Unit 11: Backups and recovery · Lesson 3 of 4 · 18 min

Finding the last clean copy

Ransomware and tampering hide in backups too. Find the newest snapshot from before the change.

mission

You are
You are choosing which snapshot to restore the web root from.
Situation
index.html was modified on web01. Restoring the newest snapshot might restore the problem.
Goal
Compare snapshots to find when the file changed and confirm the last clean one.
Hand in
The snapshot ID to restore from.

Four nights of backups

  1. 11 Octclean
  2. 12 Octclean
  3. 13 Octclean: restore this one
  4. 14 Octcontains the injected script
01

Compare neighbours

restic diff compares content, not timestamps.

learner@root-lab
export RESTIC_REPOSITORY=/srv/backup/restic-web RESTIC_PASSWORD_FILE=/srv/backup/.restic-pass
restic diff --no-lock --no-cache 381765c2 47b49379 | grep -E '^[+M-] '
restic diff --no-lock --no-cache 47b49379 1ad4a62d | grep -E '^[+M-] '
M    /var/www/html/index.html

you should see Nothing changed between 12 and 13 October. index.html changed before the 14 October snapshot.

02

Read the file from each side

learner@root-lab
restic dump --no-lock --no-cache 47b49379 /var/www/html/index.html | grep -c '<script'
0
restic dump --no-lock --no-cache 1ad4a62d /var/www/html/index.html | grep -o 'src="[^"]*"'
src="https://cdn.example-metrics.net/m.js"

you should see The 13 October copy has no script tag. The 14 October copy has the injected one.

03

Check the timestamp inside the backup

learner@root-lab
restic ls -l --no-lock --no-cache 1ad4a62d /var/www/html/index.html
snapshot 1ad4a62d of [/var/www/html] filtered by [/var/www/html/index.html] at 2026-10-14 02:30:00 +0000 UTC):
-rw-r--r--     0     0    238 2026-09-30 14:00:00 /var/www/html/index.html

you should see The modified file kept its old timestamp. Only the content gives it away.

defender tip Pick restore points by content and by when the attacker arrived, then scan the restored data before it goes live.

What a defender takes away

  1. 1The newest backup may contain the attack.
  2. 2Diff snapshots by content.
  3. 3Choose the restore point from the incident timeline.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.