Systems and methods to detect deleted files

Abstract

A data storage system protects data identified for deletion which has been created or modified between scheduled data backups. For instance, the system monitors data operations and when the data operation is a delete, the system determines whether the data identified for deletion has been protected by a backup operation. Data that has not been backed up, such as newly created data, is copied to temporary storage before deletion. When the data has been protected, the system determines whether the data has been modified after the backup operation. Data modified after the backup operation is copied to temporary storage before deletion.

1 . (canceled) 
     
     
         2 . A method to protect data deleted between data protection operations in a data management system, the method comprising:
 automatically monitoring, with a driver module in a first computing device comprising computer hardware, one or more data operations in primary storage of a client computing device that occur after one or more data protection operations;   when the one or more data operations is a deletion operation, automatically identifying deletion data associated with the deletion operation;   determining whether the deletion data has been protected by the one or more data protection operations, and when the deletion data has not been protected, automatically converting the deletion data to a hidden file;   automatically copying the hidden file to temporary storage; and   automatically migrating, during a subsequent second data protection operation, the hidden file stored in the temporary storage to secondary storage.   
     
     
         3 . The method of  claim 2  further comprising automatically deleting the hidden file from primary storage after the hidden file is copied to the temporary storage. 
     
     
         4 . The method of  claim 2  further comprising automatically saving file path data in the temporary storage that is associated with the hidden file. 
     
     
         5 . The method of  claim 2  further comprising automatically migrating differences between the deletion data and previously backed up data. 
     
     
         6 . The method of  claim 2  wherein the driver module associated with the client computing device tracks the one or more data operations that result from actions of a user. 
     
     
         7 . The method of  claim 2  further comprising:
 automatically receiving, with the driver module, the time of a previous data protection operation from a storage information manager; and 
 automatically receiving, with the driver module, the time of a last edit operation of the deletion data. 
 
     
     
         8 . The method of  claim 7  wherein the time of the last edit operation comprises a creation time when the deletion data comprises new data. 
     
     
         9 . The method of  claim 7  further comprising, when the time of a previous data protection operation is before the time of the last edit operation, automatically determining, with the driver module, that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation. 
     
     
         10 . The method of  claim 2  further comprising automatically receiving, with the driver module, an indication from a storage information manager that the deletion data has not been protected. 
     
     
         11 . The method of  claim 2  further comprising automatically receiving, with the driver module, a Universal Sequence Number (USN) from a file system change journal associated with the client computing device to determine whether the deletion data is protected. 
     
     
         12 . A system to protect data deleted between data protection operations in an information management cell, the system comprising:
 a driver module in a first computing device comprising computer hardware configured to automatically monitor data operations in primary storage of a client computing device that occur after one or more data protection operations;   when the one or more data protection operations is a deletion operation, the driver module automatically identifies deletion data associated with the deletion operation;   the driver module further configured to determine whether the deletion data has been protected by the one or more data protection operations, and when the deletion data has not been protected, automatically converting the deletion data to a hidden file;   the driver module further configured to copy the hidden file to temporary storage;   the driver module configured to migrate, during a subsequent data protection operation, the hidden file stored in the temporary storage to secondary storage.   
     
     
         13 . The system of  claim 12  wherein the driver module is further configured to automatically delete the hidden file from primary storage after the hidden file is copied to the temporary storage. 
     
     
         14 . The system of  claim 2  wherein the driver module is further configured to automatically save file path data in the temporary storage that is associated with the hidden file. 
     
     
         15 . The system of  claim 2  wherein the driver module is further configured to automatically migrate differences between the deletion data and previously backed up data. 
     
     
         16 . The system of  claim 12  wherein the driver module associated with the client computing device tracks the one or more data operations that result from actions of a user. 
     
     
         17 . The system of  claim 12  wherein the driver module is further configured to automatically receive the time of a previous data protection operation from a storage information manager and automatically receive the time of a last edit operation of the deletion data. 
     
     
         18 . The system of  claim 17  wherein the time of the last edit operation comprises a creation time when the deletion data comprises new data. 
     
     
         19 . The system of  claim 17  wherein when the time of a previous data protection operation is before the time of the last edit operation, the driver module is further configured to automatically determine that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation. 
     
     
         20 . The system of  claim 12  wherein the driver module is further configured to automatically receive an indication from a storage information manager that the deletion data has not been protected. 
     
     
         21 . The system of  claim 12  wherein the driver module is further configured to automatically receive a Universal Sequence Number (USN) from a file system change journal associated with the client computing device to determine whether the deletion data is protected.