Change-based restore from a cloud-based data protection service

A computer-implemented method comprising:

• by a data protection service that executes on one or more cloud computing resources of a cloud, receiving a request to restore a backup data set to one or more storage devices that comprise data generated by one or more computer systems,
• wherein the one or more cloud computing resources are implemented on one or more hardware processors, and
• wherein the one or more computer systems operate outside of the cloud;
• by the data protection service, responsive to the request:
• submitting, to a local agent, a change tracking query in reference to the data at the one or more storage devices, wherein the change tracking query comprises a time corresponding to the backup data set,
• wherein the local agent executes on the one or more computer systems that operate outside of the cloud,
• receiving, from a local agent that executes on the one or more computer systems that operate outside of the cloud, information that indicates a set of changed data blocks that changed at the one or more storage devices after a time that corresponds to the backup data set, and
• causing a virtual machine instance to be instantiated in the cloud, wherein the virtual machine instance is associated with a block storage configured in the cloud;
• by the virtual machine instance in the cloud, based on instructions loaded thereinto by the data protection service:
• identifying first data blocks, among a plurality of data objects of the backup data set, that correspond to the set of changed data blocks,
• wherein the plurality of data objects of the backup data set are stored at an object storage in the cloud,
• restoring the first data blocks, resulting in restored first data blocks, to the block storage that is associated with the virtual machine instance,
• causing the restored first data blocks to be stored in the object storage in the cloud,
• concatenating the restored first data blocks into a plurality of second data blocks, and
• transmitting the plurality of second data blocks, which are compressed and encrypted, to the object storage;
• by the data protection service, after providing the local agent with object identifiers corresponding to the plurality of second data blocks stored in the object storage, deleting the virtual machine instance and the block storage;
• by the local agent, obtaining the plurality of second data blocks from the object storage using the corresponding object identifiers;
• and
• by the local agent, decrypting and decompressing the plurality of second data blocks, resulting in the restored first data blocks, which are stored in the one or more storage devices at respective offsets that are based on offset information received in the information from the local agent.