Inspect and compare snapshots

Versioned backups are useful only when operators can find the right point. During a real incident you won’t restore “a backup” — you’ll need the snapshot from before the bad thing happened, and you’ll need to find it under pressure. Tags, hosts, paths, and timestamps help narrow the history.

Explore the repository

Three commands cover most of the searching you’ll ever do:

restic snapshots
restic ls latest
restic find report.txt

restic snapshots lists every recovery point with its ID, time, host, and paths:

ID        Time                 Host    Paths
--------------------------------------------------------
4a72fb18  2026-08-03 09:12:33  athena  /home/flavio/notes
9c31de07  2026-08-03 09:15:02  athena  /home/flavio/notes

restic ls latest lists the files inside the most recent snapshot, so you can confirm a path was actually captured. And restic find report.txt searches all snapshots for a filename:

Found matching entries in snapshot 4a72fb18 from 2026-08-03 09:12:33
/notes/report.txt

Found matching entries in snapshot 9c31de07 from 2026-08-03 09:15:02
/notes/report.txt

That’s the “when did this file exist?” question answered in one command. It also works with glob patterns like restic find '*.sql'.

Compare two recovery points

Choose two snapshots and run restic diff OLD NEW:

restic diff 4a72fb18 9c31de07

M    /notes/report.txt

Files:           0 new,     0 removed,     1 changed

M marks a modified file, + an added one, - a removed one. Explain which one precedes the unwanted change — that’s the practical skill here. If a config file broke on Tuesday, diff Monday’s snapshot against Tuesday’s and the changed paths point straight at the suspect.

Don’t reflexively restore latest

Do not automatically restore latest after corruption or compromise. The newest snapshot may already contain the problem: ransomware-encrypted files, the corrupted database, the broken config. Backups taken after an incident faithfully preserve the incident.

Walk backwards through the history with restic diff until you find the last snapshot that’s clean, and restore that one. The minute spent comparing is much cheaper than restoring the damage on top of itself.