| CPC G06F 11/1484 (2013.01) [G06F 11/1448 (2013.01); G06F 2201/84 (2013.01)] | 20 Claims |

|
1. A method, comprising:
receiving a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;
receiving a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;
mounting, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and
performing one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.
|