US Patent 11782790 Methods and systems for recognizing unintended file system changes

A persistent storage device includes a filesystem having a data exclusion list and a protection system stored thereon. The data exclusions list identifies excluded filesystem folders. A processor is programmed to create a canary file in at least one of the excluded filesystem folders. The processor intercepts input/output (I/O) events, each being directed to a respective target filesystem object. The processor stores system event metadata associated with each of the I/O events. The system event metadata includes a file identifier of the respective target filesystem object. The processor creates a backup copy for each respective target filesystem object. The processor releases the I/O events to be performed on the respective target filesystem objects. In addition, the processor determines, based on at least one file identifier, that one of the respective target filesystem objects is the canary file, and replaces each respective target filesystem object with its respective backup copy.