Files are identified for file-level restore by bitmaps of cloud snapshots of a storage volume. The bitmaps comprise a data structure for each snapshot containing record numbers of files of the storage volume and a file status bit for each such file that indicates the presence or absence of the file in the corresponding snapshot. File numbers of files of interest are obtained from record numbers of records in a volume files index of the storage volume. The bitmaps can be searched to locate the snapshots containing particular files of interest without the necessity of mounting and searching the separate snapshots on a virtual machine.