US Patent 11755420 Recovery point objective optimized file recovery

A system includes a data store and a data management server. The data store stores a plurality of backup snapshots that capture states of a device at different times. The data management server receives a request to restore the device that is potentially malware affected. The data management server retrieves a first backup snapshot of the device. The data management server determines that a first file stored in the first backup snapshot is malware affected. The data management server checks one or more corresponding versions of the first file captured in one or more previous backup snapshots to identify a clean version of the first file. The data management server determines that a second file stored in the first backup snapshot is clean. The data management server restores data in the device.