Backup

A 30‑day retention window is a default in many backup scripts and commercial tools. It feels safe: “I’ll keep the last month of data, that’s enough for recovery.” In 2025, a mid‑size clinic used exactly that policy on a set of encrypted LVM snapshots stored on a single NAS. When the NAS firmware update rolled out, the snapshots were corrupted, and the backup system fell back to a restore‑all mode. The result? 2 TB of unencrypted PHI leaked to a rogue process that had gained write access to the backup directory.

Pulling a single file from a Borg backup without unpacking the whole archive is a common task for sysadmins who need quick recovery of a configuration file, a database dump, or a user document.
The following walkthrough shows how to do it safely, efficiently, and with a minimal security footprint.

Why pull a single file?

• Speed – Extracting an entire archive can take minutes or hours on large repositories.
• Disk space – You may not have room to unpack thousands of files.
• Security – Extracting only what you need reduces the attack surface; you avoid exposing the rest of the backup to the current filesystem.
• Automation – Scripts that restore a single file can run in CI/CD pipelines or as part of a systemd timer.

Borg basics recap

Borg is a deduplicating backup program that stores data in a repository.
Each backup is an archive that can contain one or more directories.
The repository can be local or remote (SSH, HTTP, or a network filesystem).
Borg supports strong encryption (repokey, passphrase, or keyfile) and can be configured to use a keyfile stored on the backup host.

Why pull a single file from a Borg archive?

When a configuration file or a database dump is corrupted, you often need only that one file, not the whole archive. Extracting the entire archive just to get a single file wastes bandwidth, CPU, and disk space—especially when the archive lives on a remote server or in a cloud bucket.

Because Borg keeps the archive compressed and deduplicated, the cost of pulling a single file is proportional to the file’s size and the number of blocks it occupies. Below is a quick walk‑through for retrieving a single file efficiently, both locally and remotely, and piping the data through other tools for immediate processing or secure transfer.

When a VPS loses its /etc directory, the system can become unbootable or at least unusable until the configuration files are restored. If you have been running Borg backups (the recommended tool for incremental, deduplicated snapshots) the recovery path is clear: locate the snapshot that contains the last good /etc, extract it, and replace the missing directory. This walkthrough shows the exact commands, trade‑offs, and security checks you should perform on a current 2026 VPS environment.

Extracting a Single File from a Borg Archive Without Recreating the Entire Directory Tree

When a backup archive grows to several terabytes, restoring a single configuration file or a database dump can feel like pulling a needle from a haystack. Borg’s default extract command rebuilds the whole directory tree, which is wasteful when you only need one file. The following guide shows how to pull a single file efficiently, keeps metadata intact, and keeps your system secure.