restic find
restic find is a powerful search engine for your repository. It allows you to search for files by name, pattern, or path across multiple snapshots simultaneously. It is the fastest way to answer the question: "Which backup has that file I deleted last week?"
find is like a global search bar for your backups. Instead of checking snapshots one by one with ls, you can scan the whole history in a single command.
Basic Syntax
restic find [flags] PATTERN [PATTERN...]
Search Examples
# Search for a specific file across all snapshots
restic find report.pdf
# Search for all images in the latest snapshot
restic find --latest 1 "*.jpg"
# Search using case-insensitive patterns
restic find -i "config"
Key Flags
| Flag | Description |
|---|---|
-i or --ignore-case | Perform case-insensitive search |
--latest N | Only search in the last N snapshots |
--host HOSTNAME | Only search in snapshots from a specific host |
--tag TAG | Only search in snapshots with a specific tag |
--path PATH | Only search in snapshots containing a specific path |
--json | Output search results in JSON format |
Practical Examples
1. Finding All Versions of a Document
See exactly when a file changed by finding every snapshot that contains it.
restic find my-thesis.docx
2. Hunting for a Deleted Directory
If you're not sure when a directory disappeared, search all snapshots.
restic find --path /home/user/workspace
3. Searching with Wildcards
Find all log files that were backed up.
restic find "*.log"
find vs ls vs snapshots
| command | goal | scale |
|---|---|---|
snapshots | Find a date | Entire Repository |
ls | Find a file | Single Snapshot |
find | Find a file | Entire History |
Restic searches the metadata (tree structures) inside the repository. On very large repositories with thousands of snapshots, find may take a few moments to complete as it traverses the data structures.
Common Pitfalls
| Pitfall | Consequence | Prevention |
|---|---|---|
| Broad Patterns | Too many results to be useful (e.g., restic find "a"). | Use specific filenames or paths whenever possible. |
| Forgetting Quotes | Bash might try to expand wildcards (like *) locally before sending them to Restic. | Always wrap your patterns in quotes: restic find "*.pdf". |
| Searching the wrong host | No results found because you're searching Server A's backups while only Server B is in the repo. | Use restic snapshots first to verify which hosts are present. |
Examples with Output
1. Simple Filename Search
Command:
restic find invoices.xlsx
Output:
repository a7b2c9d opened successfully, password is correct
Found matching entries in 3 snapshots
-
Snapshot d8f3e2a1 of [/home/user] at 2024-01-10 12:00:00)
/home/user/docs/invoices.xlsx
Snapshot f9e2d1c0 of [/home/user] at 2024-01-11 12:00:00)
/home/user/docs/invoices.xlsx
Snapshot a1b2c3d4 of [/home/user] at 2024-01-12 12:00:00)
/home/user/docs/invoices.xlsx
-
2. Search with Wildcard (Quotes Required)
Command:
restic find "*.conf"
Output:
repository a7b2c9d opened successfully, password is correct
Found matching entries in 1 snapshots
-
Snapshot d8f3e2a1 of [/etc] at 2024-01-15 03:00:00)
/etc/nginx/nginx.conf
/etc/ssh/sshd_config
-
3. Find in Latest Snapshot Only
Command:
restic find --latest 1 "passwd"
Output:
repository a7b2c9d opened successfully, password is correct
Found matching entries in 1 snapshots
-
Snapshot d8f3e2a1 of [/etc] at 2024-01-15 03:00:00)
/etc/passwd
-
4. Case-Insensitive Search
ReadMe.md vs readme.md.
Command:
restic find --ignore-case "readme.md"
Output:
repository a7b2c9d opened successfully, password is correct
Found matching entries in 1 snapshots
-
Snapshot d8f3e2a1 of [/home/src] at 2024-01-15 03:00:00)
/home/src/project/ReadMe.md
-
5. Find Multiple Patterns
Command:
restic find "*.jpg" "*.png"
Output:
repository a7b2c9d opened successfully, password is correct
Found matching entries in 1 snapshots
-
Snapshot d8f3e2a1 of [/var/www] at 2024-01-15 03:00:00)
/var/www/img/logo.png
/var/www/img/banner.jpg
-
What's Next?
Once you've found the file, recover it using restic restore.