Patent Document ID: 8893277
Application ID: 12783899
Patent Status: 1

Claim One:
1. A method of operating a data identification system, the method comprising: identifying a first plurality of changed blocks in a first virtual machine file stored on a physical storage system; processing the first plurality of changed blocks to generate a first plurality of fingerprints; scanning a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks; identifying a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item; identifying a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file; processing the second plurality of changed blocks to generate a second plurality of fingerprints; and identifying a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.