Unit 11: Backups and recovery · Lesson 2 of 4 · 18 min

Snapshots and restoring a file

List what a restic repository holds and bring one file back without touching the live site.

mission

You are
You are running your first restore from backup01's repository.
Situation
A read-only copy of the web root repository is mounted at /srv/backup/restic-web.
Goal
List the snapshots, restore index.html from one of them and prove it is a good copy.
Hand in
The restored file and its hash.

A safe restore

  1. List snapshotsPick one by date
  2. Restore to a new pathNever over live data
  3. VerifyAgainst a known-good hash
  4. Swap inOnly after it checks out

Run export RESTIC_REPOSITORY=/srv/backup/restic-web RESTIC_PASSWORD_FILE=/srv/backup/.restic-pass first. --no-lock --no-cache let restic read a repository you cannot write to.

01

List snapshots

learner@root-lab
export RESTIC_REPOSITORY=/srv/backup/restic-web RESTIC_PASSWORD_FILE=/srv/backup/.restic-pass
restic snapshots --no-lock --no-cache
ID        Time                 Host        Tags        Paths
--------------------------------------------------------------------
94e33656  2026-10-11 02:30:00  web01       nightly     /var/www/html
381765c2  2026-10-12 02:30:00  web01       nightly     /var/www/html
47b49379  2026-10-13 02:30:00  web01       nightly     /var/www/html
1ad4a62d  2026-10-14 02:30:00  web01       nightly     /var/www/html
--------------------------------------------------------------------
4 snapshots

you should see Four nightly snapshots.

02

Look inside one

learner@root-lab
restic ls --no-lock --no-cache 47b49379 | head -n 8
snapshot 47b49379 of [/var/www/html] filtered by [] at 2026-10-13 02:30:00 +0000 UTC):
/var
/var/www
/var/www/html
/var/www/html/.git
/var/www/html/.git/config
/var/www/html/assets
/var/www/html/assets/css

you should see Paths exactly as they were on web01.

03

Restore to a safe place

Restore next to the live data, never over it, until you have checked the copy.

learner@root-lab
restic restore --no-lock --no-cache 47b49379 --target ~/restore --include /var/www/html/index.html
restoring <Snapshot 47b49379 of [/var/www/html] at 2026-10-13 02:30:00 +0000 UTC by root@web01> to /home/learner/restore
Summary: Restored 4 / 1 files/dirs (178 B / 178 B) in 0:00
ls -l ~/restore/var/www/html
total 4
-rw-r--r-- 1 learner learner 178 Sep 30 14:00 index.html

you should see One file, restored as you.

04

Prove it is good

learner@root-lab
sha256sum ~/restore/var/www/html/index.html
32e8a36acbf526853057f4e377f7a6078e498ca3e138120a71487e3ad9ace292  /home/learner/restore/var/www/html/index.html
grep index.html /srv/baseline/www.sha256
32e8a36acbf526853057f4e377f7a6078e498ca3e138120a71487e3ad9ace292  ./index.html

you should see The restored file matches the known-good baseline.

What a defender takes away

  1. 1Restore to a new path first.
  2. 2Check restored data against a known-good hash.
  3. 3Read-only access to backups is enough to restore.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.