Abstract: A system for performing ransomware scan is presented. The system includes a snapshot access module configured to access a base snapshot corresponding to a dataset. The system further includes a log access module configured to access a log of modified metadata and/or data blocks from a data back-up server corresponding to a subsequent snapshot versus the base snapshot. The system moreover includes an incremental block module configured to download one or more incremental metadata and/or data blocks from the data back-up server based on the log of modified metadata and/or data blocks. The system further includes a snapshot write module configured to write the one or more incremental metadata and/or data blocks on the base snapshot to generate an incremental snapshot. The system furthermore includes a ransomware scan module configured to scan the incremental snapshot to check for ransomware. A related method is also presented.