Recovery of compromised snapshots

A computing system comprising:

• a memory storing instructions;
• and
• processing circuitry that executes the instructions to:
• identify a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise;
• for each file in an anomalous snapshot of the plurality of snapshots, identify from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file;
• and
• store a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot.

Non-transitory computer-readable media comprising instructions that, when executed, cause processing circuitry of a computing system to:

• identify a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise;
• for each file in an anomalous snapshot of the plurality of snapshots, identify from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file;
• and
• store a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot.