referring to fig1 , there is shown a system 100 for recovering of data from cold images in accordance with an embodiment of the present disclosure . network 102 may be a local area network ( lan ), a wide area network ( wan ), the internet , a cellular network , a satellite network , or another network that permits communication between network element 104 , network element 110 , computer 108 , and other devices communicatively coupled to network 102 . computer 108 may contain media interface 118 . network element 110 may be communicatively coupled to storage 112 . storage 112 may contain recovered data 120 . network element 104 may be communicatively coupled to data 106 . data 106 may contain virtual machine image file 114 and file 116 . computer 108 may be a desktop computer , a laptop computer , a server , or other computer capable of performing private network backbone analysis . computer 108 may receive data from user input , a database , a file , a web service , and / or an application programming interface . computer 108 may contain one or more components , such as media interface 118 . media interface 118 may be a cd drive , a dvd drive , a flash memory interface ( e . g ., a card drive , a usb port attached to a use flash drive ), a floppy disk , a hard disk , or other storage interface . in one or more embodiments , computer 108 may provide a user interface for a recovery application and may enable the input of recovery parameters , the display of recovery data , and other recovery application functionality . network elements 104 and 110 may be application servers , backup servers , network storage devices , media servers or other devices communicatively coupled to network 102 . for example , network elements 104 and 110 may be hosts , such as application servers , which may process data traveling between themselves and a backup device , a backup process , and / or storage . in one particular exemplary embodiment , network element 110 may be a backup and / or recovery server attached to storage 112 . in one or more other embodiments , network element 110 may represent a network appliance connected to a storage area network . in one or more embodiments , network element 110 may be capable of processing data received from or transmitted to storage 112 . storage 112 may be network accessible storage and may be local , remote , or a combination thereof to network element 110 . storage 112 may utilize a tape , disk , a storage area network ( san ), or other computer accessible storage . in one or more embodiments , storage 112 may be a database . storage 112 may contain recovered data 120 . recovered data 120 may include one or more portions of data recovered from one or more cold images . recovered data 120 may contain individual files , portions of application data storage ( e . g ., database files ), or a fully recovered application data set . in one or more embodiments , recovered data 120 may be a full or partial recovered set of application data enabling the running of an application utilizing the data . data 106 may be network accessible storage and may be local , remote , or a combination thereof to network elements 104 , and 110 . data 106 may utilize a tape , disk , a storage area network ( san ), or other computer accessible storage . in one or more embodiments , data 106 may represent a database or another application instance . virtual machine image file 114 may be a virtual machine disk format ( vmdk ) file or other file that may store data associated with a virtual machine . file 116 may be one or more portions of an application data store including , but not limited to , a data structure associated with a database , a data structure associated with microsoft exchange , and a data structure associated with microsoft active directory . in one or more embodiments , a recovery process may recover one or more portions of a cold image file on data 106 . for example , a recovery process may attempt to recover data from a virtual machine 122 that crashed or was shutdown on network element 104 . the virtual machine 122 may have stored data in virtual machine image file 114 prior to crashing or shutting down . the recovery process may run on network element 104 , network element 110 , computer 108 or on another computing platform with network access to virtual machine image file 114 . a recovery process may receive one or more inputs from a user specifying a recovery target . the recovery target may be the entire virtual machine image file 114 or a portion of the virtual machine image file 114 , such as data from an application on the virtual machine 122 . the recovery process may parse the virtual machine image file 114 directly or may use an api , an executable component associated with a virtualization platform used by the virtual machine , or another utility capable of parsing a virtual machine image file . in one or more embodiments , the recovery process may attempt to boot the virtual machine 122 using an alternative boot image . if the target of the recovery process is application data associated with virtual machine image file 114 , additional parsing utilities and / or code may be utilized . for example , if a microsoft exchange server ™ was running on the virtual machine 122 and the recovery of one or more portions of exchange data from virtual machine image file 114 is desired , the recovery process may utilize an application specific utility . for example , a recovery process may use a microsoft jet api via an ese . dll file . this may enable a recovery process to parse a microsoft exchange specific data file such as an exchange database ( edb ) file . in one or more embodiments , multiple virtual machine image file 114 may comprise multiple virtual machine image files . if virtual machine 122 is not running , determining the correct files and the location of the files may be more challenging . however , the recovery process may use application specific metadata to identify and locate the proper files to recover the entire exchange instance or a portion of the exchange instance ( e . g ., one or more emails ). application specific metadata for exchange or for other applications may include a file name , a directory name , a path , a registry entry , a system variable , a file extension , a date stamp , and one or more portions of a file header . for example , a recovery process recovering one or more portions of an exchange instance may utilize metadata including configurable directories for each storage group , a system files path , a log files path , a configurable path for one or more exchange databases , a database file ( edb ) path , and a streaming database file ( stm ) path . a recovery process may scan one or more cold images such as virtual machine image file 114 in order to find one or more exchange log files . the recovery process may then parse the one or more exchange log files . the exchange log files may contain header information and / or other metadata such as paths , signatures , and / or timestamps . the metadata information of the one or more exchange log files may specify paths to databases associated with the exchange log files . the signatures and / or timestamps of the one or more exchange log files may identify a unique set of exchange log files and exchange databases and may distinguish such files from those of a separate version or exchange instance . by analyzing paths , files and / or other metadata gathered , a recovery process may be able to gain enough data and information to mount an exchange database and perform a full or granular recovery . for example , a recovery process may be capable of recovering an entire exchange database or one or more emails or other files in an exchange database . in one or more embodiments , network element 110 may be a recovery platform and a recovery process may transfer data to recovered data 120 . in some embodiments , this may enable the running of a second application instance on network element 110 utilizing recovered data 120 . a recovery process may also be capable of recovering one or more portions of other application data stores , such as a sql server database , active directory storage , a oracle database , lotus notes database , and a db2 database . based on a target type specified by a user , a recovery process may have specified metadata such as paths , extensions , directory names , file header information , system variables or parameters , and file names , which the recovery process may seek and parse . thus , a recovery process may contain or have access to sufficient application structure information to perform a granular or full recovery of an application without requiring a user to identify files , paths , and other application specific details . such a recovery process may be provided with a volume or other storage unit to search and an application name or other high level target information ( e . g .—“ recover exchange email from server a ”). a recovery process may also recover a file written in a standard format that is not part of an application data store . for example , a recovery process may parse and / or recover file 116 . in one or more embodiments , file 116 may be a file stored in a standardized format , such as . txt files , . csv files , . tar files , . zip files , . jar files , . rtf files , . jpg files , . xls files , . doc files , or other standardized non - proprietary and proprietary formats . in one or more embodiments , a recovery process may recover data from storage associated with a computing platform that is not booted . the boot information for the computing platform may be damaged , inaccessible to the recovery process , or a full boot up of the computing platform may not be desirable . the recovery process may boot the recovery platform using an alternative boot location . for example , in one or more embodiments , a recovery process may attempt the recovery of a cold image file on computer 108 . computer 108 may utilize a boot image provided on media interface 118 , such as for example , a bootable cd with a minimal operating system and recovery instructions . a recovery process may also utilize a minimum amount of boot information on media interface 118 and may utilize network booting and may execute network accessible recovery instructions . in one or more embodiments , a recovery process may recover data from a damaged application store or from damaged storage of a computing platform . for example , parsing of application data stores may enable recovery of one or more portions of data when an application is unable to initialize or mount . referring to fig2 , there is shown a cold image recovery module 210 for full or granular recovery of data from cold images , in accordance with an embodiment of the present disclosure . cold image recovery module 210 may contain one or more components including boot module 212 , storage search module 214 , storage parsing and recovery module 216 , and error handling module 220 . boot module 212 may provide one or more alternative boot locations and may facilitate booting of a computing platform associated with a recovery target . boot module 212 may enable access of a volume associated with an operating system which has failed or is unavailable . boot module 212 may enable network booting , booting off of removable storage media , or other alternative boot locations . storage search module 214 may search storage associated with a computing platform associated with a recovery target . storage search module 214 may utilize paths , extensions , directory names , file header information , system variables or parameters , file names , and other metadata . storage search module 214 may search alternative locations and extensions based upon a specified recovery target , an application associated with a recovery target , or other recovery criteria specified by a user . storage search module 214 may identify a first data structure , such as a log file . storage search module 214 may then search for other data structures based at least in part on information provided by parsing the first identified data structure by storage parsing