determining a start time q by relying on a notification from a backup system;

creating an IO journal of length [t−q, t+p], where t is a time at which a backup image of a VM was taken and time t is unknown when the IO journal is created, t−q refers to a period of time beginning at t and extending from t back to time q, and t+p refers to a period of time beginning at t and extending from forward to time p;

identifying a restore point r that is a point in time that falls within the length of the IO journal; and

determining whether r>t or r<t and then:

when r>t, and for each different location L appearing in the IO journal, applying to the backup VM image the newest IO journal entry with location L and timestamp on or before r; or

when r<t, for each different location L appearing in the IO journal over a range (t,r), applying to the backup VM image, the oldest IO journal entry with a timestamp r, and applying the oldest IO journal entry comprises either applying the data of the oldest IO journal entry or applying undo data of the oldest IO journal entry, wherein an IO journal entry that does not include undo data is not modified.