Merge pull request #4838 from MichaelEischer/restore-skip-unchanged

restore: skip unchanged files and add `--overwrite if-changed` option

changelog/unreleased/issue-4817

@@ -1,11 +1,22 @@
 Enhancement: Make overwrite behavior of `restore` customizable
 
 The `restore` command now supports an `--overwrite` option to configure whether
-already existing files are overwritten. The default is `--overwrite always`,
+already existing files are overwritten. This behavior can now be configured via
-which overwrites existing files. `--overwrite if-newer` only restores files
+the `--overwrite` option. The following values are supported:
-from the snapshot that are newer than the local state. And `--overwrite never`
+
-does not modify existing files.
+* `--overwrite always` (default): always overwrites already existing files. `restore`
+  will verify the existing file content and only restore mismatching parts to minimize
+  downloads. Updates the metadata of all files.
+* `--overwrite if-changed`: like the previous case, but speeds up the file content check
+  by assuming that files with matching size and modification time (mtime) are already up to date.
+  In case of a mismatch, the full file content is verified. Updates the metadata of all files.
+* `--overwrite if-newer`: only overwrite existing files if the file in the snapshot has a
+  newer modification time (mtime).
+* `--overwrite never`: never overwrite existing files.
 
 https://github.com/restic/restic/issues/4817
 https://github.com/restic/restic/issues/200
+https://github.com/restic/restic/issues/407
+https://github.com/restic/restic/issues/2662
 https://github.com/restic/restic/pull/4837
+https://github.com/restic/restic/pull/4838

cmd/restic/cmd_restore.go

@@ -66,7 +66,7 @@ func init() {
 	initSingleSnapshotFilter(flags, &restoreOptions.SnapshotFilter)
 	flags.BoolVar(&restoreOptions.Sparse, "sparse", false, "restore files as sparse")
 	flags.BoolVar(&restoreOptions.Verify, "verify", false, "verify restored files content")
-	flags.Var(&restoreOptions.Overwrite, "overwrite", "overwrite behavior, one of (always|if-newer|never) (default: always)")
+	flags.Var(&restoreOptions.Overwrite, "overwrite", "overwrite behavior, one of (always|if-changed|if-newer|never) (default: always)")
 }
 
 func runRestore(ctx context.Context, opts RestoreOptions, gopts GlobalOptions,

doc/050_restore.rst

@@ -91,11 +91,26 @@ stored explicitly.
 Restoring in-place
 ------------------
 
-By default, the ``restore`` command overwrites already existing files in the target
+.. note::
-directory. This behavior can be configured via the ``--overwrite`` option. The
+
-default is ``--overwrite always``. To only overwrite existing files if the file in
+    Restoring data in-place can leave files in a partially restored state if the ``restore``
-the snapshot is newer, use ``--overwrite if-newer``. To never overwrite existing files,
+    operation is interrupted. To ensure you can revert back to the previous state, create
-use ``--overwrite never``.
+    a current ``backup`` before restoring a different snapshot.
+
+By default, the ``restore`` command overwrites already existing files at the target
+directory. This behavior can be configured via the ``--overwrite`` option. The following
+values are supported:
+
+* ``--overwrite always`` (default): always overwrites already existing files. ``restore``
+  will verify the existing file content and only restore mismatching parts to minimize
+  downloads. Updates the metadata of all files.
+* ``--overwrite if-changed``: like the previous case, but speeds up the file content check
+  by assuming that files with matching size and modification time (mtime) are already up to date.
+  In case of a mismatch, the full file content is verified. Updates the metadata of all files.
+* ``--overwrite if-newer``: only overwrite existing files if the file in the snapshot has a
+  newer modification time (mtime).
+* ``--overwrite never``: never overwrite existing files.
+
 
