Apply retention with care

Snapshots pile up. Daily backups produce 365 recovery points a year, and most of them stop earning their storage after a few weeks. Retention controls that growth while keeping the useful recovery points.

The danger runs the other way too. An aggressive policy can erase the last good version of something you haven’t noticed is broken yet.

The standard shape is tiered. Keep every recent snapshot, then thin out with age. Recent history stays dense because recent mistakes are the ones you discover.

Preview before deleting

restic separates deciding from deleting. Preview a simple policy first:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --dry-run

This keeps one snapshot per day for 7 days, one per week for 4 weeks, and one per month for 12 months. With --dry-run nothing is deleted. restic prints two tables, keep and remove, with the reason each snapshot survives:

keep 11 snapshots:
ID        Time                 Reasons
------------------------------------------------
9c31de07  2026-08-03 03:00:01  daily snapshot
                               weekly snapshot
...
remove 23 snapshots:

Read both tables and explain every row to yourself before dropping the flag. Only apply forget when you understand the policy and the current incident state. If a snapshot you’d want is in the remove list, fix the policy now. The dry run is free. The mistake isn’t.

Forget, then prune, then check

forget only removes the snapshot records. The data stays until you prune:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12
restic prune
restic check

prune finds data no snapshot references anymore, repacks what’s partially used, and deletes the rest.

Keeping prune as a separate step is deliberate. Prune rewrites the repository, so run it when things are calm. Then run restic check to confirm the repository is still healthy. Pruning on top of undetected damage makes the damage worse.

When not to prune

Never prune during an active recovery or a suspected compromise. Pruning removes unreferenced data and reduces your options. That includes snapshots you just forgot in a hurry, which stay recoverable until prune runs.

During an incident, storage cost is the cheapest problem you have. Freeze retention, finish the recovery, then clean up.