Patent ID: 7765592

Claim:
A method of automatically identifying changes to a computer system, comprising: scanning the computer system for all active software components; investigating a history of changes made to files associated with each of the active software components discovered during the scanning to find recently updated files, the investigating including: narrowing a time range when a file was updated regardless of inclusion of a time stamp for the respective file, the narrowing including: setting a lower-bound for the time range when a first restore point sub-folder was created; setting an upper-bound for the time range when a second restore point sub-folder was created; examining a recording sequence of pre-image timestamps in a file change log for each of the first restore point sub-folder and the second restore point sub-folder; and determining a narrowed time range for the file based on one or more of the examined pre-image timestamps, such that the narrowed time range is not bounded by the lower-bound and the upper-bound; and ranking each of the active software components by how recently the files were updated on the computer system.