Patent ID: 8510837

Claim:
A storage area network (SAN) routing device configured to provide one or more host systems with access to one or more storage volumes present on a storage device, comprising: a processor; a storage networking interface configured to manage read and write requests made by the host systems to access the one or more storage volumes, and wherein the SAN routing device provides the one or more host systems with access to the storage volumes such that a mounted storage volume appears to a host system as a storage device physically present on the host system; and a memory that includes a program, wherein the program is configured to: mount, by the routing device, one of the storage volumes present on the storage device, retrieve a manifest specifying a list of files, wherein the list of files specifies a list of known rootkit signatures, generate a file signature for each of one or more files on the mounted storage volume host system, and compare each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems.