Patent ID: 8490189

Claim:
A method comprising: performing the following in a secure partition of a host system, the secure partition provided by firmware of a chipset of the host system, wherein the secure partition is isolated from a host operating system of the host system: obtaining file metadata for a plurality of files stored on a device coupled to the host system; using the file metadata to identify a first file of the plurality of files for examination for tampering; obtaining data blocks for the first file; communicating with a service via an out-of-band communication channel, wherein the out-of-band communication channel comprises a secure communication channel between the chipset of the host system and an enterprise service that manages the host system as one of a plurality of managed host systems; using information obtained from the service and the data blocks to determine whether the first file has been corrupted, including constructing a reconstructed version of the first file from the data blocks; and determining whether the first file is corrupted using the reconstructed version of the first file.