Inspect and compare snapshots

Versioned backups only help if you can find the right version. During a real incident you won’t restore “a backup”. You need the snapshot from before the bad thing happened, and you need to find it under pressure. Tags, hosts, paths, and timestamps are what let you narrow the history down.

Explore the repository

Three commands cover most of the searching you’ll ever do:

restic snapshots
restic ls latest
restic find report.txt

restic snapshots lists every recovery point with its ID, time, host, and paths:

ID        Time                 Host    Paths
--------------------------------------------------------
4a72fb18  2026-08-03 09:12:33  athena  /home/flavio/notes
9c31de07  2026-08-03 09:15:02  athena  /home/flavio/notes

restic ls latest lists the files inside the most recent snapshot. Use it to confirm a path was really captured.

restic find report.txt searches all snapshots for a filename:

Found matching entries in snapshot 4a72fb18 from 2026-08-03 09:12:33
/notes/report.txt

Found matching entries in snapshot 9c31de07 from 2026-08-03 09:15:02
/notes/report.txt

That answers “when did this file exist?” in one command. It also takes glob patterns, like restic find '*.sql'.

Compare two recovery points

Pick two snapshots and run restic diff OLD NEW:

restic diff 4a72fb18 9c31de07

M    /notes/report.txt

Files:           0 new,     0 removed,     1 changed

M marks a modified file, + an added one, - a removed one.

The practical skill is telling which snapshot comes before the unwanted change. If a config file broke on Tuesday, diff Monday’s snapshot against Tuesday’s. The changed paths point straight at the suspect.

Don’t restore latest by reflex

After corruption or a compromise, don’t automatically restore latest. The newest snapshot may already contain the problem. Ransomware-encrypted files, the corrupted database, the broken config. Backups taken after an incident faithfully preserve the incident.

Walk backwards through the history with restic diff until you find the last clean snapshot. Restore that one. The minute spent comparing is much cheaper than restoring the damage on top of itself.

Try it in your lab: break a file on purpose, take a snapshot, and find the last snapshot where the file was still good.