Patent ID: 7506379

Claim:
A method for detecting a modification to stored data, comprising: creating a point-in-time copy of a storage level logical unit, said point-in-time copy comprising a volume copy of said storage level logical unit and a signature of said storage level logical unit; comparing at least a portion of said point-in-time copy with a previous copy of the storage level logical unit, wherein said previous copy of the storage level logical unit comprises an original copy of the storage level logical unit; judging, based on said comparing, if a modification has occurred wherein said modification comprises at least one of an intrusion, unwanted modification; removing said point-in-time copy and saving said previous copy of the storage level logical unit for data recovery, if an intrusion has been judged; marking said point-in-time copy as a good copy and removing said previous copy of the storage level logical unit, if an intrusion has not been judged; defining access rules to identify which files of said storage level logical unit are monitored in said point-in-time copy; creating a list of modified blocks of said previous copy and a list of blocks of said point-in-time copy; and comparing modified blocks of said list of blocks of said point-in-time copy with corresponding blocks of said list of blocks of said previous copy.