Using disassociated images for computer and storage resource management

RELATED APPLICATIONS

P-0001[0001] This application claims priority to commonly owned copending application serial No. 60/370,100 filed Apr. 3, 2002, which is incorporated herein by reference.

FIELD OF THE INVENTION

P-0002[0002] The present invention relates generally to computer storage and other computer resources. The invention provides tools and techniques used on one computer to browse or modify a copy of stored data from another computer, in order to help manage resources of that other computer. For classification purposes, it may also be helpful to note that computer operations discussed herein comprise taking inventory of computer state and components, communicating across a network, copying, indexing, loading, searching, and writing data, as well as data operations such as partition manipulation.

TECHNICAL BACKGROUND OF THE INVENTION

P-0003[0003] A wide variety of tools and techniques are known for making backup copies of data stored on a computer's disk(s), and for restoring that data to those disk(s) or to their replacement(s) on the computer. For instance, data may be copied from a permanently installed local hard disk onto a removable medium, such as a floppy, an Iomega ZIP brand drive, or a USB portable disk drive that is temporarily attached to the computer. Data may also be copied over a network or other communications link, e.g., to archive client data on a server, or to mirror data from one server to another server. Data may be copied a few files at a time, or it may be copied in larger amounts in a file-by-file image or a sector-by-sector image. Data may be copied in a single snapshot or other archive that matches the computer's storage contents at a given point in time, in which case the snapshot may be subsequently supplemented by incremental images, to update the snapshot so that it matches the state of the computer's storage at later times. Data in a remote copy may also be continuously updated by a mirroring process, so a secondary computer's storage is updated each time a sector of data is written to a corresponding primary computer's storage.

P-0004[0004] Often data is backed up simply as a precaution, so it can be restored if a hard drive fails or a virus corrupts it, for instance. If no disaster strikes, the backup copy is often not used. On occasion, data that has been backed up is also made available as a read-only copy. This can be done, for instance, using the V2i Protector product from PowerQuest Corporation, which provides a driver that lets users mount a sector-by-sector image file as a drive on a computer running a file system under a Microsoft Windows brand operating system. (V2I and V2I PROTECTOR are marks of PowerQuest Corporation). But in general, the data produced on one computer and then stored elsewhere as a backup is often simply stored and then left alone. The backup is rarely read, except to be restored to the computer on which it was originally produced. It is rarely written, except to be updated to match a more current active state of the computer that first produced it.

P-0005[0005] By contrast, the data that is produced on a computer and then stored on that same computer is often used there in a wide variety of ways. Data is produced on a computer, and also manipulated there, through many familiar applications such as word processors, spreadsheets, and web browsers, and by the underlying operating system, file system, and networking software.

P-0006[0006] In particular, many tools and techniques have been developed for use on a computer to manage the storage and other resources of that managed computer. Examples include tools for installing, patching, upgrading, and/or uninstalling software on the managed computer; tools for optimizing storage by defragmenting files, changing partition cluster size, or performing other operations; tools for manipulating partitions or volume segments by resizing, moving, copying, or merging them; tools for recovering data despite loss or corruption of file system information; and tools for converting one file system type to another, such as converting between a FAT file system and a Microsoft NT brand file system.

P-0007[0007] PowerQuest Corporation provides many such resource management tools, as discussed at www.powerquest.com. The following United States Patents assigned to PowerQuest Corporation contain additional discussion of these and other tools and techniques for managing computer resources: U.S. Pat. Nos. 5,675,769, 5,706,472, 5,930,831, 5,933,647, 6,08,8778, 6,108,697, 6,108,759, 6,11,7188, 6,173,291, 6,178,487, 6,178,503, 6,185,575, 6,185,666, 6,253,300, 6,330,653, 6,377,958, 6,453,383, 6,530,077. Some of these patents discuss both modifying data to manage storage on a computer and sending data over a network to the computer, e.g., U.S. Pat. No. 6,253,300 on “Computer partition manipulation during imaging” and U.S. Pat. No. 5,933,647 on “System and method for software distribution and desktop management in a computer network environment”. U.S. Pat. No. 6,330,653 discusses manipulation of virtual and live computer storage device partitions, including remote partition manipulation over a network. Other remote control software is also available, to control execution of software on one computer through a command interface on another computer. PowerQuest also owns U.S. patent application Ser. No. 09/532,223 filed Mar. 22, 2000, which is on “Storing a computer disk image within an imaged partition”.

P-0008[0008] Other examples of tools and techniques used on a computer to manage the storage and other resources of that managed computer include antivirus software; and software for monitoring storage usage, blocking storage of files that exceed maximum allocated space quotas or belong to an illegal file type, determining billing for storage usage, and enforcing standardized storage locations for particular types of data. Such software is sometimes referred to as “storage resource management” or “SRM” software. Agents placed on a client computer gather information about the client computer's storage usage, hardware configuration, operating system configuration, software versions, and application software usage, for example, and send that information over a network to an administrative server. Commands are then issued from the administrative server back to the client agents, in response to administrator commands and/or policies, to be executed by the agents on the client computers.

P-0009[0009] Software for asset management or inventory control is also known. Such software gathers information about computing assets or resources, such as server and workstation hardware, system configuration, and software, including which applications are installed. Such asset management software may be considered an example of SRM software. It may have capabilities such as the conditional deployment of software upgrades or patches based on comparison of the actual configuration of a target computer and a desired configuration for that target; application usage tracking; and remote control of operations performed on a computer to manage the computer's resources.

P-0010[0010] In short, and with the benefit of hindsight gained from knowledge of the present invention, although many tools are used to manipulate data while that data is stored on the same computer that produced it, and many tools are used to make copies of data and send them to another computer, relatively little has been done to make use at a network management computer of information provided there in a backup copy of another computer's stored data. As discussed below, the present invention provides ways for disassociated backup information to be organized and put to many uses, instead of merely keeping such backups as a precaution against disaster or as a read-only copy shared by several individuals.

BRIEF SUMMARY OF THE INVENTION

P-0011[0011] The present invention provides tools and techniques which can be used on one computer to browse—or in some cases modify—a copy of stored backup data from another computer, in order to help manage resources of that other computer. Because the backup data copy is disassociated from the computer that produced it, the backup data copy can be used for management purposes without preventing continued use of the original data copy on the original computer. Depending on the management desired, the disassociated data may simply be “mined” for information and/or it may be modified and then installed back on the original computer and/or on other computers.

P-0012[0012] The present invention is defined by the claims, and to the extent this summary conflicts with the claims, the claims prevail. In some embodiments, the invention provides a method of computer resource management which comprises steps of ample image receiving; meta-data obtaining; indexing; using a management environment; and ample image searching. Some embodiments also provide at least one ample image modifying step and/or a modified image deploying step.

P-0013[0013] During the image receiving step, a management node which includes at least one management computer receives at least one ample image of storage of an imaged computer. The ample image is thus disassociated from the imaged computer, in that the management computer is distinct from the imaged computer.

P-0014[0014] During the meta-data obtaining step, the management node obtains meta-data that is structurally associated with the ample image. The meta-data may have been received with the ample image or received in a separate transmission. The meta-data includes structured image content information which describes content of the ample image, and/or structured imaged computer environment information which describes hardware that was installed on the imaged computer when the ample image was created.

P-0015[0015] During the indexing step, the ample image is indexed into a collection of ample images. One or more meta-data values are used as index keys, such that the ample image can be located by using at least part of the meta-data as a key. Database, hashing, and/or other indexing techniques can be used.

