A computer implemented method, computer program product and comprising rolling an image to a point in time in a protection window by applying write data using write metadata and examining read metadata, the write data, and the write metadata to determine if the image was accessed by an intruder.