The computing device of claim 9, wherein generate the list of timestamps comprises, determine from response to the request for the file or folder attributes whether the file or folder exists on a shadow volume identified via a timestamp, and if so, including an entry representing a corresponding timestamp in the list of timestamps.