US Patent 11157615 Malware scanning of an image level backup

Scanning a virtual disk image for malware without fully extracting the virtual disk image is described herein. An embodiment operates by receiving a selection of a virtual disk image. Virtual storage is initialized based on the virtual disk image. An appliance is launched, and the appliance is configured to access the virtual disk image via the virtual storage. The virtual disk image is scanned for malware using an anti-virus program such that the virtual disk image does not have to be fully extracted. During scanning, on-the-fly decompression, de-deduplication, decryption, and other operations are performed to translate read requests for content on the virtual disk image into raw disk data for the antivirus program.