Restoring from a backup without making it worse
A calm procedure for a stressful moment: assess, restore safely, and verify.
You are here because something broke. Resist the urge to fix it in place first.
Step 0: Stop making changes
Every change after the incident overwrites evidence and may destroy recoverable state. Take a snapshot of the current (broken) state before anything else — sometimes the fastest fix is to find what changed between a working and broken state.
Step 1: Understand what you are restoring
Ask:
What is actually broken — files, database, config, or all three?
What is the most recent good state — and how do you know it was good?
What will restoring cost you — data written since the backup will be lost. For a busy site, that is real.
Step 2: Restore to somewhere safe first
Never restore directly over production as the first move. Restore to a scratch location (a temp directory, a temp database), verify it is what you expect, then swap.
# files
restic restore latest --target /tmp/restore-check --include /var/www
ls -la /tmp/restore-check/var/www # does it look right?
# database to a temp instance
createdb appdb_restore
pg_restore -d appdb_restore /backups/appdb-latest.dump
psql -d appdb_restore -c 'select count(*) from users;'Step 3: Take a safety snapshot of the broken state
So that if the restore is wrong, you can get back to where you were. Snapshot, then restore.
Step 4: Restore and verify
Restore files, then the database (order rarely matters, but be consistent).
Fix permissions and ownership — a restored file tree owned by root will break a service running as
www-data.Clear caches (application, OPcache) so stale data is not served.
Load the site and check the things that matter: login, a key query, an upload.
Step 5: Confirm data currency
Check the newest record in the restored data. If it predates the disaster by more than your intended RPO, your backup job had been failing — investigate that after the service is back.
Step 6: Write down what happened
Brief notes while it is fresh: trigger, timeline, what you restored, what you lost, what to change so it does not recur (a backup alert, a test, a smaller change). Future-you will thank present-you.
Related reading