Systems and methods to detect deleted files

Abstract

A data storage system protects data identified for deletion which has been created or modified between scheduled data backups. For instance, the system monitors data operations and when the data operation is a delete, the system determines whether the data identified for deletion has been protected by a backup operation. Data that has not been backed up, such as newly created data, is copied to temporary storage before deletion. When the data has been protected, the system determines whether the data has been modified after the backup operation. Data modified after the backup operation is copied to temporary storage before deletion.

1 . (canceled) 
     
     
         2 . A method to protect data deleted between data protection operations, the method comprising:
 determining with one or more computer processors whether deletion data to be deleted from primary memory has been protected by one or more data protection operations, and when the deletion data has not been protected, automatically converting the deletion data to at least one hidden file;   automatically copying with the one or more computer processors the at least one hidden file to temporary storage; and   automatically copying, during a subsequent data protection operation, the at least one hidden file stored in the temporary storage to one or more secondary storage devices.   
     
     
         3 . The method of  claim 2  further comprising merging the at least one hidden file with secondary data stored on the one or more secondary storage devices based at least in part on a file path associated with the deletion data. 
     
     
         4 . The method of  claim 2  further comprising automatically deleting the at least one hidden file from primary storage after the at least one hidden file is copied to the temporary storage. 
     
     
         5 . The method of  claim 2  further comprising automatically migrating differences between the deletion data and previously backed up data. 
     
     
         6 . The method of  claim 2  further comprising tracking one or more deletion operations that result from actions of a user. 
     
     
         7 . The method of  claim 2  further comprising:
 automatically receiving a first time associated with a previous data protection operation from a storage information manager; and 
 automatically receiving a second time associated with a last edit operation of the deletion data. 
 
     
     
         8 . The method of  claim 7  wherein the second time comprises a creation time when the deletion data comprises new data. 
     
     
         9 . The method of  claim 7  further comprising, when the first time occurs before the second time, automatically determining, with a filter driver, that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation. 
     
     
         10 . The method of  claim 2  wherein a filter driver copies the at least one hidden file to temporary storage when a deletion operation is detected. 
     
     
         11 . The method of  claim 2  further comprising automatically receiving a Universal Sequence Number (USN) from a file system change journal associated with a client computing device to determine whether the deletion data is protected. 
     
     
         12 . A system to protect data deleted between data protection operations, the system comprising:
 one or more computer processors that determine whether deletion data to be deleted from primary memory has been protected by one or more data protection operations, and when the deletion data has not been protected, the one or more computer processors automatically convert the deletion data to at least one hidden file;   the one or more computer processors further configured to automatically copy the at least one hidden file to temporary storage; and   the one or more computer processors further configured to automatically copy, during a subsequent data protection operation, the at least one hidden file stored in the temporary storage to one or more secondary storage devices.   
     
     
         13 . The system of  claim 12  wherein the one or more computer processors are further configured to merge the at least one hidden file with secondary data stored on the one or more secondary storage devices based at least in part on a file path associated with the deletion data. 
     
     
         14 . The system of  claim 12  wherein the one or more computer processors are further configured to automatically delete the at least one hidden file from primary storage after the at least one hidden file is copied to the temporary storage. 
     
     
         15 . The system of  claim 12  wherein the one or more computer processors are further configured to automatically migrate differences between the deletion data and previously backed up data. 
     
     
         16 . The system of  claim 12  wherein the one or more computer processors are further configured to track one or more deletion operations that result from actions of a user. 
     
     
         17 . The system of  claim 12  wherein the one or more computer processors are further configured to:
 automatically receive a first time associated with a previous data protection operation from a storage information manager; and 
 automatically receive a second time associated with a last edit operation of the deletion data. 
 
     
     
         18 . The system of  claim 17  wherein the second time comprises a creation time when the deletion data comprises new data. 
     
     
         19 . The system of  claim 17  further comprising a filter driver module that automatically determines, when the first time occurs before the second time, that the deletion data is not protected, the deletion data comprising data created or modified since the previous data protection operation. 
     
     
         20 . The system of  claim 12  further comprising a filter driver that copies the at least one hidden file to temporary storage when a deletion operation is detected. 
     
     
         21 . The system of  claim 12  wherein the one or more computer processors are further configured to automatically receive a Universal Sequence Number (USN) from a file system change journal associated with a client computing device to determine whether the deletion data is protected.