Patent ID: 8091135

Claim:
A computer system including a personal computer, a virus-scan device and a storage device storing data from the personal computer in a plurality of logical volumes arranged in memory areas of one or a plurality of hard disk drives, wherein, the plurality of logical volumes comprises, a primary volume that is a target for a virus-scan, the primary volume configured to store data from the personal computer; a snapshot volume configured to store the status of the primary volume at a given point in time; and a save destination volume configured to store a copy of an updated block address from the primary volume corresponding to an updated memory area within the primary volume, an indication of an updated status of the updated memory area reflected in a bitmap; wherein, the storage device suspends input and output exchange with the personal computer prior to the save destination volume storing the copy of an updated block address, the storage device copies updated block address information of the primary volume to the save destination volume and creates the snapshot volume of the primary volume, the personal computer suspends input/output (I/O) to the storage device before the copy and resumes I/O to the storage device after accomplishing the copy, and the virus-scan device mounts the save destination volume and the snapshot volume; detects only an updated file in the primary volume from the snapshot volume and the save destination volume; creates an updated volume for storing a relevant updated file; executes a virus-scan on the updated volume; when the updated volume is infected, mounts the primary volume; and disinfects only the updated file in the primary volume by referring to the result of the virus-scan.