Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.

Abstract: Methods, systems, and devices for data management are described. The method may include obtaining a first backup of a host data store in a host environment, the first backup containing a set of multiple files from the host data store, generating, for one or more files of the set, a respective hash value using content of a respective file of the one or more files, storing the respective hash value for the one or more files of the set of multiple files in a database in association with metadata for the respective file, where the database is indexed based on hash values, querying the database for a hash value generated based on content of a compromised file, and identifying, in response to querying, a latest backup of the host data store of the host environment that does not contain the hash value for the compromised file.

Abstract: Subject matter related to data management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, the non-infected snapshot may be recovered.

Abstract: Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.

Abstract: Subject matter related to data management is disclosed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A selection of an infected snapshot may be received, where the infected snapshot may be more recent than the identified most recent snapshot. The selected infected snapshot may be mounted. Based on mounting the infected snapshot, a determination of which content in the selected snapshot are not infected may be made. Based on determining which content in the selected snapshot is not infected, at least one of the non-infected content may be recovered.

Abstract: Subject matter related to data management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, the non-infected snapshot may be recovered.

Abstract: Subject matter related to data management is disclosed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A selection of an infected snapshot may be received, where the infected snapshot may be more recent than the identified most recent snapshot. The selected infected snapshot may be mounted. Based on mounting the infected snapshot, a determination of which content in the selected snapshot are not infected may be made. Based on determining which content in the selected snapshot is not infected, at least one of the non-infected content may be recovered.

Abstract: Subject matter related to data management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, the non-infected snapshot may be recovered.

Abstract: Subject matter related to data management is disclosed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A selection of an infected snapshot may be received, where the infected snapshot may be more recent than the identified most recent snapshot. The selected infected snapshot may be mounted. Based on mounting the infected snapshot, a determination of which content in the selected snapshot are not infected may be made. Based on determining which content in the selected snapshot is not infected, at least one of the non-infected content may be recovered.