Example implementations described herein provide systems and methods for detecting damage to data by malware and involve generating log information at a storage device based on a write input/output (I/O) provided to the storage device by one or more servers, the log information comprising time information for storing the write I/O to the storage device, logical block information for the write I/O, and a compression ratio associated with storing the write I/O to the storage device; and, for a request by a management server to provide the log information for a specified time range for the storage device, returning, from the storage device, the logical block information and the compression ratio associated with the time information within the specified time range.