 Restore using mount
 ===================

internal/restic/node_windows.go

@@ -275,17 +275,20 @@ func fixEncryptionAttribute(path string, attrs *uint32, pathPointer *uint16) (er
 		// File should be encrypted.
 		err = encryptFile(pathPointer)
 		if err != nil {
-			if fs.IsAccessDenied(err) {
+			if fs.IsAccessDenied(err) || errors.Is(err, windows.ERROR_FILE_READ_ONLY) {
 				// If existing file already has readonly or system flag, encrypt file call fails.
-				// We have already cleared readonly flag, clearing system flag if needed.
 				// The readonly and system flags will be set again at the end of this func if they are needed.
+				err = fs.ResetPermissions(path)
+				if err != nil {
+					return fmt.Errorf("failed to encrypt file: failed to reset permissions: %s : %v", path, err)
+				}
 				err = fs.ClearSystem(path)
 				if err != nil {
 					return fmt.Errorf("failed to encrypt file: failed to clear system flag: %s : %v", path, err)
 				}
 				err = encryptFile(pathPointer)
 				if err != nil {
-					return fmt.Errorf("failed to encrypt file: %s : %v", path, err)
+					return fmt.Errorf("failed retry to encrypt file: %s : %v", path, err)
 				}
 			} else {
 				return fmt.Errorf("failed to encrypt file: %s : %v", path, err)
@@ -300,17 +303,20 @@ func fixEncryptionAttribute(path string, attrs *uint32, pathPointer *uint16) (er
 			// File should not be encrypted, but its already encrypted. Decrypt it.
 			err = decryptFile(pathPointer)
 			if err != nil {
-				if fs.IsAccessDenied(err) {
+				if fs.IsAccessDenied(err) || errors.Is(err, windows.ERROR_FILE_READ_ONLY) {
 					// If existing file already has readonly or system flag, decrypt file call fails.
-					// We have already cleared readonly flag, clearing system flag if needed.
 					// The readonly and system flags will be set again after this func if they are needed.
+					err = fs.ResetPermissions(path)
+					if err != nil {
+						return fmt.Errorf("failed to encrypt file: failed to reset permissions: %s : %v", path, err)
+					}
 					err = fs.ClearSystem(path)
 					if err != nil {
 						return fmt.Errorf("failed to decrypt file: failed to clear system flag: %s : %v", path, err)
 					}
 					err = decryptFile(pathPointer)
 					if err != nil {
-						return fmt.Errorf("failed to decrypt file: %s : %v", path, err)
+						return fmt.Errorf("failed retry to decrypt file: %s : %v", path, err)
 					}
 				} else {
 					return fmt.Errorf("failed to decrypt file: %s : %v", path, err)

internal/restorer/filerestorer.go

@@ -26,6 +26,7 @@ type fileInfo struct {
 	size       int64
 	location   string      // file on local filesystem relative to restorer basedir
 	blobs      interface{} // blobs of the file
+	state      *fileState
 }
 
 type fileBlobInfo struct {
@@ -80,25 +81,25 @@ func newFileRestorer(dst string,
 	}
 }
 
-func (r *fileRestorer) addFile(location string, content restic.IDs, size int64) {
+func (r *fileRestorer) addFile(location string, content restic.IDs, size int64, state *fileState) {
-	r.files = append(r.files, &fileInfo{location: location, blobs: content, size: size})
+	r.files = append(r.files, &fileInfo{location: location, blobs: content, size: size, state: state})
 }
 
 func (r *fileRestorer) targetPath(location string) string {
 	return filepath.Join(r.dst, location)
 }
 
-func (r *fileRestorer) forEachBlob(blobIDs []restic.ID, fn func(packID restic.ID, packBlob restic.Blob)) error {
+func (r *fileRestorer) forEachBlob(blobIDs []restic.ID, fn func(packID restic.ID, packBlob restic.Blob, idx int)) error {
 	if len(blobIDs) == 0 {
 		return nil
 	}
 
-	for _, blobID := range blobIDs {
+	for i, blobID := range blobIDs {
 		packs := r.idx(restic.DataBlob, blobID)
 		if len(packs) == 0 {
 			return errors.Errorf("Unknown blob %s", blobID.String())
 		}
-		fn(packs[0].PackID, packs[0].Blob)
+		fn(packs[0].PackID, packs[0].Blob, i)
 	}
 