P-0016[0016] During the step of bringing the ample image into a management environment at the management node, the ample image is mounted for access by management computer system software, replicated and expanded into a virtual environment that simulates at least the storage system portion of the imaged computer, or otherwise made accessible so that a user can at least read the files and their content, and in some embodiments, can also write them.

P-0017[0017] A resource management facilitating step uses the management environment and performs at least a step of searching of the ample image. It may also perform a step of modifying the ample image. In some cases the modified ample image may then be deployed to the imaged computer and/or to another computer which is distinct from the management node.

P-0018[0018] These are examples, not a comprehensive summary. The invention provides other methods, as well as products, systems, and configured storage media. Advantages and operation of the invention can be more fully appreciated by the description which follows.

BRIEF DESCRIPTION OF THE DRAWINGS

P-0019[0019] To illustrate the manner in which the advantages and features of the invention are obtained, a more particular description of the invention will be given with reference to the attached drawings. These drawings only illustrate selected aspects of the invention and thus do not fully determine the invention's scope.

P-0020[0020]FIG. 1 is a data flow diagram generally illustrating the present invention.

P-0021[0021]FIG. 2 is a data flow diagram further illustrating some embodiments of the present invention.

P-0022[0022]FIG. 3 is a flowchart generally illustrating methods of the present invention, with emphasis on the perspective of a management computer that manages other computers' storage-related resources.

P-0023[0023]FIG. 4 is a flowchart further illustrating ample image searching steps of the present invention.

P-0024[0024]FIG. 5 is a flowchart further illustrating ample image modifying steps of the present invention.

P-0025[0025]FIG. 6 is a flowchart further illustrating resource management steps of the present invention.

P-0026[0026]FIG. 7 is a flowchart illustrating a resource management method of the present invention from the perspective of a managed computer.

DETAILED DESCRIPTION OF EMBODIMENTS

P-0027[0027] In describing the invention, the meaning of several important terms is clarified, so the claims must be read with careful attention to these clarifications. Specific examples are given to illustrate aspects of the invention, but those of skill in the relevant art(s) will understand that other examples may also fall within the meaning of the terms used, and hence within the scope of one or more claims. Important terms may be defined, either explicitly or implicitly, above, here in the Detailed Description, and/or elsewhere in the application file.

P-0028[0028] Some Definitions and Examples

P-0029[0029] An “ample image” is a copy of data stored at a computer, such as a backup copy, but not every backup copy is an ample image. An ample image contains at least file names, file contents, and sector allocation information. It may contain a boot sector. It may contain attributes of individual files and/or attributes of an entire file system, such as access permissions.

P-0030[0030] Unlike a mere directory tree, each ample image contains file contents in addition to file names. An ample image may be an image of an entire disk of an imaged computer, an image of all disks of the imaged computer, an image of selected partition(s) of the imaged computer, or any other image that contains at least file names, file contents and sector allocation information.

P-0031[0031] Unlike a file-by-file image, each ample image contains sector allocation information which defines the layout of sectors on disk relative to other sectors. Thus, disk-based optimizations such as file defragmentation are preserved when an ample image is restored into a target disk. For example, an ample image may include a File Allocation Table, a cluster allocation bitmap, a partition table, and/or other sector allocation information. A complete sector-by-sector image of a disk is one example of an ample image. A sector-by-sector image of one or more partitions, but not the entire disk, is also an ample image. A one-to-one mapping between sectors in the ample image and sectors on the disk is allowed but is not required; for instance, ample images may also note the presence of empty sectors in other ways, such as by using bitmaps or data structures that identify empty sector runs (e.g., “13 empty sectors starting at sector 47”). PowerQuest Drive Image® products produce ample images (DRIVE IMAGE is a registered mark of PowerQuest Corporation.)

P-0032[0032] Because it contains sector allocation information in addition to mere file contents, an ample image, like a sector-by-sector disk image, may contain information not typically found in file-by-file images. Examples of such information include information stored in hidden partitions or hidden files, information stored on sectors outside any defined partition, and information stored inside file system structures but not in any user-defined file.

P-0033[0033] The ample image may be stored in a single file, or it may be stored in several files or blocks that are associated with one another in a recognized way through a file naming convention, by contiguity, by being identified as a group in a data structure, or by another recognizable association. File system limits on file size may require use of more than one file to hold a given ample image. Also, baseline ample images and their subsequent incremental ample images will typically be stored in different files.

P-0034[0034] The ample image may be created by conventional imaging tools such as PowerQuest's Drive Image® products (DRIVE IMAGE is a registered mark of PowerQuest Corporation), or by conventional data mirroring tools, so long as they capture more than mere file content, as discussed above. This is not to say that every ample image can be created using only conventional tools. Some ample images contain one or more metadata files that are created according to the invention and are placed in the imaged computer's storage before the ample image is created, so that the ample image contains the meta-data file as well as other imaged data. Ample-imaged computers may be clients in a network, servers, laptops, stand-alone workstations, or other computing devices.

P-0035[0035] An ample image may be “full” in that it contains a copy of every bit and byte of the imaged computer's storage and the storage allocation information specifying how that data resided on disk(s). An ample image may be “partial” in the sense that it does not contain every such bit and byte of data. For instance, one or more partitions might not be imaged and/or the image might be an incremental image that only specifies recent changes to storage.

P-0036[0036] A “container” is one or more files, blocks, or other grouped data structures which contains at least an ample image and which is in a form permitting its transmission (over a network, or via physically transported media) toward a management computer. A container may contain meta-data in addition to an ample image.

P-0037[0037] A “disassociated” image is one that is stored offline, from the imaged computer's perspective. That is, the image is stored somewhere other than the computer that was imaged to create the image in question. It is a copy of what was in storage at some past time, and it is not the storage currently being used by the imaged computer. Disassociated images are sent to management computers, where they can be searched, and in at least some embodiments, modified. Mere replacement is not modification; modification is done in place at the management node.

P-0038[0038] An “embodiment” of the invention may be a particular system, process product, method, and/or signal which configures a computer memory or other digital or analog computer-readable medium, as described herein to one of skill. “Method” and “process” are used interchangeably herein. Except as clearly indicated otherwise by operability constraints or the teachings herein, the description of one type of embodiment informs and illustrates the other types of embodiments. For example, systems of the invention may generally be understood to operate according to the methods described herein.

P-0039[0039] “Environment data” is data that modifies or describes a particular instance of a user's data or operating environment. For example, configuration files, INI type files, or registry files that describe the operating configuration or environment contain environment data. Environment data is a type of meta-data, which can be extracted from an ample image to provides a means of identification or classification of the data or characteristics of the data in the image file.

P-0040[0040] Environment meta-data may be captured on a client computer by running one or more programs on the client computer and saving the resulting output into one or more files in the file system before the ample image is created. Particular file name(s) are used to hold the meta-data. When the ample image is created, such meta-data files are imaged, and thus become part of the ample image. After the ample image is transported to a management node, the meta-data files are read from the ample image, and the meta-data is extracted from them. Environment metadata may also be extracted from conventional system files, such as a Microsoft Windows brand registry file. Meta-data describes the hardware and/or software environment on the client computer. It is used to index the ample image file(s) in a collection of ample images.

P-0041[0041] A “management computer” is defined relative to the ample image in question. The management computer is any computer operating according to the invention to search and/or modify the ample image, which is not the imaged computer whose resources are being managed offline. One or more management computers working together are referred to herein as a “management node”.

