Create a restic snapshot

Each restic backup creates a snapshot, a picture of the selected paths at one point in time. Snapshots turn a copy into history. You can go back to any of them. And unchanged data is reused inside the repository, so a hundred snapshots of a mostly-static directory cost barely more than one.

Create two snapshots

Let’s back up, change one file, and back up again:

restic backup notes/
printf '%s\n' 'new line' >> notes/report.txt
restic backup notes/
restic snapshots

The first run reports everything as new:

Files:          42 new,     0 changed,     0 unmodified
Added to the repository: 1.204 MiB (698.221 KiB stored)
snapshot 4a72fb18 saved

The second run tells a different story:

Files:           0 new,     1 changed,    41 unmodified
Added to the repository: 1.841 KiB (1.203 KiB stored)
snapshot 9c31de07 saved

One changed file, and only kilobytes added. That’s deduplication. restic splits your data into content-defined chunks, sees that almost all of them already exist in the repository, and stores only the new ones. This is why frequent snapshots are cheap.

restic snapshots lists both versions:

ID        Time                 Host    Paths
--------------------------------------------------------
4a72fb18  2026-08-03 09:12:33  athena  /home/flavio/notes
9c31de07  2026-08-03 09:15:02  athena  /home/flavio/notes

Compare them

restic diff takes two snapshot IDs and shows what changed between them:

restic diff 4a72fb18 9c31de07

M    /notes/report.txt

Files:           0 new,     0 removed,     1 changed

Exactly the one file we touched, marked M for modified.

If a diff between two routine snapshots ever shows thousands of unexpected changes, stop and investigate. That pattern is how you notice ransomware or a runaway process rewriting files behind your back.

Two habits to keep

“snapshot saved” proves the backup ran. It does not prove you can get data back. You still need repository checks and restore tests, and we’ll do both later in the course.

And keep the live data outside the repository path. If you back up a directory that contains its own repository, every snapshot swallows the previous ones. The repository balloons with encrypted copies of itself.