Patent ID: 8849777

Claim:
A method for protecting data, the method comprising: receiving a first changed block corresponding to a section of a Master File Table (“MFT”) that has changed since a previous backup, wherein the first changed block is associated with a plurality of files in the MFT; updating, in response to receiving the first changed block, a backup database associated with the MFT, wherein the backup database comprises one or more entries that each comprise a reference flag and a timestamp, and wherein updating the backup database includes: determining whether the first changed block comprises one or more new files that have been added to the MFT since the previous backup, wherein a new backup database entry is created in the event that a file in the first changed block does not correspond to any existing backup database entries, and wherein the new backup database entry comprises a reference flag set to a current backup version; determining whether the first changed block comprises one or more files in the MFT that have been modified since the previous backup including by setting to the current backup version: (1) a reference flag that is associated with a backup database entry for each of the plurality of files comprising the first changed block, and (2) a reference flag that is associated with each new backup database entry for one or more files that are determined to have been modified; determining whether the first changed block comprises one or more files in the MFT that have been deleted since the previous backup at least in part by reading the previous backup to determine a list of files associated with the first changed block at a time of the previous backup; for a first file in the list of files associated with the first changed block: identifying a backup database entry associated with the first file; determining whether the reference flag is set to the current backup version; and in the event that the reference flag is not set to the current backup version, modifying the backup database entry associated with the first file indicating that the first file has been deleted since the previous backup.