I have some SharePoint experience as an Accidental Admin but I'm not sure about how this will work.
We had a ransomware attack and servers got encrypted. IT did an excellent job of recovering them but it's been decided that all VMs will be replaced or restored. No SP database data has been lost. We are discussing doing an image restore of the Web server VMs that will roll them back about 3 or 4 weeks. As I said, the databases will retain up-to-date data.
What might be lost with the webserver-only restore? I don't think that anyone is doing much with SP Designer but there are likely to be new views and perhaps new forms. I think that the restore is the only way to go, given our instructions, but what should I tell users to look for afterwards?