Skip to main content

Restore Procedures

This page covers all restore scenarios for both endpoint backup and SaaS backup. Follow the appropriate procedure for your situation.

Restoring a File or Folder to the Original Location​

Use this when a file was accidentally deleted or corrupted and you want it back in its original path.

  1. Go to Backups console → Catalog
  2. Select the device
  3. Select the backup snapshot to restore from (the most recent snapshot is pre-selected)
  4. Navigate the file tree to find the file or folder
  5. Click Restore → Restore to Original Location
  6. Confirm — the restore job is queued

The agent downloads the file from backup storage and writes it to the original path. If a file with the same name exists at the destination, it is renamed with a .bak suffix before the restored version is written.

ℹ️The device must be online and the agent must be running for restore to original location. If the device is offline, use restore to alternate location or download instead.

Restoring a File or Folder to an Alternate Location​

Use this when the original device is unavailable, or when you want to verify the file before placing it back in production.

  1. Go to Catalog → select the device and snapshot
  2. Navigate to the file or folder
  3. Click Restore → Restore to Alternate Location
  4. Choose:
    • Target Device — The device to restore to (can be the same device or a different enrolled device)
    • Target Path — The destination directory on the target device
  5. Confirm — the restore job runs and delivers the file to the target device

Point-in-Time Restore​

Restore a specific version of a file from any backup timestamp within the retention window.

  1. Go to Catalog → select the device
  2. Click All Versions on a file to see its complete version history
  3. Select the version you want (versions are listed with timestamp, file size, and change type)
  4. Click Restore and choose original or alternate location

The version history shows every incremental change captured. If a file was modified 12 times in the past week, you have 12 distinct versions to choose from.

Bare Metal Restore​

Bare metal restore (BMR) recovers a complete system — OS, installed applications, settings, and data — to a physical or virtual machine. This is used when a server fails completely or needs to be rebuilt from scratch.

ℹ️Bare metal restore requires a full_image source in the backup policy. File-only policies cannot perform BMR.

Prepare Boot Media​

  1. Go to Catalog → select the device
  2. Click Create Boot Media — downloads a WinPE ISO (Windows) or bootable Linux environment (Linux)
  3. Write the ISO to a USB drive using Rufus, Balena Etcher, or your imaging tool of choice
  4. Alternatively, mount the ISO to a VM for virtual machine recovery

Execute BMR​

  1. Boot the target machine from the boot media
  2. The restore environment connects to the Backups API using the device's stored credentials
  3. Select the backup snapshot to restore from
  4. Select the target disk
  5. Confirm — the full image is downloaded and written to the target disk
  6. Remove the boot media and reboot

BMR restore time depends on the image size and network speed. A 100 GB image at 100 Mbps takes approximately 2.5–3 hours.

Cross-Device Restore​

Restore data from one device to a different enrolled device — useful when a device is replaced (hardware failure, upgrade, theft).

  1. Go to Catalog → select the source device (the original device whose backup you want)
  2. Navigate to the file or folder
  3. Click Restore → Restore to Alternate Location
  4. Set Target Device to the new device
  5. Set the target path
  6. Confirm

The agent on the target device receives the restore job and downloads the data from backup storage. The source device does not need to be online.

Restore Verification​

After any restore, confirm the data is intact:

  1. Open the restored file and verify its contents
  2. For folder restores, spot-check several files
  3. For database or application data restores, start the application and confirm it functions
  4. Mark the restore job as Verified in the Backups console to close the restore ticket

SaaS Item Restore — Single Email, File, or Event​

Restore a single item from a SaaS backup (M365 or Google Workspace).

  1. Go to SaaS → select the connection
  2. Click Browse
  3. Select the user whose data you want to restore
  4. Navigate to the service (Exchange, OneDrive, SharePoint, Calendar, etc.)
  5. Find the item — use the search bar to filter by name, subject, or date
  6. Click Restore → Restore to Original Location
    • For Exchange: the email is re-created in the user's mailbox (in the original folder if it still exists)
    • For OneDrive/Drive: the file is re-created at its original path
    • For Calendar: the event is re-created in the user's calendar

Alternatively, click Download to get the item as a file (.eml for email, original format for files, .ics for calendar events).

SaaS Bulk Restore — Full User Restore​

Restore all backed-up data for a user. Used when an account is deleted, wiped, or ransomware-encrypted.

  1. Go to SaaS → select the connection → Browse
  2. Select the user
  3. Click Restore All
  4. Select the backup snapshot date (choose the most recent clean backup)
  5. Confirm — the bulk restore job is queued

Bulk restore creates all items in the live account. Existing items with the same ID are not overwritten — the restored items are created alongside them with a restoration suffix if needed.

ℹ️Bulk restore for a large M365 mailbox (50,000+ emails, 30GB+) can take 4–8 hours due to Microsoft Graph API rate limiting. The restore runs as a background job — you will receive a completion notification when it finishes.

Restore Data Integrity​

Every restore job verifies the integrity of downloaded backup data:

  • Hash verification — Each file's SHA-256 hash is checked against the catalog entry before delivery
  • Encryption verification — AES-256-GCM authentication tag is validated during decryption; any tampered block fails the restore
  • Restore job log — The console records each file restored, its hash, and the outcome (success/failure/skipped)

If the integrity check fails for any file during a restore, the file is flagged in the restore log and the restore continues for remaining files. You will see a summary of failed files at the end of the job.