Abstract: A method for secure restoration of data selected based on user-specified search criteria includes maintaining one or more backup versions of a plurality of storage objects and initiating the generation of a plurality of database entries, wherein each database entry corresponds to a backup version of a storage object and includes an encoding of a security descriptor associated with the storage object. The method may further include, in response to a backup version search request from a user, using contents of the search request and encodings of security descriptors stored in the plurality of database entries to identify one or more backup versions of a particular storage object that the user is authorized to access.