What is file-level restore?
File-level restore is the recovery of individual files or folders from a backup, without restoring the entire system they came from. It is the most frequent kind of restore in day-to-day operations, used when a file has been deleted, overwritten or damaged.
How does file-level restore work from an image backup?
When the backup is an image, the backup software mounts the restore point as a virtual disk on a helper machine or mount server. It reads the file system inside the image, presents the folder tree to the operator and copies the chosen items out. Only the blocks that make up those files and the file system's own structures are read from the repository, so a small restore from a large image stays quick.
Where can the files be restored to?
Backup software offers several destinations, each suited to a different situation.
| Destination | When it is used |
|---|---|
| Original location, overwrite | The current file is known to be bad |
| Original location, keep both | The user needs to compare versions |
| Alternate folder or server | Investigation, or the original system is gone |
| Download to the operator | Small items handed over directly |
What limits the speed of a file-level restore?
Three things set the pace. Finding the right restore point takes time when nobody knows when the file was lost, which is where a searchable backup catalog helps. Mounting the image requires random reads from the repository. And restoring very many small files is slower than restoring the same volume as a few large ones, because each file has its own overhead. File restores versus VM restores compares the two operations.
What about permissions and security?
A restored file should carry the access rights it had. Backup software can restore ownership and access control lists along with the data, provided the destination is a compatible file system. Restore itself needs control too. Anyone who can browse backups can read files they may not be entitled to see on the live system, so the right to perform file-level restores should be limited and logged.
Frequently asked questions
Can files be restored from an incremental restore point?
Yes. The software reconstructs the image as of that point from the chain and mounts it like a full.
Is file-level restore possible for Linux and Windows systems alike?
Yes, though mounting some file systems requires a helper appliance that understands them.
How far back can a file be restored?
As far as the oldest restore point still held. Retention sets the limit.