File system metadata regarding states of a file system affected by transactions is tracked consistently even in the face of dirty shutdowns which might cause rollbacks in transactions which have already been reflected in the metadata. In order to only request time- and resource-heavy rebuilding of metadata for metadata which may have been affected by rollbacks, reliability information is tracked regarding metadata items. When a metadata item is affected by a transaction which may not complete properly in the case of a problematic shutdown or other event, that metadata item's reliability information indicates that it may not be reliable in case of such a problematic ("dirty" or "abnormal") event. In addition to flag information indicating unreliability, timestamp information tracking a time of the command which has made a metadata item unreliable is also maintained. This timestamp information can then be used, along with information regarding a period after which the transaction will no longer cause a problem in the case of a problematic event, in order to reset the reliability information to indicate that the metadata item is now reliable even in the face of a problematic event.

A storage system stores I/O operations in a journal volume in a chronological order and with assigned sequence numbers. When a predefined command to be logged is received, the storage system transmits a log of the command to an external server with the information of a particular sequence number of the I/O operation that is influenced by the command. When a log entry is identified as necessitating data recovery, such as by being issued maliciously, the I/O operations with sequence numbers larger than the particular sequence number of the identified log entry are discarded. A log analysis module is located separately from the storage system on the external server, and is able to identify the particular sequence number of the I/O operation which is affected by the malicious command so that instructions may be sent to the storage system regarding the sequence numbers of the commands to be discarded.

A host and a storage system each keep a shared identifier indicating a state of a system. The storage system acquires, at update of data, a data pair including data for a change through processing of the host and data before the update. The storage system relates the data pair to a shared identifier. When the host indicates an identifier, the storage system restores data using the data pair.