 	return nil
@@ -128,8 +129,8 @@ func (r *fileRestorer) restoreFiles(ctx context.Context) error {
 			packsMap = make(map[restic.ID][]fileBlobInfo)
 		}
 		fileOffset := int64(0)
-		err := r.forEachBlob(fileBlobs, func(packID restic.ID, blob restic.Blob) {
+		err := r.forEachBlob(fileBlobs, func(packID restic.ID, blob restic.Blob, idx int) {
-			if largeFile {
+			if largeFile && !file.state.HasMatchingBlob(idx) {
 				packsMap[packID] = append(packsMap[packID], fileBlobInfo{id: blob.ID, offset: fileOffset})
 				fileOffset += int64(blob.DataLength())
 			}
@@ -152,6 +153,12 @@ func (r *fileRestorer) restoreFiles(ctx context.Context) error {
 			// in addition, a short chunk will never match r.zeroChunk which would prevent sparseness for short files
 			file.sparse = r.sparse
 		}
+		if file.state != nil {
+			// The restorer currently cannot punch new holes into an existing files.
+			// Thus sections that contained data but should be sparse after restoring
+			// the snapshot would still contain the old data resulting in a corrupt restore.
+			file.sparse = false
+		}
 
 		if err != nil {
 			// repository index is messed up, can't do anything
@@ -232,8 +239,8 @@ func (r *fileRestorer) downloadPack(ctx context.Context, pack *packInfo) error {
 		}
 		if fileBlobs, ok := file.blobs.(restic.IDs); ok {
 			fileOffset := int64(0)
-			err := r.forEachBlob(fileBlobs, func(packID restic.ID, blob restic.Blob) {
+			err := r.forEachBlob(fileBlobs, func(packID restic.ID, blob restic.Blob, idx int) {
-				if packID.Equal(pack.id) {
+				if packID.Equal(pack.id) && !file.state.HasMatchingBlob(idx) {
 					addBlob(blob, fileOffset)
 				}
 				fileOffset += int64(blob.DataLength())

internal/restorer/fileswriter.go

@@ -40,9 +40,8 @@ func newFilesWriter(count int) *filesWriter {
 }
 
 func createFile(path string, createSize int64, sparse bool) (*os.File, error) {
-	var f *os.File
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0600)
-	var err error
+	if err != nil {
-	if f, err = os.OpenFile(path, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600); err != nil {
 		if !fs.IsAccessDenied(err) {
 			return nil, err
 		}
@@ -54,19 +53,31 @@ func createFile(path string, createSize int64, sparse bool) (*os.File, error) {
 		if err = fs.ResetPermissions(path); err != nil {
 			return nil, err
 		}
-		if f, err = os.OpenFile(path, os.O_TRUNC|os.O_WRONLY, 0600); err != nil {
+		if f, err = os.OpenFile(path, os.O_WRONLY, 0600); err != nil {
 			return nil, err
 		}
 	}
 
-	if createSize > 0 {
+	if sparse {
-		if sparse {
+		err = truncateSparse(f, createSize)
-			err = truncateSparse(f, createSize)
+		if err != nil {
+			_ = f.Close()
+			return nil, err
+		}
+	} else {
+		info, err := f.Stat()
+		if err != nil {
+			_ = f.Close()
+			return nil, err
+		}
+		if info.Size() > createSize {
+			// file is too long must shorten it
+			err = f.Truncate(createSize)
 			if err != nil {
 				_ = f.Close()
 				return nil, err
 			}
-		} else {
+		} else if createSize > 0 {
 			err := fs.PreallocateFile(f, createSize)
 			if err != nil {
 				// Just log the preallocate error but don't let it cause the restore process to fail.
@@ -78,7 +89,7 @@ func createFile(path string, createSize int64, sparse bool) (*os.File, error) {
 			}
 		}
 	}
-	return f, err
+	return f, nil
 }
 
 func (w *filesWriter) writeToFile(path string, blob []byte, offset int64, createSize int64, sparse bool) error {

internal/restorer/restorer.go

@@ -3,6 +3,7 @@ package restorer
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"sync/atomic"
@@ -18,13 +19,11 @@ import (
 
 // Restorer is used to restore a snapshot to a directory.
 type Restorer struct {
-	repo      restic.Repository
+	repo restic.Repository
-	sn        *restic.Snapshot
+	sn   *restic.Snapshot
-	sparse    bool
+	opts Options
-	progress  *restoreui.Progress
-	overwrite OverwriteBehavior
 
