System and method for ransomware scan using incremental data blocks

A system for performing a ransomware scan, the system comprising:

• a snapshot access module configured to access a base snapshot corresponding to a dataset;
• a log access module configured to access a log of modified metadata and/or data blocks from a data back-up server corresponding to a subsequent snapshot versus the base snapshot;
• an incremental block module configured to download one or more incremental metadata and/or data blocks from the data back-up server based on the log of modified metadata and/or data blocks;
• a snapshot write module configured to write the one or more incremental metadata and/or data blocks on the base snapshot to generate an incremental snapshot;
• a ransomware scan module configured to scan the incremental snapshot to check for ransomware;
• and
• a file restore module configured to restore a safe version of a corrupted file if the ransomware scan module identifies the corrupted file in the scanned incremental snapshot wherein the file restore module includes:
• an offset identification module configured to identify a plurality of offsets corresponding to the corrupted file;
• an offset log access module configured to access a log of one or more modified offsets from the data back-up server corresponding to the corrupted file;
• an offset download module configured to download the one or more modified offsets from the data back-up server based on the log of one or more modified offsets;
• a file write module configured to write the one or more modified offsets on the corrupted file to generate a modified file;
• a file check module configured to determine whether the modified file corresponds to the safe version of the corrupted file;
• and
• and in response to determining the modified file corresponds to the safe version of the corrupted file, replacing the corrupted file with the safe version of the corrupted file.