Abstract: Methods, systems, and devices for data management are described. The method may include obtaining a first backup of a host data store in a host environment, the first backup containing a set of multiple files from the host data store, generating, for one or more files of the set, a respective hash value using content of a respective file of the one or more files, storing the respective hash value for the one or more files of the set of multiple files in a database in association with metadata for the respective file, where the database is indexed based on hash values, querying the database for a hash value generated based on content of a compromised file, and identifying, in response to querying, a latest backup of the host data store of the host environment that does not contain the hash value for the compromised file.