> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/installed-to-be-wild-privesc-paths-in-windows-apps/restic-backup-utility.md).

# Restic - Backup Utility

## Basics

With restic, we can create a `repository` which is basically the directory where backups will be stored. For this example we'll use restic `0.13.1` and back up the repository in `C:\xampp\htdocs\webapp` in the `E:\restic\` directory.

Restic will check the environment variable `RESTIC_PASSWORD` as the password for the given repository. If unset, the application will ask for the password to initialize the repository and for any other operation in this repository.

{% tabs %}
{% tab title="Init" %}

```powershell
PS C:\htb> restic.exe -r E:\restic init

    Directory: E:\

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----          8/9/2022   2:16 PM                restic
enter password for new repository:
enter password again:
created restic repository fdb2e6dd1d at E:\restic

Please note that knowledge of your password is required to access
the repository. Losing your password means that your data is
irrecoverably lost.
```

{% endtab %}

{% tab title="Backup" %}

```powershell
PS C:\htb> $env:RESTIC_PASSWORD = 'Password'
PS C:\htb> restic.exe -r E:\restic\ backup C:\SampleFolder

repository fdb2e6dd opened successfully, password is correct
created new cache in C:\Users\jeff\AppData\Local\restic
no parent snapshot found, will read all files

Files:           1 new,     0 changed,     0 unmodified
Dirs:            2 new,     0 changed,     0 unmodified
Added to the repo: 927 B

processed 1 files, 22 B in 0:00
snapshot 9971e881 saved
```

{% endtab %}

{% tab title="Create VSS" %}

```powershell
PS C:\htb> restic.exe -r E:\restic\ backup C:\Windows\System32\config --use-fs-snapshot

repository fdb2e6dd opened successfully, password is correct
no parent snapshot found, will read all files
creating VSS snapshot for [c:\]
successfully created snapshot for [c:\]
error: Open: open \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config: Access is denied.

Files:           0 new,     0 changed,     0 unmodified
Dirs:            3 new,     0 changed,     0 unmodified
Added to the repo: 914 B

processed 0 files, 0 B in 0:02
snapshot b0b6f4bb saved
Warning: at least one source file could not be read
```

{% endtab %}

{% tab title="List Backups" %}

```powershell
PS C:\htb> restic.exe -r E:\restic\ snapshots

repository fdb2e6dd opened successfully, password is correct
ID        Time                 Host             Tags        Paths
--------------------------------------------------------------------------------------
9971e881  2022-08-09 14:18:59  PILLAGING-WIN01              C:\SampleFolder
b0b6f4bb  2022-08-09 14:19:41  PILLAGING-WIN01              C:\Windows\System32\config
afba3e9c  2022-08-09 14:35:25  PILLAGING-WIN01              C:\Users\jeff\Documents
--------------------------------------------------------------------------------------
3 snapshots
```

{% endtab %}

{% tab title="Restore" %}

```powershell
PS C:\htb> restic.exe -r E:\restic\ restore 9971e881 --target C:\Restore

repository fdb2e6dd opened successfully, password is correct
restoring <Snapshot 9971e881 of [C:\SampleFolder] at 2022-08-09 14:18:59.4715994 -0700 PDT by PILLAGING-WIN01\jeff@PILLAGING-WIN01> to C:\Restore
```

{% endtab %}
{% endtabs %}

## Resources

* <https://restic.net/>
* <https://github.com/restic/restic/releases/latest>