Patent ID: 7640404

Claim:
A computer-implemented method for file-based write filtering, wherein a write filter comprises a file exclusion list, the method comprising: receiving a function call from an application programming interface to perform at least one of (1) read certain data from a file stored on a storage of a computer or (2) write particular data to a file stored on the storage of the computer, said storage being a read-only storage medium; if the received function call is to read the certain data from a file, then determining whether the certain data is in a cache memory; in response to said determining indicating that the certain data is in the cache memory, reading the certain data from the cache memory, and returning the certain data from the cache memory to the application program interface, and in response to said determining indicating that the certain data is not in the cache memory, passing the read function call to a system driver; if the received function call is a file-based write request to write particular data to a file on the storage, then determining whether the particular data is to be written to a file identified on the file exclusion list, said file exclusion list including information identifying files that can be written on a write-protected storage volume other than the storage of the computer; in response to said determining indicating that the particular data is to be written to the file identified on the file exclusion list, writing the particular data to the file on the write-protected storage volume, and returning notification of a successful write on the storage to the application program interface, in response to said determining indicating that the particular data is to be written to a file not identified on the file exclusion list, writing the particular data to the cache memory, making the written particular data available on the cache memory without having the particular data written on the write-protected storage volume, and returning notification of the successful write on the storage to the application programming interface such that the application programming interface can proceed with its process even though the particular data is written on the cache memory and not the storage, wherein contents in the cache memory are deleted from the computer before rebooting the computer; and balancing the data in a cache memory data structure, said balancing comprising organizing the cache memory data structure, said cache memory data structure including a root node and leaf nodes and comprising a binary search tree with an additional property for each node of the cache memory data structure, wherein the tree structure guarantees that no path from the root to any leaf nodes can be more than twice as long as any other paths.