P-0042[0042] A “management environment” is an environment on a management computer which permits an administrator to at least browse (a.k.a. search or mine) an ample image of some other computer's storage. It need not require execution on the management computer of code that is stored in the ample image. But it must provide at least the ability to perform at least one file system-type operation to read files and directories, and in embodiments that permit modification of the ample image at the management computer, the management environment must also permit at least one file system-type operation to write file and/or directory data. File system-type file and directory reads permit operations such as reading a directory to list all files, to list file attributes (size, creations date, permissions, etc.), to search a directory tree with wildcards, and to read file contents. File system-type file and directory writes permit operations such as creating, renaming, and moving files or file contents. Similar definitions pertain to volume, partition, and other storage structure reads and writes.

P-0043[0043] One suitable management environment is provided by a conventional file system that is running on a management node computer, in combination with a driver that supports mounting the ample image for at least read-access there by an administrator. One suitable read-only driver is provided by the V2i Protector product from PowerQuest Corporation. (V2I and V2I PROTECTOR are marks of PowerQuest Corporation). Read-write drivers are to be implemented and provided in some embodiments according to the invention. To the management computer operating system/file system, the mounted ample image looks like a standard local folder/volume/partition/disk, so that applications running on the management computer can access the ample image's data using standard operating system/file system calls.

P-0044[0044] Another suitable management environment is a virtual environment which contains data structures and code simulating at least storage system aspects of an imaged computer. Implementation of such a virtual environment may be informed by reference to the Virtual PC product of Connectix Corporation (see www.connectix.com) and/or by the discussion of a virtual engine environment, its components, their uses, and related information, in PowerQuest's U.S. Pat. No. 6,330,653 at FIGS. 2-8 and columns 3-44. Virtual environments support storage operations (read/write) that can act on the content of an ample image without running file systems/operating system code that is stored in the ample image and that would have been used on the imaged computer to perform the operation(s) in question.

P-0045[0045] Some implementations may run, on the management computer, file systems/operating system code that is stored in the ample image, if that is necessary to perform a hardware device driver or software application installation. This may be used to change the installed hardware support identified in an operating system registry, for example. But in general, only the storage system aspects of the imaged computer are needed at the management computer, not the full execution environment of the imaged computer.

P-0046[0046] “Meta-data” is structured data that describes the content and/or context of an ample image. Examples of meta-data include “structured image content information” and “structured imaged computer environment information”. In each, the structure provides a computer-parseable structure, which distinguishes meta-data from free-form information or natural-language commentary like that found in readme files, press releases, email message bodies, and other texts intended primarily for human readers. For example, XML, data structure definitions, file formats, pointers and other addresses, indexes, and databases all provide computer-parseable structure.

P-0047[0047] Examples of structured image content information include: data specifying which applications were installed on the computer when the ample image was created, and may include version numbers; data specifying which operating system(s) were installed on the computer when the ample image was created, and may include version numbers, service release numbers, and patch history; file settings; other data which describes content of the ample image.

P-0048[0048] Examples of structured imaged computer environment information include: the time at which the ample image was created; the name of the user of the imaged computer; the name (e.g., machine address, processor ID, IP address) of the imaged computer; hardware that was installed on the imaged computer when the ample image was created.

P-0049[0049] Some meta-data, such as directory trees and Microsoft Windows brand registry entries, are implicitly stored in the ample image they describe. They are implicit in the ample image, in that they were created and placed in the ample image for purposes other than the methods of the present invention. The present invention provides new uses for such previously known data. Meta-data may also be explicitly stored in the ample image, by writing the meta-data to a file expressly for use by the present invention, and then creating an ample image which comprises that meta-data file. Meta-data for a given ample image may also be explicitly stored in a file that is stored outside the ample image but structurally associated with it. Network packets and other data structures that can be sent to a management computer are equivalent to files for the purpose of determining whether meta-data is present, although some specific file or other data structures will provide better speed/reliability/etc. than others in a particular implementation.

P-0050[0050] Meta-data is “structurally associated” with an ample image by: using the metadata as an index to locate the ample image in a collection of images; applying a file-naming convention so that the ample image file name corresponds to the name of at least one file containing meta-data for that ample image; placing meta-data in the same file(s) as the ample image to which that meta-data pertains; or otherwise providing a computer-parseable structural linkage between the ample image and meta-data for that ample image.

P-0051[0051] For instance, the invention provides an embedded meta-data file data management technique in which a file included in the ample image describes the contents of the ample image in computer-readable form. The file contains meta-data useful in describing the ample image inside which it is stored and the computer in which the ample image was taken. One can provide the ability to enable/disable the including of the file in the ample image. Examples of such meta-data include a file list, disk statistics, image creation date, computer name, other hardware configuration data, other software configuration data. This helps make ample images portable from computer to computer, helps provide quick identification of image contents without searching the entire image, and helps provide quick identification of the environment in which the image was taken. Like other features discussed herein, not every feature necessarily appears in every embodiment of the invention.

P-0052[0052] “Mining” refers to searching an ample image to extract data that facilitates computer resource management.

P-0053[0053] An Introduction

P-0054[0054] The invention provides tools and techniques for computer storage life-cycle management. As illustrated in FIG. 1, one or more computers <b>102</b> are imaged, and then the image(s) <b>104</b> are used to help manage resources such as storage capacity, applications software, data files, and hardware drivers. The managed computers <b>102</b> may be stand-alone machines, or they may be connected to a network <b>106</b>. If a network <b>106</b> is present, it may use known protocols or other tools such as HTTP, TCP/IP, XML. The network <b>106</b> can be owned and managed by a single entity, such as a corporation or a government agency, or by multiple entities. The network <b>106</b> or some other data transmission tool <b>108</b>, such as shipped or carried DVDs or tapes, is used to transmit images <b>104</b> from the managed computer(s) <b>102</b> to one or more management computers <b>110</b>.

P-0055[0055] The managed computers <b>102</b> may be network clients <b>112</b>, network servers <b>114</b>, or other computers. Each computer <b>102</b> has a hardware configuration <b>116</b>, e.g., motherboard, processor, volatile storage, display, input devices, non-volatile storage, connection and connectivity devices. Each computer <b>102</b> also has a software configuration <b>118</b>, e.g., one or more installed operating systems, corresponding license and computer naming information for the installed operating systems, application software, corresponding version and license information for that software, and user data. Each computer <b>102</b> operates in the context of a current environment <b>120</b>, e.g., domain, workgroup, login validation information, access rights, settings, preferences, installed devices, and installed optional software.

P-0056[0056] Each computer <b>102</b> also has one or more local disks and/or other storage <b>122</b>, on which the software and the user data <b>118</b> are stored. Each disk is organized into one or more partitions <b>124</b>. Partitions are either formatted or unformatted. Unformatted partitions hold no data. Each formatted partition holds at least file system data, and also holds zero or more files. Each file typically contains data. Examples of files include operating system files such as registry files, configuration files, operating system code; application files such as initialization files, application code, sample or tutorial data; user files such as data files produced by users while using applications.

P-0057[0057] Because hardware, software, and context are often functionally linked in a computer, those of skill will appreciate that statements herein regarding any one of the components <b>116</b>, <b>118</b>, <b>120</b>, <b>122</b> of a computer <b>102</b> may apply equally, for purposes of the present invention, to some or all of the other components. For instance, software <b>118</b> may be installed or removed, and so may hardware <b>116</b>. Indeed, characterization of a given component as belonging to one of the categories <b>116</b>, <b>118</b>, <b>120</b>, <b>122</b> may be more a matter of convenience or perspective than one of widespread consensus. For example, one may view a given component either as BIOS code <b>118</b> stored in a computer chip, or as a computer chip <b>116</b> that contains some BIOS code.

