A system and method for generating replicas of a file of a protected storage system from protected data in a recovery system. The method including protecting data in a recovery system including a target disk configured to store a replica of the protected storage system from a before a time window and a journal including data and metadata of write operations to the protected storage system that occurred during the time window, obtaining a request to restore a file and an indication of a specified time point from which the file should be restored, generating a replica of a table of content of a file system of the protected storage system from the journal and the target disk, extracting location of the file from the table of content, and generating a replica of the file from the journal and the target disk, using the extracted file location.