-	fileList map[string]struct{}
+	fileList map[string]bool
 
 	Error        func(location string, err error) error
 	Warn         func(message string)
@@ -43,10 +42,13 @@ type OverwriteBehavior int
 
 // Constants for different overwrite behavior
 const (
-	OverwriteAlways  OverwriteBehavior = 0
+	OverwriteAlways OverwriteBehavior = iota
-	OverwriteIfNewer OverwriteBehavior = 1
+	// OverwriteIfChanged is like OverwriteAlways except that it skips restoring the content
-	OverwriteNever   OverwriteBehavior = 2
+	// of files with matching size&mtime. Metatdata is always restored.
-	OverwriteInvalid OverwriteBehavior = 3
+	OverwriteIfChanged
+	OverwriteIfNewer
+	OverwriteNever
+	OverwriteInvalid
 )
 
 // Set implements the method needed for pflag command flag parsing.
@@ -54,6 +56,8 @@ func (c *OverwriteBehavior) Set(s string) error {
 	switch s {
 	case "always":
 		*c = OverwriteAlways
+	case "if-changed":
+		*c = OverwriteIfChanged
 	case "if-newer":
 		*c = OverwriteIfNewer
 	case "never":
@@ -70,6 +74,8 @@ func (c *OverwriteBehavior) String() string {
 	switch *c {
 	case OverwriteAlways:
 		return "always"
+	case OverwriteIfChanged:
+		return "if-changed"
 	case OverwriteIfNewer:
 		return "if-newer"
 	case OverwriteNever:
@@ -87,10 +93,8 @@ func (c *OverwriteBehavior) Type() string {
 func NewRestorer(repo restic.Repository, sn *restic.Snapshot, opts Options) *Restorer {
 	r := &Restorer{
 		repo:         repo,
-		sparse:       opts.Sparse,
+		opts:         opts,
-		progress:     opts.Progress,
+		fileList:     make(map[string]bool),
-		overwrite:    opts.Overwrite,
-		fileList:     make(map[string]struct{}),
 		Error:        restorerAbortOnAllErrors,
 		SelectFilter: func(string, string, *restic.Node) (bool, bool) { return true, true },
 		sn:           sn,
@@ -224,7 +228,7 @@ func (res *Restorer) restoreNodeTo(ctx context.Context, node *restic.Node, targe
 		return err
 	}
 
-	res.progress.AddProgress(location, 0, 0)
+	res.opts.Progress.AddProgress(location, 0, 0)
 	return res.restoreNodeMetadataTo(node, target, location)
 }
 
@@ -246,7 +250,7 @@ func (res *Restorer) restoreHardlinkAt(node *restic.Node, target, path, location
 		return errors.WithStack(err)
 	}
 
-	res.progress.AddProgress(location, 0, 0)
+	res.opts.Progress.AddProgress(location, 0, 0)
 
 	// TODO investigate if hardlinks have separate metadata on any supported system
 	return res.restoreNodeMetadataTo(node, path, location)
@@ -265,16 +269,18 @@ func (res *Restorer) RestoreTo(ctx context.Context, dst string) error {
 
 	idx := NewHardlinkIndex[string]()
 	filerestorer := newFileRestorer(dst, res.repo.LoadBlobsFromPack, res.repo.LookupBlob,
-		res.repo.Connections(), res.sparse, res.progress)
+		res.repo.Connections(), res.opts.Sparse, res.opts.Progress)
 	filerestorer.Error = res.Error
 
 	debug.Log("first pass for %q", dst)
 
+	var buf []byte
+
 	// first tree pass: create directories and collect all files to restore
 	_, err = res.traverseTree(ctx, dst, string(filepath.Separator), *res.sn.Tree, treeVisitor{
 		enterDir: func(_ *restic.Node, target, location string) error {
 			debug.Log("first pass, enterDir: mkdir %q, leaveDir should restore metadata", location)
-			res.progress.AddFile(0)
+			res.opts.Progress.AddFile(0)
 			// create dir with default permissions
 			// #leaveDir restores dir metadata after visiting all children
 			return fs.MkdirAll(target, 0700)
@@ -290,25 +296,30 @@ func (res *Restorer) RestoreTo(ctx context.Context, dst string) error {
 			}
 
 			if node.Type != "file" {
-				res.progress.AddFile(0)
+				res.opts.Progress.AddFile(0)
 				return nil
 			}
 
 			if node.Links > 1 {
 				if idx.Has(node.Inode, node.DeviceID) {
 					// a hardlinked file does not increase the restore size
-					res.progress.AddFile(0)
+					res.opts.Progress.AddFile(0)
 					return nil
 				}
 				idx.Add(node.Inode, node.DeviceID, location)
 			}
 