P-0058[0058] Regardless, the invention provides “offline” storage management, from the managed computer <b>102</b>'s point of view. That is, the invention provides storage management capabilities which use a copy of data from a computer's storage <b>122</b>, in a place that is remote from the computer <b>102</b>, to help manage the resources of the computer <b>102</b>. In some cases the same computer <b>102</b> may also be managed online in a conventional manner, e.g., by using conventional SRM software which is running and controlled locally at the computer <b>102</b>, or by using conventional SRM software that is controlled remotely, but which runs on the computer <b>102</b> and accesses the local storage <b>122</b> as its primary data source. The invention is generally compatible with, but does not require, conventional online resource management.

P-0059[0059] One inventive approach includes taking a snapshot image <b>104</b> of a client <b>112</b>, placing that snapshot image into a container <b>126</b> with meta-data <b>128</b>, sending <b>108</b> the container <b>126</b> to another computer <b>110</b> such as an administrative server, modifying <b>130</b> the image there, sending <b>108</b> the modified image <b>104</b> back to the client <b>112</b>, and installing the modified image on the client <b>112</b>. Variations and alternatives are also discussed herein, including some in which the image <b>104</b> is not modified, and some in which an image <b>104</b> (modified or not, but at least indexed and searched) is installed on some computer other than the imaged computer <b>102</b> it originally came from.

P-0060[0060] Data collection and visualization management software and supporting hardware <b>134</b> allows administrators to perform tasks such as scheduling imaging, scheduling collection of meta-data, and managing the indexing <b>132</b> of images <b>104</b> into a collection organized for retrieval by specifying meta-data values. Meta-data may be structured image content information <b>142</b> such as directory trees or a list of installed applications, and/or structured imaged computer environment data <b>144</b> such as a list of installed hardware <b>116</b> or an IP address.

P-0061[0061] Life-cycle management software and supporting hardware <b>136</b> allows administrators to perform tasks such as bringing a specified image <b>104</b> into a management environment <b>138</b>, searching the image <b>104</b>, modifying the image <b>104</b>, and (re)deploying the (modified) image <b>104</b> to one or more computers which may include the computer <b>102</b> on which the image <b>104</b> originated.

P-0062[0062] A Detailed Example

P-0063[0063]FIG. 2 further illustrates a particular embodiment, which is more focused and hence narrower than the inventive data flow and architecture shown in FIG. 1. For instance, FIG. 2 calls for a virtual environment, which is a particular kind of management environment <b>138</b>; FIG. 2 assumes environment meta-data <b>128</b> is collected by an agent on a client computer <b>102</b>; and FIG. 2 provides for image <b>104</b> compression and an image store which are not required in FIG. 1. Accordingly, limitations of FIG. 2 are not necessarily found in every embodiment of the invention, but are presented instead to further illustrate some possible embodiments.

P-0064[0064] At the most general illustrated level of FIG. 2, client-side components are both distinguishable from and connectable to three other groups of components by a computer network <b>106</b>, which is one instance of a transmission means <b>108</b>; other transmission means include, e.g., placing images <b>104</b> on DVD or tape and shipping the DVD or tape. The other three component groups illustrated in FIG. 2 are: data collection and visualization management components <b>134</b>, shown to the left of a grouping line <b>202</b>; meta-data indexing and management components <b>132</b>, shown between grouping lines <b>202</b> and <b>204</b>; and storage life-cycle management components <b>136</b>, shown to the right of grouping line <b>204</b>. The grouping lines <b>202</b>, <b>204</b> are for clarity of illustration and discussion only, and they do not necessarily require any corresponding dividing or grouping structure in a given embodiment of the invention.

P-0065[0065] In the dataflow architecture shown in FIG. 2, an administrator schedules <b>206</b> resource management for a particular user. In particular, this sends a triggering instruction <b>208</b> over the network <b>106</b> to a client computer <b>102</b> agent, which is part of the software <b>118</b> running on that client <b>102</b>, <b>112</b>. The agent collects <b>210</b> environment data <b>128</b>, <b>144</b> reflecting the environment <b>120</b> and/or hardware <b>116</b> context, and takes <b>212</b> an ample image <b>104</b> or directs imaging software on the client <b>112</b> to take <b>212</b> an ample image <b>104</b>. The agent may also collect other meta-data such as the user name, and the image <b>104</b> will typically contain content meta-data <b>142</b>, <b>128</b> such as directory information and software <b>118</b> installation information in a registry. The agent bundles the image <b>104</b> and the meta-data <b>128</b> into a single container <b>126</b> for easier transport administration, and sends <b>214</b> the container <b>126</b> over the network <b>106</b> to a management node <b>110</b>.

P-0066[0066] The management node <b>110</b> receives <b>216</b> the container <b>126</b>, and separates/extracts the image <b>104</b> and the meta-data <b>128</b>. The content meta-data <b>142</b> is indexed <b>218</b>, and the environment meta-data <b>144</b> is indexed <b>220</b>. Indexing may be done using conventional database indexing techniques and tools, familiar hash algorithms, and/or other approaches. The image <b>104</b> is stored <b>614</b> in a collection of images, which in this example is a database <b>222</b> of images; an indexed collection of files or storage blocks could also be used without a relational database so long as meta-data is indexed to permit image location <b>612</b>. The environment meta-data <b>144</b> is stored in an inventory database <b>250</b>. A joint database combining components <b>222</b>, <b>250</b> could also be used.

P-0067[0067] The image database <b>222</b> is a storage location where the image <b>104</b> files are kept. One can specify characteristics of each image. For instance, it can be associated with a client computer so that the correct image can be later retrieved for restoration of the client computer. Images <b>104</b> may also be retrieved for further data extraction and/or image modification prior to restoration.

P-0068[0068] For example, one can locate <b>612</b> (and subsequently retrieve) a given image <b>104</b> in the image database <b>222</b> by specifying corresponding meta-data <b>128</b> values. One could locate all ample images <b>104</b> stored <b>614</b> in the database that were created within a specified time window, or all images for a given user (who might have used more than one machine <b>102</b>), or all images for a given machine <b>102</b>, or all images for machines that have a specified network card installed, or all images for machines <b>102</b> that lack a particular application program, or some Boolean/database query language combination of such meta-data key values.

P-0069[0069] One could also use the gathered meta-data <b>128</b> to build <b>252</b> an inventory summary of the hardware <b>116</b>, software <b>118</b>, storage devices and capacities <b>122</b>, and/or other characteristics of the computers <b>102</b>. The inventory database <b>250</b> would not always be current, since it is based on information collected from computers <b>102</b> when they are imaged, rather than being continuously updated as conventional SRM software may do. User environment information <b>220</b> may be displayed <b>254</b> to an administrator.

P-0070[0070] In some embodiments, the inventory database <b>250</b> is an indexed collection of data about the installed hardware <b>116</b> and software <b>118</b> on each client computer <b>112</b>. This inventory database <b>250</b> is searchable to allow both reports and policies to be executed against selected conditions. For example, decisions to upgrade to a new operating system can be based upon the ability of existing client computers <b>112</b> to handle the minimum hardware requirements, and reports can be generated <b>256</b> identifying the upgrade or replacement hardware that is necessary to bring the lacking client computers <b>112</b> into compliance. This is also true for making decisions about upgrading software applications <b>118</b>. The hardware inventory information is collected by agents or other programs running on the client computers <b>112</b>. The results can be sent to the inventory database apart from the image <b>104</b>, or they can be placed into a known file before imaging so that file will be in the image <b>104</b> that is sent up to the management node <b>110</b>, where it is extracted from the image <b>104</b> and placed into the database <b>250</b>.

