Patent ID: 8230500

Claim:
A computer-implemented method, at least a portion of the computer-implemented method being performed by a computing system comprising at least one processor, the computer-implemented method comprising: detecting a rootkit that is able to hide files from attempts to map a volume formatted in a New technology File System (NTFS) format; from a control platform, identifying a first directory listing associated with a file system of the volume, the control platform being a secure software platform that runs directly on trusted hardware of a computing device; from a target platform, identifying a second directory listing associated with the file system of the volume, the control platform and the target platform executing in parallel on a computing device, the target platform being an insecure operating system that communicates with the hardware of the computing device through the control platform; detecting a discrepancy between the first directory listing and the second directory listing; determining that the discrepancy is the result of the target platform being infected with the rootkit that is able to hide files from the attempt to map the volume; removing the rootkit.