces cloud-based storage systems and structures, although the scope of the invention is not limited to these examples of non-transitory storage media.

Computer-executable instructions comprise, for example, instructions and data which, when executed, cause a general-purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. As such, some embodiments of the invention may be downloadable to one or more systems or devices, for example, from a website, mesh topology, or other source. As well, the scope of the invention embraces any hardware system or device that comprises an instance of an application that comprises the disclosed executable instructions.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts disclosed herein are disclosed as example forms of implementing the claims.

As used herein, the term module, component, engine, agent, client, or the like may refer to software objects or routines that execute on the computing system. The different components, modules, engines, and services described herein may be implemented as objects or processes that execute on the computing system, for example, as separate threads. While the system and methods described herein may be implemented in software, implementations in hardware or a combination of software and hardware are also possible and contemplated. In the present disclosure, a ‘computing entity’ may be any computing system as previously defined herein, or any module or combination of modules running on a computing system.

In at least some instances, a hardware processor is provided that is operable to carry out executable instructions for performing a method or process, such as the methods and processes disclosed herein. The hardware processor may or may not comprise an element of other hardware, such as the computing devices and systems disclosed herein.

In terms of computing environments, embodiments of the invention may be performed in client-server environments, whether network or local environments, or in any other suitable environment. Suitable operating environments for at least some embodiments of the invention include cloud computing environments where one or more of a client, server, or other machine may reside and operate in a cloud environment.

With reference briefly now toFIG.5, any one or more of the entities disclosed, or implied, by the Figures, and/or elsewhere herein, may take the form of, or include, or be implemented on, or hosted by, a physical computing device, one example of which is denoted at5. As well, where any of the aforementioned elements comprise or consist of a virtual machine (VM), that VM may constitute a virtualization of any combination of the physical components disclosed inFIG.5.

In the example ofFIG.5, the physical computing device500includes a memory502which may include one, some, or all, of random access memory (RAM), non-volatile memory (NVM)504such as NVRAM for example, read-only memory (ROM), and persistent memory, one or more hardware processors506, non-transitory storage media508, UI device510, and data storage512. One or more of the memory components502of the physical computing device500may take the form of solid-state device (SSD) storage. As well, one or more applications514may be provided that comprise instructions executable by one or more hardware processors506to perform any of the operations, or portions thereof, disclosed herein. The device500may also represent a computing environment such as an edge system, a cloud-based system, a cluster of resources or the like.

Such executable instructions may take various forms including, for example, instructions executable to perform any method or portion thereof disclosed herein, and/or executable by/at any of a storage site, whether on-premises at an enterprise, or a cloud computing site, client, datacenter, data protection site including a cloud storage site, or backup server, to perform any of the functions disclosed herein. As well, such instructions may be executable to perform any of the other operations and methods, and any portions thereof, disclosed herein.

The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.