Patent ID: 7756834

Claim:
A method for malware recovery in a computer system comprising: a) repeatedly making associated data backups at the computer system for each of a plurality of files by making a series of snapshots of file storage volumes containing said plurality of files, each of said data backups comprising versions of said associated file, including uncorrupted versions of said associated file in an uncorrupted state; b) determining that an attack by a malicious program has occurred at the computer system; c) identifying at the computer system corrupted files of said plurality of files that were corrupted by said malicious program; d) for each said corrupted file, scanning by the computer system said series of snapshots to identify an uncorrupted version of said uncorrupted versions of said file; e) for each said corrupted file, restoring at the computer system said file to one of said uncorrupted versions thereof; f) creating and maintaining an event log at the computer system that contains write events corresponding to writes performed by said plurality of files; g) performing a forensic scan that scans said event log to determine modifying writes of said writes that were made by said corrupted files and which modified further files of said plurality of files; and h) for each of said further files, identifying unmodified versions thereof and restoring at the computer system said further file to one of said unmodified versions thereof.