Restore one file

The most common restore isn’t a disaster recovery. It’s “I overwrote a file an hour ago and I want it back”. This small case is where you build the habits that make the big case survivable.

The safest first restore leaves current data untouched. Recover into a temporary destination, inspect it, then choose whether to replace anything. Restoring straight over the live path is a one-way door: if you picked the wrong snapshot, you’ve now destroyed the current version too.

Restore into a separate directory

Restore one included path:

mkdir restore-test
restic restore SNAPSHOT_ID --target restore-test --include /notes/report.txt

Replace SNAPSHOT_ID with a real ID from restic snapshots, chosen because it predates the mistake. The --include path is the file’s path as stored in the snapshot — check it with restic ls SNAPSHOT_ID if the filter matches nothing.

The output confirms what happened:

repository 3f8a91c2 opened (version 2)
restoring snapshot 4a72fb18 of [/home/flavio/notes] at 2026-08-03 09:12:33 to restore-test
Summary: Restored 2 files/dirs (1.184 KiB) in 0:00

If it says Restored 0 files/dirs, the include pattern didn’t match — nothing was recovered, even though the command exited happily. Always read this line.

Verify before replacing

Open the restored file and compare timestamps, permissions, and content with the wanted version:

diff restore-test/notes/report.txt notes/report.txt
stat restore-test/notes/report.txt

The diff shows exactly what you’d be rolling back. The stat confirms metadata came through. Only after this comparison, copy the file into place yourself:

cp restore-test/notes/report.txt notes/report.txt

That manual copy is deliberate. You stay in control of the final overwrite, one file at a time.

The habit that matters

Use an exact snapshot ID and destination. Do not restore over live data until the recovered version is verified. latest is convenient in examples and dangerous in incidents — if the file was corrupted before the last backup ran, the latest snapshot contains the corrupted version, and restoring it over your live tree accomplishes nothing except making you feel like you fixed it.