-			return res.withOverwriteCheck(node, target, false, func() error {
+			buf, err = res.withOverwriteCheck(node, target, false, buf, func(updateMetadataOnly bool, matches *fileState) error {
-				res.progress.AddFile(node.Size)
+				if updateMetadataOnly {
-				filerestorer.addFile(location, node.Content, int64(node.Size))
+					res.opts.Progress.AddSkippedFile(node.Size)
-				res.trackFile(location)
+				} else {
+					res.opts.Progress.AddFile(node.Size)
+					filerestorer.addFile(location, node.Content, int64(node.Size), matches)
+				}
+				res.trackFile(location, updateMetadataOnly)
 				return nil
 			})
+			return err
 		},
 	})
 	if err != nil {
@@ -327,18 +338,20 @@ func (res *Restorer) RestoreTo(ctx context.Context, dst string) error {
 		visitNode: func(node *restic.Node, target, location string) error {
 			debug.Log("second pass, visitNode: restore node %q", location)
 			if node.Type != "file" {
-				return res.withOverwriteCheck(node, target, false, func() error {
+				_, err := res.withOverwriteCheck(node, target, false, nil, func(_ bool, _ *fileState) error {
 					return res.restoreNodeTo(ctx, node, target, location)
 				})
+				return err
 			}
 
 			if idx.Has(node.Inode, node.DeviceID) && idx.Value(node.Inode, node.DeviceID) != location {
-				return res.withOverwriteCheck(node, target, true, func() error {
+				_, err := res.withOverwriteCheck(node, target, true, nil, func(_ bool, _ *fileState) error {
 					return res.restoreHardlinkAt(node, filerestorer.targetPath(idx.Value(node.Inode, node.DeviceID)), target, location)
 				})
+				return err
 			}
 
-			if res.hasRestoredFile(location) {
+			if _, ok := res.hasRestoredFile(location); ok {
 				return res.restoreNodeMetadataTo(node, target, location)
 			}
 			// don't touch skipped files
@@ -347,7 +360,7 @@ func (res *Restorer) RestoreTo(ctx context.Context, dst string) error {
 		leaveDir: func(node *restic.Node, target, location string) error {
 			err := res.restoreNodeMetadataTo(node, target, location)
 			if err == nil {
-				res.progress.AddProgress(location, 0, 0)
+				res.opts.Progress.AddProgress(location, 0, 0)
 			}
 			return err
 		},
@@ -355,32 +368,42 @@ func (res *Restorer) RestoreTo(ctx context.Context, dst string) error {
 	return err
 }
 
-func (res *Restorer) trackFile(location string) {
+func (res *Restorer) trackFile(location string, metadataOnly bool) {
-	res.fileList[location] = struct{}{}
+	res.fileList[location] = metadataOnly
 }
 
-func (res *Restorer) hasRestoredFile(location string) bool {
+func (res *Restorer) hasRestoredFile(location string) (metadataOnly bool, ok bool) {
-	_, ok := res.fileList[location]
+	metadataOnly, ok = res.fileList[location]
-	return ok
+	return metadataOnly, ok
 }
 
