Indicating infected snapshots in a snapshot chain

An apparatus, comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the apparatus to:
• identify a most recent snapshot in a snapshot chain that is not infected by malware, wherein the identifying comprises mounting snapshots in the snapshot chain and determining whether the snapshots are infected by malware;
• display a graphical user interface showing individual snapshots in the snapshot chain, wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, the graphical user interface providing a recover function for non-infected snapshots and disabling the recover function for infected snapshots;
• receive a command to recover a non-infected snapshot from the snapshot chain;
• and
• recover the non-infected snapshot in response to the command.

A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

• identify a most recent snapshot in a snapshot chain that is not infected by malware, wherein the identifying comprises mounting snapshots in the snapshot chain and determining whether the snapshots are infected by malware;
• display a graphical user interface showing individual snapshots in the snapshot chain, wherein a representation of an individual snapshot indicates whether the individual snapshot is infected with malware, the graphical user interface providing a recover function for non-infected snapshots and disabling the recover function for infected snapshots;
• receive a command to recover a non-infected snapshot from the snapshot chain;
• and
• recover the non-infected snapshot in response to the command.