Bulk snapshot recovery

An apparatus, comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the apparatus to:
• perform, by a data management system, a malware scan to scan for malware within a plurality of respective sets of snapshots of a plurality of computing objects of a computing system;
• update, by the data management system based at least in part on a result of the malware scan, a data structure comprising a plurality of entries storing metadata for the plurality of respective sets of snapshots of the plurality of computing objects of the computing system, wherein the plurality of respective sets of snapshots comprises a respective set of multiple snapshots for each computing object included in the plurality of computing objects, and wherein, to update the data structure, the instructions, when executed by the processor, cause the apparatus to:
• update respective metadata stored in first respective entries of the plurality of entries for a first set of snapshots included in the plurality of respective sets of snapshots to indicate that snapshots in the first set of snapshots are anomalous based at least in part on detection of the malware in the first set of snapshots during the malware scan;
• receive, by the data management system, a request to restore the plurality of computing objects, the request indicating a recovery time range, and the data management system storing the plurality of respective sets of snapshots and the metadata for the plurality of respective sets of snapshots;
• filter, by the data management system, the plurality of entries of the data structure to obtain a subset of entries associated with a second set of snapshots from among the plurality of respective sets of snapshots that are available for restoring two or more computing objects of the plurality of computing objects, wherein the subset of entries is obtained via the filtering based at least in part on second respective entries of the subset of entries for the second set of snapshots indicating that respective creation times of the second set of snapshots satisfy the recovery time range and further based at least in part on the second set of snapshots being exclusive of the first set of snapshots that are indicated by the first respective entries as being anomalous;
• and
• indicate, by the data management system, at least two snapshots from among the second set of snapshots, the at least two snapshots comprising at least one respective snapshot for each of the two or more computing objects that are available for restoring the two or more computing objects.

A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

• perform, by a data management system, a malware scan to scan for malware within a plurality of respective sets of snapshots of a plurality of computing objects of a computing system;
• update, by the data management system based at least in part on a result of the malware scan, a data structure comprising a plurality of entries storing metadata for the plurality of respective sets of snapshots of the plurality of computing objects of the computing system, wherein the plurality of respective sets of snapshots comprises a respective set of multiple snapshots for each computing object included in the plurality of computing objects, and wherein, to update the data structure, the instructions are executable by the processor of the device to cause the device to:
• update respective metadata stored in first respective entries of the plurality of entries for a first set of snapshots included in the plurality of respective sets of snapshots to indicate that snapshots in the first set of snapshots are anomalous based at least in part on detection of the malware in the first set of snapshots during the malware scan;
• receive, by the data management system, a request to restore the plurality of computing objects, the request indicating a recovery time range, and the data management system storing the plurality of respective sets of snapshots and the metadata for the plurality of respective sets of snapshots;
• filter, by the data management system, the plurality of entries of the data structure to obtain a subset of entries associated with a second set of snapshots from among the plurality of respective sets of snapshots that are available for restoring two or more computing objects of the plurality of computing objects, wherein the subset of entries is obtained via the filtering based at least in part on second respective entries of the subset of entries for the second set of snapshots indicating that respective creation times of the second set of snapshots satisfy the recovery time range and further based at least in part on the second set of snapshots being exclusive of the first set of snapshots that are indicated by the first respective entries as being anomalous;
• and
• indicate, by the data management system, at least two snapshots from among the second set of snapshots, the at least two snapshots comprising at least one respective snapshot for each of the two or more computing objects that are available for restoring the two or more computing objects.