MicrosoftRevert snapshot will be handy for the bad deployment case. One caution if people reach for it during a ransomware incident: it's in place, so whatever the share looks like right now is gone once you revert, including the encrypted files and notes the IR people may want to look at. I'd take a fresh snapshot of the damaged share first, then revert.
Also worth browsing the snapshot you plan to go back to before you pick it. Share snapshots are read only, so it's cheap to open a handful of files in two or three of them and check they're actually fine instead of trusting the timestamp.
Disclosure: I'm founder of CyberSnap.
