Detecting modifications to a storage that occur in an alternate operating environment

Abstract

Detecting modifications to a storage that occur in an alternate operating environment. In one example embodiment, a method for detecting modifications to a storage that occur in an alternate operating environment may include tracking, in a modify map, modifications to a storage that occur during operation of a primary operating environment, identifying a first most recent transaction identifier in a journal of a file system of the storage prior to closing of the storage by the primary operating environment, upon opening of the storage by the primary operating environment, identifying a second most recent transaction identifier in the journal, determining that the second most recent transaction identifier does not match the first most recent transaction identifier, concluding that the storage was modified in an alternate operating environment between the closing and the opening of the storage by the primary operating environment, and invalidating the modify map.

1 . A method for detecting modifications to a storage that occur in an alternate operating environment, the method comprising:
 tracking, in a modify map, modifications to a storage that occur during operation of a primary operating environment;   identifying a first most recent transaction identifier in a journal of a file system of the storage prior to closing of the storage by the primary operating environment;   upon opening of the storage by the primary operating environment, identifying a second most recent transaction identifier in the journal;   determining that the second most recent transaction identifier does not match the first most recent transaction identifier;   concluding that the storage was modified in an alternate operating environment between the closing and the opening of the storage by the primary operating environment; and   invalidating the modify map.   
     
     
         2 . The method as recited in  claim 1 , wherein the invalidating of the modify map includes discontinuing tracking, in the modify map, modifications to the storage that occur during operation of the primary operating environment until a next snapshot of the storage. 
     
     
         3 . The method as recited in  claim 1 , further comprising:
 performing a full backup, instead of an incremental backup or a decremental backup, of the storage due to the invalidated modify map.   
     
     
         4 . The method as recited in  claim 1 , further comprising:
 performing a full compare between the storage and a most recent backup of the storage prior to performing an incremental backup or a decremental backup of the storage due to the invalidated modify map.   
     
     
         5 . The method as recited in  claim 1 , wherein:
 the primary operating environment is an operating system; and   the tracking is performed by a backup module that executes upon opening the storage within the operating system and prior to any writes by the operating system to the storage.   
     
     
         6 . The method as recited in  claim 5 , wherein:
 the alternate operating environment is a second operating system; and   the backup module is not capable of tracking changes made to the storage during operation of the second operating system.   
     
     
         7 . The method as recited in  claim 5 , wherein:
 the alternate operating environment is a pre-boot virus scanner; and   the backup module is not capable of tracking changes made to the storage during operation of the pre-boot virus scanner.   
     
     
         8 . The method as recited in  claim 5 , wherein:
 the alternate operating environment is a boot environment; and   the backup module is not capable of tracking changes made to the storage during operation of the boot environment.   
     
     
         9 . The method as recited in  claim 5 , wherein the file system of the storage is a New Technology File System (NTFS) file system. 
     
     
         10 . One or more non-transitory computer-readable media storing one or more programs that are configured, when executed, to cause one or more processors to perform the method as recited in  claim 1 . 
     
     
         11 . A method for detecting modifications to a storage that occur in an alternate operating environment, the method comprising:
 tracking, in a modify map, modifications to a storage that occur during operation of a primary operating environment;   calculating a first checksum of file system metadata of a file system of the storage prior to closing of the storage by the primary operating environment;   upon opening of the storage by the primary operating environment, calculating a second checksum of the file system metadata of the file system of the storage;   determining that the second checksum does not match the first checksum;   concluding that the storage was modified in an alternate operating environment between the closing and the opening of the storage by the primary operating environment; and   invalidating the modify map.   
     
     
         12 . The method as recited in  claim 11 , wherein the invalidating of the modify map includes discontinuing tracking, in the modify map, modifications to the storage that occur during operation of the primary operating environment until a next snapshot of the storage. 
     
     
         13 . The method as recited in  claim 11 , further comprising:
 performing a full backup, instead of an incremental backup or a decremental backup, of the storage due to the invalidated modify map.   
     
     
         14 . The method as recited in  claim 11 , further comprising:
 performing a full compare between the storage and a most recent backup of the storage prior to performing an incremental backup or a decremental backup of the storage due to the invalidated modify map.   
     
     
         15 . The method as recited in  claim 11 , wherein:
 the primary operating environment is an operating system; and   the tracking is performed by a backup module that executes upon opening the storage within the operating system and prior to any writes by the operating system to the storage.   
     
     
         16 . The method as recited in  claim 15 , wherein:
 the alternate operating environment is a second operating system; and   the backup module is not capable of tracking changes made to the storage during operation of the second operating system.   
     
     
         17 . The method as recited in  claim 15 , wherein:
 the alternate operating environment is a pre-boot virus scanner; and   the backup module is not capable of tracking changes made to the storage during operation of the pre-boot virus scanner.   
     
     
         18 . The method as recited in  claim 15 , wherein:
 the alternate operating environment is a boot environment; and   the backup module is not capable of tracking changes made to the storage during operation of the boot environment.   
     
     
         19 . The method as recited in  claim 15 , wherein:
 the file system of the storage is a New Technology File System (NTFS) file system; and   the first checksum and the second checksum are calculated on a log of the file system metadata of the NTFS file system.   
     
     
         20 . One or more non-transitory computer-readable media storing one or more programs that are configured, when executed, to cause one or more processors to perform the method as recited in  claim 11 .