Create a restic snapshot

Each restic backup creates a snapshot representing the selected paths at a point in time. Snapshots are what turn a copy into history: you can go back to any of them, and unchanged data can be reused inside the repository, so a hundred snapshots of a mostly-static directory cost barely more than one.

Create two snapshots

Back up, change something, back up again:

restic backup notes/
printf '%s\n' 'new line' >> notes/report.txt
restic backup notes/
restic snapshots

The first run reports everything as new:

Files:          42 new,     0 changed,     0 unmodified
Added to the repository: 1.204 MiB (698.221 KiB stored)
snapshot 4a72fb18 saved

The second run tells a different story:

Files:           0 new,     1 changed,    41 unmodified
Added to the repository: 1.841 KiB (1.203 KiB stored)
snapshot 9c31de07 saved

One changed file, and only kilobytes added. That’s deduplication at work: restic split your data into content-defined chunks, saw that almost all of them already exist in the repository, and stored only the new ones. This is why frequent snapshots are cheap.

restic snapshots lists both versions:

ID        Time                 Host    Paths
--------------------------------------------------------
4a72fb18  2026-08-03 09:12:33  athena  /home/flavio/notes
9c31de07  2026-08-03 09:15:02  athena  /home/flavio/notes

Compare them

Compare snapshot IDs, times, paths, and file changes. Use restic diff between the two snapshot IDs:

restic diff 4a72fb18 9c31de07

M    /notes/report.txt

Files:           0 new,     0 removed,     1 changed

Exactly the one file we touched, marked M for modified. If a diff between two routine snapshots ever shows thousands of unexpected changes, investigate before doing anything else — that pattern is how you notice ransomware or a runaway process rewriting files behind your back.

Two habits to keep

A successful command still needs repository checks and restore tests. “snapshot saved” proves the backup ran, not that you can get data back.

And keep the live data outside the repository path. Backing up a directory that contains its own repository makes every snapshot swallow the previous ones, and the repository balloons with encrypted copies of itself.