-func (res *Restorer) withOverwriteCheck(node *restic.Node, target string, isHardlink bool, cb func() error) error {
+func (res *Restorer) withOverwriteCheck(node *restic.Node, target string, isHardlink bool, buf []byte, cb func(updateMetadataOnly bool, matches *fileState) error) ([]byte, error) {
-	overwrite, err := shouldOverwrite(res.overwrite, node, target)
+	overwrite, err := shouldOverwrite(res.opts.Overwrite, node, target)
 	if err != nil {
-		return err
+		return buf, err
 	} else if !overwrite {
 		size := node.Size
 		if isHardlink {
 			size = 0
 		}
-		res.progress.AddSkippedFile(size)
+		res.opts.Progress.AddSkippedFile(size)
-		return nil
+		return buf, nil
 	}
-	return cb()
+
+	var matches *fileState
+	updateMetadataOnly := false
+	if node.Type == "file" && !isHardlink {
+		// if a file fails to verify, then matches is nil which results in restoring from scratch
+		matches, buf, _ = res.verifyFile(target, node, false, res.opts.Overwrite == OverwriteIfChanged, buf)
+		// skip files that are already correct completely
+		updateMetadataOnly = !matches.NeedsRestore()
+	}
+
+	return buf, cb(updateMetadataOnly, matches)
 }
 
 func shouldOverwrite(overwrite OverwriteBehavior, node *restic.Node, destination string) (bool, error) {
-	if overwrite == OverwriteAlways {
+	if overwrite == OverwriteAlways || overwrite == OverwriteIfChanged {
 		return true, nil
 	}
 
@@ -433,7 +456,10 @@ func (res *Restorer) VerifyFiles(ctx context.Context, dst string) (int, error) {
 
 		_, err := res.traverseTree(ctx, dst, string(filepath.Separator), *res.sn.Tree, treeVisitor{
 			visitNode: func(node *restic.Node, target, location string) error {
-				if node.Type != "file" || !res.hasRestoredFile(location) {
+				if node.Type != "file" {
+					return nil
+				}
+				if metadataOnly, ok := res.hasRestoredFile(location); !ok || metadataOnly {
 					return nil
 				}
 				select {
@@ -451,7 +477,7 @@ func (res *Restorer) VerifyFiles(ctx context.Context, dst string) (int, error) {
 		g.Go(func() (err error) {
 			var buf []byte
 			for job := range work {
-				buf, err = res.verifyFile(job.path, job.node, buf)
+				_, buf, err = res.verifyFile(job.path, job.node, true, false, buf)
 				if err != nil {
 					err = res.Error(job.path, err)
 				}
@@ -467,34 +493,72 @@ func (res *Restorer) VerifyFiles(ctx context.Context, dst string) (int, error) {
 	return int(nchecked), g.Wait()
 }
 
+type fileState struct {
+	blobMatches []bool
+	sizeMatches bool
+}
+
+func (s *fileState) NeedsRestore() bool {
+	if s == nil {
+		return true
+	}
+	if !s.sizeMatches {
+		return true
+	}
+	for _, match := range s.blobMatches {
+		if !match {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *fileState) HasMatchingBlob(i int) bool {
+	if s == nil || s.blobMatches == nil {
+		return false
+	}
+	return i < len(s.blobMatches) && s.blobMatches[i]
+}
+
 // Verify that the file target has the contents of node.
 //
 // buf and the first return value are scratch space, passed around for reuse.
 // Reusing buffers prevents the verifier goroutines allocating all of RAM and
 // flushing the filesystem cache (at least on Linux).
-func (res *Restorer) verifyFile(target string, node *restic.Node, buf []byte) ([]byte, error) {
+func (res *Restorer) verifyFile(target string, node *restic.Node, failFast bool, trustMtime bool, buf []byte) (*fileState, []byte, error) {
-	f, err := os.Open(target)
+	f, err := os.OpenFile(target, fs.O_RDONLY|fs.O_NOFOLLOW, 0)
 	if err != nil {
-		return buf, err
+		return nil, buf, err
 	}
 	defer func() {
 		_ = f.Close()
 	}()
 
 	fi, err := f.Stat()
+	sizeMatches := true
 	switch {
 	case err != nil:
-		return buf, err
+		return nil, buf, err
+	case !fi.Mode().IsRegular():
+		return nil, buf, errors.Errorf("Expected %s to be a regular file", target)
 	case int64(node.Size) != fi.Size():
-		return buf, errors.Errorf("Invalid file size for %s: expected %d, got %d",
+		if failFast {
-			target, node.Size, fi.Size())
+			return nil, buf, errors.Errorf("Invalid file size for %s: expected %d, got %d",
+				target, node.Size, fi.Size())
+		}
+		sizeMatches = false
 	}
 
