Patent ID: 7962956

Claim:
A method of evaluating incremental backup copies of data stored in a data storage device of a computer, the method comprising: accessing a first snapshot of a data storage device, the first snapshot comprising an incremental backup of the data of the data storage device and including information indicative of sectors of the data storage device that have been modified, the first snapshot being taken at a first point in time; reading from the data storage device current contents of a first modified sector of the data storage device noted in the first snapshot, the first modified sector containing data of a first file; scanning the current contents of the first modified sector in the data storage device and corresponding data in the incremental backup for malicious codes, the first modified sector being selected for scanning for malicious codes based on information from the incremental backup; reading from the data storage device current contents of a second modified sector of the data storage device noted in the first snapshot, the second modified sector containing data of a second file that is different from the first file; scanning the current contents of the second modified sector in the data storage device and corresponding data in the incremental backup for malicious codes, the second modified sector being selected for scanning for malicious code based on information from the incremental backup; and determining if the first snapshot together with a full backup of the data storage device can be used for restoring the data storage device based at least on scanning for malicious codes of current contents of individual modified sectors of the data storage device noted in the first snapshot.