P-0071[0071] In the illustrated architecture of FIG. 2, extremely large amounts of image data may be managed. Accordingly, to reduce storage requirements, image clusters (blocks, sectors, etc.) may be compressed, to remove space-consuming redundancy within a given cluster and/or to identify identical clusters within more than one image <b>104</b>. Compressed images are stored in an image store <b>228</b>. Thus, the image store <b>228</b> is an optimized storage of multiple image <b>104</b> files where redundant pieces have been identified and replaced with references to fewer (ideally just one) stored copy of the imaged data. It is managed though an API <b>230</b> or other interface. An incremental image <b>104</b> may be merged with a prior complete snapshot image <b>104</b> to form a complete and more recent snapshot image which is placed in the image database <b>222</b> and/or the image store <b>228</b>. A given image <b>104</b> in the image store <b>228</b> may also be the result of both image compression and merging in of incremental images.

P-0072[0072] The image compression <b>224</b> and the image store <b>228</b> provide an efficiency enhancement to the illustrated architecture, but aspects of them have been the subject of discussion outside PowerQuest more than a year prior to the priority date of the present application. For purposes of the present application, PowerQuest therefore does not intend to claim components <b>224</b>, <b>226</b>, <b>228</b>, and/or <b>230</b> in and of themselves. PowerQuest will not object hereafter if components <b>224</b>, <b>226</b>, <b>228</b>, and/or <b>230</b> are treated as prior art for examination purposes, regardless of whether a court of competent jurisdiction ultimately determines them to be prior art.

P-0073[0073] In some embodiments, the meta-data <b>128</b> identifies the user of the client computer; the imaging <b>212</b>, meta-data <b>128</b> gathering, transmission <b>108</b>, and indexing <b>218</b>, <b>220</b> steps discussed above are repeated for multiple computers <b>102</b>; user identifications are copied from the meta-data <b>128</b>; and the image database <b>222</b> is built using the user identifications of multiple client computer containers <b>126</b> and images from those containers <b>126</b>. The user identifications become <b>132</b> keys in the index <b>218</b>/<b>220</b> into the image database <b>222</b>, so that one can locate <b>612</b> a particular image <b>104</b> by specifying the user identity. The time at which a container <b>126</b> was created, modified, or otherwise processed and time-stamped, can also be used as a meta-data key. Thus, one could locate all images <b>104</b> for a given user across time and/or across several machines <b>102</b>, all images created within a given time window on one or more specified machines <b>102</b>, or all images for a given user created in a given time window. A given embodiment may index <b>306</b> by one or more of the following meta-data 128 values: user name, computer name, image creation time, IP address, hardware installed, operating system type and version installed, application name and version installed, registry file content. Creation and use of indexes (e.g., database keys) is, in and of itself, well-understood technology, but embodiments that index <b>306</b> according to the present invention are believed to be new.

P-0074[0074] Turning now to the storage life-cycle management components <b>136</b>, shown in FIG. 2 to the right of grouping line <b>204</b>, inputs such as user commands and policy specifications are received <b>232</b> through an interface. Resource management policy specifications in the inventive system are read from a computer-readable medium (volatile or not) in a computer-parseable form. Some inputs cause an embodiment to build 256 views showing the imaged computer's state at a specified time, and/or to build reports showing trends in storage usage, for example. Both local controls operating on the images <b>104</b> in the management node <b>110</b>, and remote controls operating through the network <b>106</b> on imaged computers <b>102</b>, may be invoked in a command interpreter <b>234</b> to gather information for reports and views, or perform searching <b>310</b> and/or modifying <b>312</b> steps on disassociated ample images <b>104</b>.

P-0075[0075] An administrator may schedule <b>236</b> storage life-cycle management tasks, such as upgrading images <b>104</b> with new drivers or other software <b>118</b> and deploying them, or tasks otherwise modifying images <b>104</b> and deploying them.

P-0076[0076] Ample images <b>104</b> are used in the illustrated system to build <b>238</b> a virtual environment, which can then be used as a management environment <b>138</b> to search <b>140</b> and/or modify <b>130</b>, <b>240</b> the image <b>104</b> as it is embodied in that virtual environment on the management computer <b>110</b>. Modified images <b>104</b> can be deployed <b>242</b> as new storage environments for one or more computers <b>102</b>. Images <b>104</b> may also be deployed without modification, for familiar purposes of backup retrieval or disaster recovery. If one image <b>104</b> is to be deployed to multiple computers <b>102</b>, it can be placed in a container <b>126</b> suitable for multicasting <b>244</b> over the network <b>106</b>. The image <b>104</b> being deployed is received <b>246</b> at the target computer(s) <b>102</b>, and imaged <b>248</b> into (partial ample image such as one that omits a partition <b>124</b>) or onto (full ample image) each target computer's storage <b>122</b>.

P-0077[0077] In some embodiments an image is recreated from the image store <b>228</b> or copied from the image database <b>222</b> and combined with the client's hardware and software configuration information from the inventory database <b>250</b>, and is then used to build <b>238</b> a new virtual environment. Then the virtual environment is modified <b>240</b> as desired. A full image <b>104</b> in a virtual environment contains the necessary operating system software, application software and the required configuration files as well as the operating system and application data for use on a client computer <b>102</b>, but with the invention the ample image <b>104</b> is configured without the need for the actual computer <b>102</b> to be used during the configuration process.

P-0078[0078] More About Modifying Ample Images

P-0079[0079] The ample image <b>104</b> may be modified and then redeployed back to the imaged computer. For instance, storage <b>122</b> may be reorganized and/or optimized. Files may be defragmented. New hardware drivers may be installed (driver software added if not already present, changes made to registry, etc.), to match hardware changes in the imaged computer that are/will be made after the ample image was created. Files may be rearranged in the ample image to make disk operations more efficient in other ways, e.g., by placing together on disk files that are frequently accessed together in time. Partition cluster size may be changed so that less storage space lies in the unused portion of clusters. Directory storage space may be reclaimed. Storage may be divided between partitions <b>124</b>, e.g., by placing user data in one partition and system data and software in another partition.

P-0080[0080] (Re)deployment of a modified ample image <b>104</b> may be one-to-one with the imaged computer, but it need not always be one-to-one. In a redeployment that is one-to-one with the imaged computer <b>102</b>, an ample image of imaged computer A is taken, sent to management computer B, modified there, and then redeployed back to computer A only. The redeployed image replaces/overwrites the original data. In a first variation, an ample image of imaged computer A is taken, sent to management computer B, modified there, and then redeployed back to computer A and also deployed to one or more other computers C, D, E, and so on. In a second variation, an ample image of imaged computer A is taken, sent to management computer B, modified there, is not redeployed back to computer A, but is deployed to one or more other computers C, D, E, and so on.

P-0081[0081] In a third variation, an ample image of imaged computer A is taken, sent to management computer B, modified there, and then split between two or more computers on (re)deployment. For instance, suppose a single first server <b>114</b> is providing both web services and accounting services. Then a second server is purchased. To configure the second server, and reconfigure the first server, an ample image <b>104</b> of the first server is made and sent to a management computer <b>110</b>. On the management computer, while the first server continues to run, the ample image is modified by splitting it into two ample images, one of which is suitable for a web server without accounting capabilities, and the other of which is suitable for an accounting server without web server capabilities. Then the two ample images are deployed. One overwrites the original server <b>114</b>, and the other configures the new second server. As a result, the invention permits the functionality originally borne by a single server to be split between two (or more) servers, with relatively brief downtime, and thus puts less intense time-pressure on administrators during the reconfiguration process.

