A computer implemented method, system, and computer program product comprising scanning, using a set of virtual machines, at least one object in an object store to determine if unwanted behavior has occurred on a production site; wherein the object store has a set of objects corresponding to a copy of a storage device at one or more points in time (PITs) on a production site; wherein the objects store include data objects and metadata objects for each of the one or more PITs.