A computer-implemented method and system for analyzing and maintaining data security in backup data, comprising of: accessing backup data of file systems on-site or remotely from a backup server; determining which data is present in a backup system; defining an abnormality data selection criteria to identify security components within the scope of said backup system; performing a data security analysis on backup data; if data abnormality in data are detected in backup data, determining compromised target files, identifying all other files created or modified associated with said compromised target files, including files having a parent-child relationship in both up and down directions of the parent-child tree, including files that are other children of the compromised files in the parent-child tree, including files created or modified by of the compromised files, and including data launched from those files.