P-0082[0082] Some of the suitable modifications that may be made <b>240</b> to a virtual environment, or otherwise made to an ample image <b>104</b> according to the invention, include handling <b>530</b> viruses by detecting viruses and then quarantining/repairing/deleting infected files; taking <b>252</b> an inventory of the installed hardware and software present when the computer <b>102</b> was imaged; updating <b>504</b> applications with new releases and/or patches; checking <b>618</b> the integrity of a file system; defragmenting <b>522</b> one or more files; removing <b>532</b> one or more illegal files as defined <b>606</b> by corporate information systems policies (e.g., MP3 music files, picture files, or other copyrighted files that lack clear authorization); checking <b>608</b> for security breaches by scanning for controlled or sensitive document or other information files; checking <b>608</b>, <b>534</b> for remote mail folders that might constitute security policy violations; separating <b>620</b> data and systems volumes by identifying data folders and files, creating <b>520</b> a data volume, moving <b>622</b> the folders and files to the data volume and adjusting <b>516</b> the operating system and application configuration data to reflect the new logical location of the data (other separations could also be performed <b>622</b>, e.g., migrating application software to one partition <b>124</b> and system software to another partition); sorting <b>624</b> files by type, function, or department, and combining <b>626</b> like files to provide a single master file on a server with clients having links defined to access the master copy; mapping <b>628</b> information location by enforcing standardized storage locations for the storage of particular types of data on all client computers; mapping shortcuts <b>630</b> by defining links and short cuts in the environment settings of all client computers to access certain data.

P-0083[0083] The modified virtual environment is then placed in a container file and sent over the network <b>106</b> back to the client computer <b>102</b>. If multiple clients <b>102</b> should have the same modified storage environment, then the modified environment can be multicast <b>244</b> to those clients. An agent on each client then installs the modified image <b>248</b> onto the client, thereby making it the new storage environment of the client. The installation is accomplished by writing the container file content back to the appropriate locations on the hard disk(s) of the client computer and rebooting the client computer <b>102</b>.

P-0084[0084] Thus, some embodiments of the invention include tools and techniques to read and temporarily store the image <b>104</b> of a specific user(s)/groups of users/computer(s) environment. The image <b>104</b> is indexed by user(s)/computer index and time of capture. At the management node <b>110</b>, one can create a virtual environment or other management environment <b>138</b> that matches the current or historical state of the user(s)/groups of users/computer(s) environment, for the purpose of refreshing, or modifying the user(s)/groups of users/computer(s) online environment. Particular user(s) may need to have a display driver updated <b>510</b>, for instance, because they all have the same display hardware. Likewise, a group of computers <b>102</b> may have been imaged just before a virus infected the enterprise, and so their active state can be rolled back using the saved images.

P-0085[0085] Embodiments may provide a language that allows the automation of methods discussed herein, so an administrator can customize the process by creating batch command files. Such a language could allow the administrator to specify some or all aspects of assembling a specific operating environment or active state, including files and configuration information. Administrative server <b>110</b> applications <b>140</b> could search the saved images <b>104</b> and associated meta-data <b>128</b> for the purpose of reporting on, managing and subsequently modifying the operating environment based on the current and historical states of user(s)/computer environments.

P-0086[0086] More About Methods

P-0087[0087] Various embodiments of the present invention may be more fully understood by considering flowcharts illustrating methods of the invention. As noted elsewhere, system embodiments operate according to the methods discussed herein, as governed by the claims. The context, purposes, and results of method steps are likewise illustrated by the system and dataflow embodiments shown in FIGS. 1 and 2, and the discussion of those figures.

P-0088[0088]FIG. 3 illustrates a method <b>300</b> of computer resource management according to the present invention. During a receiving step <b>302</b>, the management node <b>110</b> (which includes at least one management computer) receives at least one ample image <b>104</b> (partial or full) of storage <b>122</b> of an imaged computer <b>102</b>. The ample image <b>104</b> may be received as a single container <b>126</b> or as a single image file <b>104</b>. Or it may be received in parts, as a sequence of image files which together comprise the ample image <b>104</b>. Regardless, the ample image <b>104</b> is disassociated from the imaged computer <b>102</b> in that the ample image <b>104</b> is at the management computer <b>110</b> and the management computer <b>110</b> is distinct from the imaged computer <b>102</b>.

P-0089[0089] During an obtaining step <b>304</b>, the management node <b>110</b> obtains meta-data <b>128</b> that is structurally associated with the ample image <b>104</b>. The meta-data <b>128</b> includes at least one of: structured image content information <b>142</b> which describes content of the ample image <b>104</b>, and structured imaged computer environment information <b>144</b> which describes hardware <b>116</b> (or equivalently, hardware drivers/registry entries) that was installed on the imaged computer <b>102</b> when the ample image <b>104</b> was created <b>212</b>. Meta-data may be embedded in the image <b>104</b>, either in standard operating system and file system structures or in a file dedicated to meta-data. Meta-data <b>128</b> may also be outside the image <b>104</b> but inside the container <b>126</b>. Finally, metadata <b>128</b> may be transmitted separately from the image <b>104</b> and/or the image container <b>126</b>.

P-0090[0090] During an indexing step <b>306</b>, the ample image <b>104</b> is indexed into a collection of ample images, e.g., image database <b>222</b>, such that the ample image can be located by using at least part of the meta-data <b>128</b> as a key. The meta-data <b>128</b> may be indexed <b>306</b>, <b>218</b> into one or more databases or other data structures, to permit use of the meta-data as a key in locating the image, and optionally to permit use of the meta-data for other purposes, such as building an inventory database <b>250</b>. In some embodiments, for example, the indexing step <b>306</b> indexes the ample image <b>104</b> into a collection of ample images such that the ample image can be located <b>612</b> by using at least part of the meta-data <b>128</b> as a key, where the image <b>104</b> is indexed by at least one of: a user name, a computer name, an image creation time, an IP address, a value identifying installed hardware, a value identifying installed operating system type, a value identifying an installed application, a value given in a registry file of the imaged computer.

P-0091[0091] During a bringing step <b>308</b>, the ample image <b>104</b> is brought into a management environment <b>138</b> at the management node <b>110</b>. This may require building <b>238</b> a virtual environment, or it may require use of a driver that lets an image <b>104</b> be mounted as a volume at the management node <b>110</b> so the mounted image is accessible to system and applications software running on the management computer <b>110</b>.

P-0092[0092] Steps <b>310</b> and <b>312</b> are instances of a resource management facilitating step <b>314</b>. Commands to perform steps <b>314</b> may be input interactively and/or in a script of batch-mode user commands, so the facilitating step is performed in response to interactive-mode user commands and/or in response to a script of batch-mode user commands. Commands may be triggered by a specified event or condition, or a combination of events and/or conditions. Commands may be subject to policies specified <b>606</b> by an administrator. Policies can trigger management actions such as running a script, creating a report, and/or sending <b>616</b> an alert to an administrator.

P-0093[0093] Either or both steps <b>310</b>, <b>314</b> are performed at least once using the ample image <b>104</b> in the management environment <b>138</b>. During image searching step <b>310</b>, the directory tree, file contents, partition table, and/or other content of the ample image <b>104</b> is searched. Searching <b>310</b> involves looking inside the ample image <b>104</b>, not merely looking at file system characteristics of the file(s) that contain the ample image <b>104</b>. During image modifying step <b>312</b>, the directory tree, file contents, partition table, sector allocation information, and/or other content of the ample image <b>104</b> is modified. Modifying <b>312</b> likewise involves changing information inside the ample image <b>104</b>, not merely changing file system characteristics of the file(s) that contain the ample image <b>104</b>.

