How to restore a file from an rsync backup

Dated rsync backups can hold several copies of the same pathname, so recovery starts by selecting the intended snapshot without changing the live file. Restoring into a separate directory keeps the chosen copy isolated for content and metadata checks.

The --relative option recreates source path components below the destination. Placing ./ inside the source path sets the point where that recreated path begins, which keeps the file's original directory context without reproducing the backup root.

Keep the backup source read-only and the recovery directory restricted to the people approving the restore. Archive mode covers basic Unix ownership and permissions, but ACLs and extended attributes need explicit preservation when the backup policy requires them. Moving the checked file into an application or user directory is a separate, owner-approved cutover because that action may replace newer live data.

1. List the dated copies of the file before choosing the restore source.

   $ sudo find /backups -path '*/home/alex/docs/report.txt' -type f -print
   /backups/2026-06-06/home/alex/docs/report.txt
   /backups/2026-06-05/home/alex/docs/report.txt
   /backups/2026-06-07/home/alex/docs/report.txt

   Confirm the snapshot date from the backup inventory or change record; identical filenames do not prove that two snapshots contain the same revision.

2. Create a restricted directory for the recovered copy.

   $ sudo install -d -m 0750 /srv/recovery/2026-06-06

3. Preview the file and path that rsync would create.

   $ sudo rsync --archive --relative --dry-run --itemize-changes /backups/2026-06-06/./home/alex/docs/report.txt /srv/recovery/2026-06-06/
   cd+++++++++ home/
   cd+++++++++ home/alex/
   cd+++++++++ home/alex/docs/
   >f+++++++++ home/alex/docs/report.txt

   Proceed only when the preview names the intended snapshot and isolated recovery path. Do not add --delete or point this restore at a live directory; either choice can remove or replace newer data.

4. Restore the selected file into the recovery directory.

   $ sudo rsync --archive --relative --itemize-changes /backups/2026-06-06/./home/alex/docs/report.txt /srv/recovery/2026-06-06/
   cd+++++++++ home/
   cd+++++++++ home/alex/
   cd+++++++++ home/alex/docs/
   >f+++++++++ home/alex/docs/report.txt

5. Compare the backup and recovered file checksums.

   $ sudo sha256sum /backups/2026-06-06/home/alex/docs/report.txt /srv/recovery/2026-06-06/home/alex/docs/report.txt
   3aeaa9bb6717874d57615434654ae904a968319dc8b7333cc1d3898f34970829  /backups/2026-06-06/home/alex/docs/report.txt
   3aeaa9bb6717874d57615434654ae904a968319dc8b7333cc1d3898f34970829  /srv/recovery/2026-06-06/home/alex/docs/report.txt

6. Check the ownership, mode, and size required for the recovered file.

   $ sudo stat -c '%n %U:%G %a %s bytes' /backups/2026-06-06/home/alex/docs/report.txt /srv/recovery/2026-06-06/home/alex/docs/report.txt
   /backups/2026-06-06/home/alex/docs/report.txt root:root 640 41 bytes
   /srv/recovery/2026-06-06/home/alex/docs/report.txt root:root 640 41 bytes