Druva Inc.

A system includes a data management server and a data store. The data store uses an external file system to store the data of a client virtual machine (VM) which uses an internal file system. The server comprises an agent VM. Responsive to receiving a request to retrieve a file from a filesystem snapshot, the agent VM determines a path of the internal files system of the client VM and mounts a virtual file system at the agent VM based on the determined path. The virtual file system represents the internal file system of the client virtual machine. The agent VM uses a block device protocol to translate the internal file address to an external file address of the external file system. The agent VM retrieves the file stored in the data store based on the external file address and provides the retrieved file to the target device.

The invention relates to a system and method for restoring data of a virtual machine. The system includes a memory for storing one or more processor-executable routines, and a processor communicatively coupled to the memory to execute the one or more processor-executable routines to access a plurality of virtual machine snapshots of the virtual machine from a storage. The snapshots include block-level snapshots. The processor is configured to scan the plurality of virtual machine snapshots to identify one or more malicious files present in the snapshots, and generate a report with details of malicious files present in the snapshots. The processor is configured to implement a first workflow to patch the identified malicious files while restoring the data. The processor is further configured to implement a second workflow to identify snapshots that comprise block signatures similar to the malicious files and to mark the identified snapshots as malicious snapshots.

A system for performing an antivirus scan of backup snapshots of a virtual machine is provided. The system includes a memory storing one or more processor-executable routines and a processor communicatively coupled to the memory. The processor is configured to execute the one or more processor-executable routines to access a plurality of backup snapshots of the virtual machine and perform a complete antivirus scan of one or more snapshots to identify a reference snapshot. The reference snapshot includes one or more malicious files. The processor is further configured to compare file system metadata of a first snapshot with respective file system metadata of the reference snapshot to identify files that have changed between the first and reference snapshots and perform the antivirus scan of the identified changed files to detect one or more malicious files and to generate an updated list of the malicious files. The processor is further configured to access a second snapshot and the updated list of malicious files with corresponding metadata of the files and perform first, second and third screenings of the second snapshot to detect an infected snapshot. The processor is further configured to compare disk offsets and checksum of corresponding data at the disk offsets, metadata and file checksum respectively of the malicious files with corresponding files of the second snapshot to perform the first, second and third screenings in a sequential manner. The processor is further configured to repeat the first, second and third screenings for the plurality of backup snapshots of the virtual machine.

A system includes a data management server and a data store. The data store uses an external file system to store data block of a client virtual machine. The client virtual machine uses an internal file system. The data management server comprises a proxy agent and a staging virtual machine. In response to receiving a request to retrieve a file indexed by the client virtual machine, the proxy agent imports data of the internal file system to a staging virtual machine. The proxy agent determines an internal file address that corresponds to the requested file. The staging virtual machine translates the internal file address to an external file address of the external file system. The staging virtual machine retrieves the file stored in the data store based on the external file address. The staging virtual machine provides the retrieved file to the target device.

A system includes a data management server and a data store. The data store uses an external file system to store data block of a client virtual machine. The client virtual machine uses an internal file system. The data management server comprises a proxy agent and a staging virtual machine. In response to receiving a request to retrieve a file indexed by the client virtual machine, the proxy agent imports data of the internal file system to a staging virtual machine. The proxy agent determines an internal file address that corresponds to the requested file. The staging virtual machine translates the internal file address to an external file address of the external file system. The staging virtual machine retrieves the file stored in the data store based on the external file address. The staging virtual machine provides the retrieved file to the target device.