P-0094[0094] During an optional deploying step <b>316</b>, the ample image (possibly modified) is deployed over a network <b>106</b> or other transmission means <b>108</b> to the imaged computer <b>102</b> and/or to another computer which is distinct from the management node <b>110</b>. Familiar image deployment tools and techniques may be used.

P-0095[0095]FIG. 4 further illustrates steps which may serve as image searching steps <b>310</b> in the management environment <b>138</b> of a given embodiment and/or in a given situation. These are illustrative only. The list shown is not necessarily comprehensive, and some of the steps may overlap, e.g., reading a file involves reading sectors. Not every listed step need be present in every embodiment. As with all flowcharts provided herein, steps may be grouped differently, reordered (except to the extent that one step requires results of another step), repeated, omitted, performed concurrently, and/or renamed in a given embodiment, to the extent that doing so still provides an operable embodiment consistent with the claims.

P-0096[0096] A file reading step <b>402</b> reads a file from a disassociated ample image <b>104</b>, that is, from an image <b>104</b> in a management environment <b>138</b> at a management computer <b>110</b> that is distinct from the computer <b>102</b> whose image <b>104</b> is being read. A directory reading step <b>404</b> likewise reads file system directory information from a disassociated ample image <b>104</b>; this may be done, for instance, to determine whether a particular file is present, to determine whether at least one file of a particular type is present, or to check for compliance with policies stating what types of files are stored in a given directory. A partition table reading step <b>406</b> reads partition table information from a disassociated ample image <b>104</b>. A sector reading step <b>408</b> reads a disk sector from a disassociated ample image <b>104</b>; it may also read a cluster or block containing multiple sectors. The sector read may be in a file, or it may lie outside any file. A disk usage information extracting step <b>410</b> performs similarly to conventional SRM disk usage information extraction but reads from a disassociated ample image <b>104</b> instead of reading from a local machine it runs on. Likewise, a billing determination step <b>412</b> performs similarly to conventional SRM billing determination but reads a disassociated ample image <b>104</b> to determine billing for the imaged computer <b>102</b> instead of the (management) computer <b>110</b> it is running on. A searching step <b>414</b> reads a disassociated ample image <b>104</b> to check for illegal files (such as MP3 files, or limited distribution files on an unauthorized machine <b>102</b>) and/or to check files for virus infection.

P-0097[0097] Mining <b>310</b> an ample image <b>104</b> according to the present invention is different in several respects from mining storage <b>122</b> locally while that storage is in use. First, the ample image is not current, so the information it provides is aged. Second, by mining several ample images taken at different times, the present invention provides information about trends that is not limited to predetermined variables—any data in the ample images <b>104</b> can be examined at any imaged point in time. Third, by mining several ample images taken from different machines <b>102</b> at substantially the same time, and doing this for sets of images at different times, the invention can help administrators identify the entry point/origin of suspect files (illegal files, viruses) and the propagation path(s) of suspect files. Travel across time and across the network with a focus on variables dynamically identified during the search is easier. Fourth, the present invention can provide detailed information about machines <b>102</b> that are not running, including machines that are now difficult or expensive to run because of changed circumstances. This may save administrative overhead and/or facilitate forensic investigations. Fifth, although agents can be used to gather environment meta-data, not every embodiment of the invention requires an agent running on the imaged computer <b>102</b>. Environment meta-data may be gathered from a registry, or it may be omitted entirely.

P-0098[0098] Disassociated images <b>104</b> may be mined <b>310</b> according to the invention using software that does—on the mined image <b>104</b>—the same kind of operations that conventional SRM software does on the original storage <b>122</b> (either locally or via remote control). Like conventional SRM tools, some of the systems and software according to the present invention can be controlled partially or entirely by policies which are set <b>606</b> by an administrator. Such policies may set disk quotas, identify illegal file types, specify particular storage locations for particular types of data, require antivirus software to be current to within a specified time period, and/or require or prohibit certain hardware or software configurations, for instance. However, unlike conventional SRM operations, the methods of the present invention are not done in real-time on the actual system <b>102</b> whose resources are being managed, but can be done instead at the administrator's convenience using an ample image taken from the managed computer <b>102</b> to a management computer <b>110</b>.

P-0099[0099]FIG. 5 further illustrates steps which may serve as image modifying steps <b>312</b> in the management environment <b>138</b> of a given embodiment and/or in a given situation. It will be understood that these modifications take effect on managed computers <b>102</b> only if the modified image <b>104</b> is deployed <b>316</b> to the managed computer(s) <b>102</b>. As with FIG. 4, the steps in FIG. 5 are illustrative only, not necessarily comprehensive or required, and may overlap. As illustrated, resource management methods of the invention may modify <b>312</b> the ample image <b>104</b> by performing at least one of the following steps on the disassociated ample image <b>104</b>: installing <b>502</b> an application; updating <b>504</b> an application by patching code, adding new data files such as virus definitions, or otherwise; removing <b>506</b> an application (which may include regular uninstalls that update the registry, as well as bare file system deletes that may not); installing <b>508</b> a hardware driver; updating <b>510</b> a hardware driver; removing <b>512</b> a hardware driver; installing <b>514</b> system software other than a hardware driver, such as an operating system or communications software; updating <b>516</b> system software other than a hardware driver; removing <b>518</b> system software other than a hardware driver.

P-0100[0100] Each of these steps <b>502</b> through <b>518</b> facilitates management <b>314</b> of software <b>118</b> as a resource. Note that removing a piece of software is done by uninstalling, overwriting, disabling, and/or deleting that software. Removing is directed specifically at that software rather than the entire image <b>104</b>, since one does not normally delete an entire image from the management environment <b>138</b> merely to delete a particular program. Software installation, updating, and removal, in and of themselves, are well-known in other contexts, but their use on ample images <b>104</b> according to the present invention is believed to be new.

P-0101[0101] In addition to, or in place of, the foregoing image modifying steps, the invention supports modifying <b>312</b> an ample image <b>104</b> to manage storage capacity and/or to help manage <b>314</b> the organization of items within storage <b>122</b>. For example, a partition manipulating step <b>520</b> is performed by performing at least one of the following steps on the ample image <b>104</b> in the management environment <b>138</b>: creating a partition <b>124</b>, resizing a partition, resizing clusters of a partition, moving a partition, moving data between partitions, canonizing a partition, deleting a partition, merging two partitions, manipulating volume segments. Partition manipulations, in and of themselves, are well-known in other contexts, but their use on ample images according to the present invention is believed to be new. Storage capacity may also be managed <b>314</b> by defragmenting <b>522</b> files in the ample image <b>104</b>, by reclaiming <b>524</b> directory space in a partition <b>124</b> of the ample image <b>104</b>, by recovering <b>526</b> data despite corrupted or lost file system information in the ample image <b>104</b>, and/or by converting <b>528</b> one file system type to another file system type (e.g., converting between FAT and Microsoft NT brand file systems) in the ample image <b>104</b>.

P-0102[0102] In some embodiments and/or situations, the invention provides a method that comprises both searching <b>310</b> the ample image <b>104</b> and modifying <b>312</b> the ample image <b>104</b>, by performing at least one of the following pairs of steps on the ample image in the management environment: handling <b>530</b> a virus by detecting a virus and then quarantining or repairing an infected file; handling <b>530</b> a virus by detecting a virus and then removing an infected file; handling <b>532</b> an illegal file by identifying <b>404</b> an illegal file and then removing that illegal file; enforcing <b>534</b> policy by identifying a breach of a policy that defines standardized storage locations for particular types of data and then moving or removing data to enforce that policy.

