A method for inspecting archive slices for malware, the method comprising: generating a backup slice that reflects a state of data at a first time, wherein the backup slice is stored in a backup archive; generating a virtual volume comprising a list of files in the backup slice and associated file information, wherein the virtual volume does not store the files referenced in the list of files; mounting the virtual volume to a disk; creating, in the virtual volume, empty sparse files that are placeholders of the files referenced in the list of files; for each respective empty sparse file: comparing file information associated with the respective empty sparse file with file information associated with a corresponding file in another backup slice reflecting the state of data at a second time; and in response to detecting a change between the respective empty sparse file and the corresponding file: retrieving content associated with the respective empty sparse file from the backup slice; and storing the content in the virtual volume in place of the respective empty sparse file; scanning the virtual volume for viruses and/or malicious software; and in response to detecting that at least one file in the virtual volume is infected with a virus and/or malicious software, generating a cured slice that replaces the backup slice in the backup archive. generating a backup slice that reflects a state of data at a first time, wherein the backup slice is stored in a backup archive; generating a virtual volume comprising a list of files in the backup slice and associated file information, wherein the virtual volume does not store the files referenced in the list of files; mounting the virtual volume to a disk; creating, in the virtual volume, empty sparse files that are placeholders of the files referenced in the list of files; for each respective empty sparse file: comparing file information associated with the respective empty sparse file with file information associated with a corresponding file in another backup slice reflecting the state of data at a second time; and in response to detecting a change between the respective empty sparse file and the corresponding file: retrieving content associated with the respective empty sparse file from the backup slice; and storing the content in the virtual volume in place of the respective empty sparse file; comparing file information associated with the respective empty sparse file with file information associated with a corresponding file in another backup slice reflecting the state of data at a second time; and in response to detecting a change between the respective empty sparse file and the corresponding file: retrieving content associated with the respective empty sparse file from the backup slice; and storing the content in the virtual volume in place of the respective empty sparse file; retrieving content associated with the respective empty sparse file from the backup slice; and storing the content in the virtual volume in place of the respective empty sparse file; scanning the virtual volume for viruses and/or malicious software; and in response to detecting that at least one file in the virtual volume is infected with a virus and/or malicious software, generating a cured slice that replaces the backup slice in the backup archive.