Systems, methods, and apparatus for fast ransomware recovery

Abstract

Methods and apparatus for protecting data. Backup copies of data are created in real time and restoration of this backup data is enabled. For example, backup repositories of files stored in a primary storage device of a computer system may be created by examining information concerning the files to determine critical fields therein, and storage of the critical fields to a critical storage device and of non-critical fields and tags that are substituted for the critical fields to a context storage device effected. Following compromise of the files stored in the primary storage device, accesses by applications may be directed to the context storage device, e.g., as a means of rapid failover, and/or for each file stored in the context storage device, record-by-record copying of such files to the primary storage device may be effected to restore the contents of the primary storage device.

What is claimed is: 
     
         1 . A method, comprising:
 reading a first record to be deleted from a primary storage device;   determining a tag of the first record that has been stored in place of a critical field of first record, wherein the critical field is stored in a critical storage device; and   if the tag is not being referenced by a second record stored in the primary storage device, deleting the critical field stored in the critical storage device, wherein the second record is not being deleted from the primary storage device.   
     
     
         2 . The method of  claim 1 , wherein the tag points to the critical field stored in the critical storage device. 
     
     
         3 . The method of  claim 1 , wherein the critical field includes one or more of a last name, first name, a middle initial, a date of birth, and an address of a patient. 
     
     
         4 . The method of  claim 1 , further comprising after the critical field stored in the critical storage device has been deleted, deleting the first record from the primary storage device. 
     
     
         5 . The method of  claim 1  wherein a copy of the first record is stored in a context storage device. 
     
     
         6 . The method of  claim 5 , further comprising after the critical field stored in the critical storage device has been deleted, deleting the copy of the first record from the context storage device. 
     
     
         7 . A computer system comprising:
 a primary storage device;   a context storage device;   a critical storage device; and   a backup controller configured to:
 read a first record to be deleted from the primary storage device; 
 determine a tag of the first record that has been stored in place of a critical field of the first record, wherein the critical field is stored in the critical storage device; and 
 if the tag is not being referenced by a second record stored in the primary storage device, delete the critical field stored in the critical storage device, wherein the second record is not being deleted from the primary storage device. 
   
     
     
         8 . The computer system of  claim 7 , wherein the tag points to the critical field stored in the critical storage device. 
     
     
         9 . The computer system of  claim 7 , wherein the critical field includes one or more of a last name, first name, a middle initial, a date of birth, and an address of a patient. 
     
     
         10 . The computer system of  claim 7 , wherein the backup controller is further configured to delete the first record from the primary storage device after the critical field stored in the critical storage device has been deleted. 
     
     
         11 . The computer system of  claim 7 , wherein a copy of the first record is stored in the context storage device. 
     
     
         12 . The computer system of  claim 11 , wherein the backup controller is further configured to delete the copy of the first record from the context storage device after the critical field stored in the critical storage device has been deleted.