P-0103[0103] A modified ample image <b>312</b> may be viewed in claim terms as the product of a process. For instance, FIG. 3 is stated from the perspective of the management computer, but as illustrated in FIG. 7 the invention likewise provides a process that can be stated from the perspective of an imaged computer <b>102</b>: send <b>702</b> an ample image <b>104</b> to a management node <b>110</b>; send <b>704</b> meta-data to the management node <b>110</b>; after both sending steps receive and install <b>706</b> a modified ample image on the computer <b>102</b>. The modified ample image may differ from the image sent <b>702</b> to the management node <b>110</b> in one or more of the following ways: a change (installation, updating, patching, disabling, or removal) in application software; a change in driver software; a change in other software; a change in the partition table (e.g., new partition, partitions merged, partitions resized); a change in cluster size; a change in the folder in which given data is stored; a change in the partition in which data is stored; a change in status (e.g., quarantined or not, repaired or not, removed or not) of a file infected by a virus; a change in status (removed or not) in an illegal file.

P-0104[0104]FIG. 6 further illustrates steps which may serve as resource management facilitating steps <b>314</b> in the management environment <b>138</b> of a given embodiment and/or in a given situation. The steps are illustrative only, not necessarily comprehensive or required, and may overlap. Groups of images <b>104</b> can be tracked, or used in tracking files. In one tracking step <b>602</b>, multiple ample images <b>104</b> are searched to track propagation of a file, an infection, or another storage characteristic over time; the ample images used for this step <b>602</b> are imaged from a particular computer <b>102</b> at different points in time. For example, one could track <b>602</b> propagation of a virus through the files on a computer <b>102</b> to identify a virus' point of entry, to gain a better understanding of how the virus operates, and/or to determine which files may have been infected.

P-0105[0105] In another tracking step <b>604</b>, multiple ample images <b>104</b> are searched to track propagation of a file, an infection, or another storage characteristic over nodes in a network, that is, over different computing devices attached to the network. In this case, the ample images used are imaged from multiple computers <b>102</b>, and may also be imaged at different points in time. One could track <b>604</b> a virus across the network <b>106</b>. One could also track <b>604</b> an illegal file, such as an MP3 file or a file containing highly confidential information, across the network <b>106</b> to identify users who have insecure machines <b>102</b>, for example, or users who might be involved in unauthorized activities.

P-0106[0106] Other management steps <b>314</b> are discussed elsewhere, and shown in FIG. 6 as a reminder. For instance, during a policy setting step <b>606</b>, an administrator sets a policy, such as a policy of the type recognized in conventional SRM software, to be enforced <b>534</b> by appropriate modifications <b>312</b> of ample images <b>104</b> followed by deployment <b>316</b> of the modified images.

P-0107[0107] Also, if modification <b>312</b> of an image <b>104</b> makes the meta-data <b>128</b> associated with the image inaccurate, then the meta-data may be modified <b>610</b> to match the modified image. For example, if a hardware driver is installed <b>508</b>, then the meta-data <b>144</b> describing the hardware <b>116</b> on the imaged computer may be modified <b>610</b> accordingly (regardless of whether the actual hardware has been swapped yet) so that the meta-data indexing <b>132</b>, <b>218</b> operates to locate <b>612</b> the modified image <b>104</b> in the image database <b>222</b> when the hardware driver in question is specified as a key.

P-0108[0108] Some embodiments provide software similar to PowerQuest Drive Image® software, to build and write—in a recognized image file format—an image from the ample image <b>104</b> data in a management environment. The resulting collection of one or more image files can then be (re)deployed <b>316</b> using conventional image deployment software.

P-0109[0109] Configured Media Generally

P-0110[0110] The computers <b>102</b>, <b>110</b> are capable of using floppy drives, tape drives, optical drives or other means to read a configured storage medium <b>146</b>. A suitable configured medium includes a magnetic, optical, or other computer-readable storage device. Suitable storage devices include floppy disks, hard disks, tape, CD-ROMs, PROMs, RAM, and other computer system storage devices. The substrate configuration of the medium <b>146</b> represents data and instructions which cause the computer system to operate in a specific and predefined manner as described herein. For instance, the medium <b>146</b> tangibly embodies a program, functions, and/or instructions that are executable by the management computers <b>110</b> or imaged computers <b>102</b> to perform methods of the present invention substantially as described and claimed herein.

CONCLUSION

P-0111[0111] Using the present invention, one can take a picture or snapshot of up to the entire functioning storage space of a client computer. Indeed, all computers in an enterprise including all servers, desktops, laptops, and mobile data devices could be imaged. After the image(s) are copied or moved to an alternate storage location at a management computer, one can perform various resource management tasks using the alternate copies of the image. An ample image contains persistent data from the client. In a full ample image, this is data that represents the exact state of both the operating system and all installed software as well as all the system and user data contained on the client computer. This is the “active state” of a fully imaged computer. Using the captured active state, one can mine this data, as in an SRM application, to learn any storage-evident aspect of the current operation of the operating system and applications, as well as anything else captured in the stored data.

P-0112[0112] As a further step, one can then make modifications to this active state data and send it, back to the same client and/or to another client computer, by rebuilding an image, taking that image to the target(s), and then (re)writing each target's storage with the image. When sending the image back to different client than the one on which it originated, one should make necessary modifications in the environment and configuration data used by the operating system to allow it to properly recognize and accept this change in its active state. For instance, hardware differences may require device driver changes, and disk capacity changes may require resizing or splitting partitions, or deleting unwanted data. Changes can be made interactively and/or by scripts, and they may be constrained or triggered by administrator-defined policies.

P-0113[0113] Embodiments of the invention may allow less disruptive management of a real-time computing environments than other tools, may reduce the number of copies of management software needed per node, may allow storage management to be centralized around one controlled set of images and meta-data, may allow storage management applications to view the historical conditions of a user(s)/computer and its environment, and/or may allow for the protection of computer <b>102</b> data by permitting environments to be rolled back to a specific point in time and the associated environment.

P-0114[0114] Suitable software to assist in implementing the invention is readily provided by those of skill in the pertinent art(s) using the teachings presented here and programming languages and tools such as C++, C, Java, Pascal, Perl, Python, XML, APIs, SDKs, assembly, firmware, microcode, and/or other languages and tools.

P-0115[0115] Although particular embodiments of the present invention are expressly illustrated and described herein, it will be appreciated that discussion of one type of embodiment also generally extends to other embodiment types. For instance, the description of the methods illustrated in FIG. 3 also helps describe systems like those shown in FIG. 1 which can operate according to those methods. Embodiments such as the methods or systems illustrated may omit items/steps, repeat items/steps, group them differently, supplement them with familiar items/steps, or otherwise comprise variations on the given examples. All claims as filed are part of the specification and thus help describe the invention, and repeated claim language may be inserted outside the claims as needed. Any failure to expressly identify a thing as prior art in this document is not an assertion that it is not prior art; readers are assumed to be familiar with the state of the art.

P-0116[0116] As used herein, terms such as “a” and “the” and designations such as “ample image” and “searching”, are inclusive of one or more of the indicated item or step. In particular, in the claims a reference to an item generally means at least one such item is present and a reference to a step means at least one instance of the step is performed.

P-0117[0117] The invention may be embodied in other specific forms without departing from its essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. Headings are for convenience only. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope to the full extent permitted by law.