Recovering infected snapshots in a snapshot chain

An apparatus, comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the apparatus to:
• identify a most recent snapshot in a snapshot chain that is not infected by malware, wherein the identifying comprises mounting snapshots in the snapshot chain and determining whether the snapshots are infected by malware;
• receive a selection, from a user, of an infected snapshot, the infected snapshot being more recent than the identified most recent snapshot;
• mount the selected infected snapshot;
• determine which content in the selected infected snapshot are not infected;
• and
• recover at least one of the non-infected content.

A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

• identify a most recent snapshot in a snapshot chain that is not infected by malware, wherein the identifying comprises mounting snapshots in the snapshot chain and determining whether the snapshots are infected by malware;
• receive a selection, from a user, of an infected snapshot, the infected snapshot being more recent than the identified most recent snapshot;
• mount the selected infected snapshot;
• determine which content in the selected infected snapshot are not infected;
• and
• recover at least one of the non-infected content.