and recovery module 216 . storage parsing and recovery module 216 may parse one or more data structures associated with a recovery target . storage parsing and recovery module 216 may be capable of parsing a file , such as a log file , a sql server file , or another file directly . in one or more embodiments , storage parsing and recovery module 216 may utilize a component or a utility to access an application storage file . for example , storage parsing and recovery module 216 may use a microsoft jet api and / or an ( extensible storage engine ) ese . dll file to parse an exchange server or active directory file . in one or more embodiments , storage parsing and recovery module 216 may use other indexed sequential access mechanisms ( isams ) to access application data associated with a recovery target . error handling module 220 may handle errors with booting , file access , file parsing , data recovery , and other recovery issues . error handling module 220 may log errors , such as errors occurring during data recovery . error handling module 220 may generate and / or provide one or more reports . such reports may contain recovery information , recovered data , errors , and information associated with recovery target damage or data loss . for example , error handling module 220 may identify one or more unrecoverable portions of a recovery target due to physical damage , such as damaged disk sectors , file corruption , or other issues . referring to fig3 , there is shown a method 300 for providing a differential application level backup in accordance with an embodiment of the present disclosure . at block 302 , the method 300 for providing a differential application level backup may begin . at block 304 , the method 300 may specify a target for recovery . for example , a user at computer 108 may specify a recovery target , such as storage associated with a computing platform and / or an application instance . at block 306 , the method 300 may boot a computing platform associated with a recovery target using an alternative boot process . for example , a user may provide removable storage media containing executable boot instructions or may specify a network location for network based booting . in one or more embodiments , booting may not be performed . for example , a physical computing platform may be running , but a virtual machine or a virtualization platform , such as vmware , may not be . the method 300 may then have access to one or more virtual machine image files without performing a boot process . at block 308 , the method 300 may search storage , such as a volume , associated with a recovery target . the method 300 may utilize metadata associated with an application type or a recovery target to provide search criteria . one or more files or other data structures may be identified . at block 310 , the method 300 may parse the one or more identified data structures . parsing of the data structures may provide additional metadata to ensure that all data and / or files associated with a recovery target are identified . for example , parsing of a log file associated with a database to be recovered may identify one or more additional database files . furthermore , parsing of a data file may verify an identify of the file by timestamps , signatures , file header information , or other data . at block 312 it may be determined whether additional data is desired . if parsing of one or more identified files has provided criteria to identify further files ( e . g ., additional log files , an mdb file ), the method 300 may return to block 308 . if no further files are identified and / or needed , the method 300 may continue to block 314 . at block 314 , one or more portions of data may be recovered . such data recovery may be performed by parsing one or more identified files , by mounting a database , by instantiating an application instance , and / or by utilizing an application recovery api or utility . at this point it should be noted that full and granular recovery from cold images in accordance with the present disclosure as described above typically involves the processing of input data and the generation of output data to some extent . this input data processing and output data generation may be implemented in hardware or software . for example , specific electronic components may be employed in a data recovery module or similar or related circuitry for implementing the functions associated with full and granular recovery from cold images in accordance with the present disclosure as described above . alternatively , one or more processors operating in accordance with instructions may implement the functions associated with full and granular recovery from cold images in accordance with the present disclosure as described above . if such is the case , it is within the scope of the present disclosure that such instructions may be stored on one or more processor readable media ( e . g ., a magnetic disk or other storage medium ), or transmitted to one or more processors via one or more signals embodied in one or more carrier waves . the present disclosure is not to be limited in scope by the specific embodiments described herein . indeed , other various embodiments of and modifications to the present disclosure , in addition to those described herein , will be apparent to those of ordinary skill in the art from the foregoing description and accompanying drawings . thus , such other embodiments and modifications are intended to fall within the scope of the present disclosure . further , although the present disclosure has been described herein in the context of a particular implementation in a particular environment for a particular purpose , those of ordinary skill in the art will recognize that its usefulness is not limited thereto and that the present disclosure may be beneficially implemented in any number of environments for any number of purposes . accordingly , the claims set forth below should be construed in view of the full breadth and spirit of the present disclosure as described herein .