Recover from bitrotted snapshots

[enboig]

I recently moved my image gallery from a mdadm raid to raidz.

I have a script to backup "just the important files", but to ease my task I made another snapshot with all files (new one, no parent used) and restored it.

Then I restored the image gallery and compared folders, expecting to miss only thumnails, an cache files, but lot of images files, besides having same size, had different checksums.

Both snapshots are from the same day, so I belive the snapshot with old parent is correcte because corrupter files where not upload again. Is this the case?

As I was playing with rustic, changing path created "new packs of snapshots", so if I restore latest snapshot from each pack, starting from the latest pack, and overwrite it with the latest snapshot from prevoius pack, I should overwrite corrupted files with uncorrupted versions; does it sound logic?

rustic restore 309e9f58:/mnt/md0/docker/immich /fitxers/immich # first snapshot: 2025-10-17 15:22:24 | last snapshot: 2025-10-17 21:28:30 | id: 309e9f58
rustic restore aaa00f77:/mnt/md0/docker/immich /fitxers/immich # first snapshot: 2025-10-10 12:44:56 | last snapshot: 2025-10-14 14:20:04 | id: aaa00f77
rustic restore 238075ca:/mnt/md0/docker/immich /fitxers/immich # first snapshot: 2024-08-07 16:09:15 | last snapshot: 2024-08-08 16:35:30 | id: 238075ca
rustic restore 685b0013:/mnt/md0/docker/immich /fitxers/immich # first snapshot: 2025-09-23 12:49:45 | last snapshot: 2025-10-07 08:02:09 | id: 685b0013
rustic restore f6d79598:/mnt/md0/docker/immich /fitxers/immich # first snapshot: 2025-07-31 05:02:04 | last snapshot: 2025-09-22 08:06:03 | id: f6d79598

[aawsome]

@enboig

Sorry, I didn't fully get what was bitrotted. Am I right that you are talking about source(s) you backup'ed into a rustic repo and in the source you are discovering bitrot?

Now, in this case, what's in the repository? There are two cases:

• if you run backup and a file is new or changed w.r.t. the parent - or if there is no parent snapshot used - the file is read and that data is referenced in the snapshot
• if you run backup and a file is not changed w.r.t. the parent (note that this depends on change-detection options, but a file, which got bitrot between the parent and the current backup, typically will be detected as not changed) it will not be read, but the data of the parent is referenced in the snapshot.

So, depending on when your file was created, when you ran backup and which parents you used, you may have one of the three situations:

1. you only have the already bitrotted content referenced in all snapshots
2. you have the original content referenced in some snapshots followed by the bitrotted content in other snapshots
3. you have the original content referenced in all snapshots

In case 1), there is nothing you can do, sorry... For case 2) you can try to identify where a file was changed using rustic diff with two snapshots. But note, this will also show you "normal" changes of files.
In case 3), you can use rustic diff --only-identical to diff a snapshot with the local contents. This will you only show results with changed contents, but identical metadata. These are usually only bitrotted files.

[enboig]

It seems snapshots were ok, restoration was failing. #1592