Restore one file

The most common restore isn’t a disaster recovery. It’s “I overwrote a file an hour ago and I want it back”. This small case is where you build the habits that make the big case survivable.

The safest first restore leaves the current data untouched. Recover into a temporary directory, inspect the result, then decide whether to replace anything. Restoring straight over the live path is a one-way door. If you picked the wrong snapshot, you just destroyed the current version too.

Restore into a separate directory

Restore a single path from a snapshot into a fresh directory:

mkdir restore-test
restic restore SNAPSHOT_ID --target restore-test --include /notes/report.txt

Replace SNAPSHOT_ID with a real ID from restic snapshots. Pick one that predates the mistake. The --include path is the file’s path as stored in the snapshot. If the filter matches nothing, check the path with restic ls SNAPSHOT_ID.

The output confirms what happened:

repository 3f8a91c2 opened (version 2)
restoring snapshot 4a72fb18 of [/home/flavio/notes] at 2026-08-03 09:12:33 to restore-test
Summary: Restored 2 files/dirs (1.184 KiB) in 0:00

If it says Restored 0 files/dirs, the include pattern didn’t match. Nothing was recovered, even though the command exited happily. Always read this line.

Verify before replacing

Compare the restored file with the live one. Check the content and the metadata:

diff restore-test/notes/report.txt notes/report.txt
stat restore-test/notes/report.txt

The diff shows exactly what you’d be rolling back. The stat confirms the metadata came through. Only after this comparison, copy the file into place yourself:

cp restore-test/notes/report.txt notes/report.txt

That manual copy is deliberate. You stay in control of the final overwrite, one file at a time.

The habit that matters

Use an exact snapshot ID and an explicit destination. Don’t restore over live data until you verified the recovered version.

latest is convenient in examples and dangerous in incidents. If the file was corrupted before the last backup ran, the latest snapshot holds the corrupted version. Restoring it over your live tree does nothing, except make you feel like you fixed it.