Patent ID: 6907512

Claim:
A computer-readable medium having computer-executable instructions for performing steps by a write filter in an operating system running in a computing device, the computer having a main storage medium having stored thereon an operating system image, the steps comprising: intercepting a write request from the operating system to write data into the main storage medium at a specified location; writing the data of the write request and data representing the specified location into an auxiliary storage medium, the auxiliary storage medium being non-volatile; receiving a checkpoint request to watermark data stored on the auxiliary storage medium; creating a checkpoint for watermarking data stored in the auxiliary storage medium as of a time of the checkpoint for preventing the data stored of the time of the checkpoint from being written over; receiving a rollback request; in response to the rollback request, deleting data in the auxiliary storage medium stored after the checkpoint; and removing the checkpoint to allow the data stored as of the time of the checkpoint to be written over.