INDICATING INFECTED SNAPSHOTS IN A SNAPSHOT CHAIN

1 . A method, comprising:

displaying a graphical user interface showing:

at least a portion of respective snapshot chains for respective computing objects of a plurality of computing objects, wherein the respective snapshot chains are represented as one or more individual snapshots, and wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, the plurality of computing objects comprising one or more virtual machines, one or more file systems, one or more databases, one or more network attached storage systems, or any combination thereof, and

across the respective snapshot chains, a cut line delineating infected snapshots from non-infected snapshots, wherein snapshots above the cut line are restricted from being recovered, and wherein the cut line is based at least in part on respective most recent non-infected snapshots for the respective snapshot chains;

receiving a command to recover, for the respective computing objects, non-infected data; and

recovering, in response to the command, for the respective computing objects, a non-infected snapshot from the respective snapshot chains in accordance with the cut line.

2 . The method of claim 1 , further comprising:

mounting snapshots in the respective snapshot chains; and

determining whether the mounted snapshots are infected by malware, wherein the representation is based at least in part on the determining.

3 . The method of claim 2 , wherein mounting the snapshots comprises:

mounting the snapshots in the respective snapshot chains in reverse chronological order.

4 . The method of claim 3 , wherein the mounting and the determining is repeated until a non-infected snapshot in the respective snapshot chains is identified.

5 . The method of claim 3 , wherein the mounting and the determining is repeated past a non-infected snapshot in the respective snapshot chains being identified.

6 . The method of claim 2 , wherein the determining comprises:

applying YARA rules and hash matching to a mounted snapshot.

7 . The method of claim 2 , wherein mounting the snapshots comprises mounting the snapshots in a sandboxed virtual machine.

8 . The method of claim 2 , further comprising:

hydrating data in a mounted snapshot before the determining.

9 . The method of claim 1 , wherein:

a first computing object of the plurality of computing objects is a first virtual machine, a first file system, a first database, or a first network attached storage system; and

a second computing object of the plurality of computing objects is a second virtual machine, a second file system, a second database, or a second network attached storage system.

10 . The method of claim 1 , further comprising:

displaying, via the graphical user interface, an indication of whether a snapshot is encrypted by malware as determined by a measure of entropy of the snapshot.

11 . An apparatus, comprising:

one or more processors; and

one or more memories storing instructions that, when executed by the one or more processors, cause the apparatus to:

display a graphical user interface showing:

at least a portion of respective snapshot chains for respective computing objects of a plurality of computing objects, wherein the respective snapshot chains are represented as one or more individual snapshots, and wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, the plurality of computing objects comprising one or more virtual machines, one or more file systems, one or more databases, one or more network attached storage systems, or any combination thereof, and

across the respective snapshot chains, a cut line delineating infected snapshots from non-infected snapshots, wherein snapshots above the cut line are restricted from being recovered, and wherein the cut line is based at least in part on respective most recent non-infected snapshots for the respective snapshot chains;

receive a command to recover, for the respective computing objects, non-infected data; and

recover, in response to the command, for the respective computing objects, a non-infected snapshot from the respective snapshot chains in accordance with the cut line.

12 . The apparatus of claim 11 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:

mount snapshots in the respective snapshot chains; and

determine whether the mounted snapshots are infected by malware, wherein the representation is based at least in part on the determining.

13 . The apparatus of claim 12 , wherein, to mount the snapshots, the instructions are executable by the one or more processors to cause the apparatus to:

mount the snapshots in the respective snapshot chains in reverse chronological order.

14 . The apparatus of claim 13 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:

repeat the mounting and the determining until a non-infected snapshot in the respective snapshot chains is identified.

15 . The apparatus of claim 13 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:

repeat the mounting and the determining past a non-infected snapshot in the respective snapshot chains being identified.

16 . The apparatus of claim 12 , wherein to determine whether the mounted snapshots are infected by malware, the instructions are further executable by the one or more processors to cause the apparatus to:

apply YARA rules and hash matching to a mounted snapshot.

17 . The apparatus of claim 12 , wherein to mount the snapshots, the instructions are further executable by the one or more processors to cause the apparatus to:

mount the snapshots in a sandboxed virtual machine.

18 . The apparatus of claim 12 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:

hydrate data in a mounted snapshot before the determining.

19 . The apparatus of claim 11 , wherein:

a first computing object of the plurality of computing objects is a first virtual machine, a first file system, a first database, or a first network attached storage system; and

a second computing object of the plurality of computing objects is a second virtual machine, a second file system, a second database, or a second network attached storage system.

20 . A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

display a graphical user interface showing:

at least a portion of respective snapshot chains for respective computing objects of a plurality of computing objects, wherein the respective snapshot chains are represented as one or more individual snapshots, and wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, the plurality of computing objects comprising one or more virtual machines, one or more file systems, one or more databases, one or more network attached storage systems, or any combination thereof, and

across the respective snapshot chains, a cut line delineating infected snapshots from non-infected snapshots, wherein snapshots above the cut line are restricted from being recovered, and wherein the cut line is based at least in part on respective most recent non-infected snapshots for the respective snapshot chains;

receive a command to recover, for the respective computing objects, non-infected data; and

recover, in response to the command, for the respective computing objects, a non-infected snapshot from the respective snapshot chains in accordance with the cut line.