Guide · Restore
Restoring a deleted file: finding the right restore point
In short: when a file has been deleted or overwritten, stop changing anything in that folder and work out when it was last correct. Then search for the file across all restore points of the backup, pick the right version and, if in doubt, restore it to a different folder – that way nothing current is overwritten.
First: answer three questions
- When was the file last correct? If you know it was still right on Tuesday, you search that period instead of every restore point.
- Deleted or overwritten? A deleted file is missing from newer restore points altogether. An overwritten one is in every restore point – what you need is an older version.
- Where should it go? To the original location if nothing is there any more. To a different folder if a newer file with the same name now exists or the versions need comparing first.
The recycle bin and Windows shadow copies only help as long as the deletion is recent and nobody has cleaned up. A backup reaches further back – as far as its retention allows.
Finding the right restore point
Every backup captures a restore point of the data. With daily backups there is one per day, with several runs a day correspondingly more. Rather than opening one restore point after another, a search across all of them is faster: it shows which restore points contain a file and when it changed.
| Situation | Which restore point fits |
|---|---|
| File deleted by mistake | The last restore point that still contains the file |
| File saved with wrong content | The last version before the change – size and modification time of the versions give the clue |
| Folder reorganised or renamed | The restore point before the reorganisation, as a whole folder |
| Files encrypted by ransomware | The last restore point before the attack – not simply the newest; see Ransomware and backup |
Compare versions before anything is overwritten
With overwritten files in particular, comparing two restore points pays off: what was added, removed or changed between Monday and Wednesday? If unsure, restore the older version to a folder of its own and compare it with the current one there. Only once it is clear which version is right does it go back in its place.
Permissions and properties belong to the file
A restored file should behave as before: with the same permissions, the same owner and the same timestamps. Without its NTFS permissions, a file on a file server may suddenly be open to everyone – or to no one. A file backup should therefore include these properties and set them again on restore.
How this works with AegisGrid
AegisGrid searches for a file by name across all restore points, optionally limited to a period, shows every version of a file and compares two restore points. Files are restored to the original location, to a different folder or as a ZIP archive. In the management console you select files and folders with checkboxes. If you prefer to browse, open a restore point as a read-only folder – on Windows and Linux; it disappears by itself after a while without access. On Linux, individual files can also be taken from disk and VM backups. Permissions, owner and times are backed up and restored, on Windows including NTFS permissions.
Frequently asked questions about restoring files
How far back can I restore a file?
As far as the backup's retention reaches. A tiered scheme is common, for example daily restore points for two weeks, weekly ones for a few months and monthly ones for a year or longer. Older restore points are cleaned up according to this rule.
Will the current file be overwritten when restoring?
Only if you restore to the original location and a file with the same name is there. If in doubt, restore the file to a different folder or as a ZIP archive and compare first.
Do I have to restore an entire backup for this?
No. Individual files and folders are taken directly from the chosen restore point without touching the rest of the backup. Because every restore point is complete, no chain of full and incremental backups is needed either.
Files back quickly instead of long searches
In a pilot project we set up the file backup and practise restoring together with you.