+	if trustMtime && fi.ModTime().Equal(node.ModTime) && sizeMatches {
+		return &fileState{nil, sizeMatches}, buf, nil
+	}
+
+	matches := make([]bool, len(node.Content))
 	var offset int64
-	for _, blobID := range node.Content {
+	for i, blobID := range node.Content {
 		length, found := res.repo.LookupBlobSize(restic.DataBlob, blobID)
 		if !found {
-			return buf, errors.Errorf("Unable to fetch blob %s", blobID)
+			return nil, buf, errors.Errorf("Unable to fetch blob %s", blobID)
 		}
 
 		if length > uint(cap(buf)) {
@@ -503,16 +567,21 @@ func (res *Restorer) verifyFile(target string, node *restic.Node, buf []byte) ([
 		buf = buf[:length]
 
 		_, err = f.ReadAt(buf, offset)
-		if err != nil {
+		if err == io.EOF && !failFast {
-			return buf, err
+			sizeMatches = false
+			break
 		}
-		if !blobID.Equal(restic.Hash(buf)) {
+		if err != nil {
-			return buf, errors.Errorf(
+			return nil, buf, err
+		}
+		matches[i] = blobID.Equal(restic.Hash(buf))
+		if failFast && !matches[i] {
+			return nil, buf, errors.Errorf(
 				"Unexpected content in %s, starting at offset %d",
 				target, offset)
 		}
 		offset += int64(length)
 	}
 
-	return buf, nil
+	return &fileState{matches, sizeMatches}, buf, nil
 }

internal/restorer/restorer_test.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -894,6 +895,44 @@ func TestRestorerSparseFiles(t *testing.T) {
 		len(zeros), blocks, 100*sparsity)
 }
 
+func TestRestorerSparseOverwrite(t *testing.T) {
+	baseSnapshot := Snapshot{
+		Nodes: map[string]Node{
+			"foo": File{Data: "content: new\n"},
+		},
+	}
+	var zero [14]byte
+	sparseSnapshot := Snapshot{
+		Nodes: map[string]Node{
+			"foo": File{Data: string(zero[:])},
+		},
+	}
+
+	repo := repository.TestRepository(t)
+	tempdir := filepath.Join(rtest.TempDir(t), "target")
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// base snapshot
+	sn, id := saveSnapshot(t, repo, baseSnapshot, noopGetGenericAttributes)
+	t.Logf("base snapshot saved as %v", id.Str())
+
+	res := NewRestorer(repo, sn, Options{Sparse: true})
+	err := res.RestoreTo(ctx, tempdir)
+	rtest.OK(t, err)
+
+	// sparse snapshot
+	sn, id = saveSnapshot(t, repo, sparseSnapshot, noopGetGenericAttributes)
+	t.Logf("base snapshot saved as %v", id.Str())
+
+	res = NewRestorer(repo, sn, Options{Sparse: true, Overwrite: OverwriteAlways})
+	err = res.RestoreTo(ctx, tempdir)
+	rtest.OK(t, err)
+	files, err := res.VerifyFiles(ctx, tempdir)
+	rtest.OK(t, err)
+	rtest.Equals(t, 1, files, "unexpected number of verified files")
+}
+
 func TestRestorerOverwriteBehavior(t *testing.T) {
 	baseTime := time.Now()
 	baseSnapshot := Snapshot{
@@ -929,6 +968,13 @@ func TestRestorerOverwriteBehavior(t *testing.T) {
 				"dirtest/file": "content: file2\n",
 			},
 		},
+		{
+			Overwrite: OverwriteIfChanged,
+			Files: map[string]string{
+				"foo":          "content: new\n",
+				"dirtest/file": "content: file2\n",
+			},
+		},
 		{
 			Overwrite: OverwriteIfNewer,
 			Files: map[string]string{
@@ -982,3 +1028,88 @@ func TestRestorerOverwriteBehavior(t *testing.T) {
 		})
 	}
 }
+
+func TestRestoreModified(t *testing.T) {
+	// overwrite files between snapshots and also change their filesize
+	snapshots := []Snapshot{
+		{
+			Nodes: map[string]Node{
+				"foo": File{Data: "content: foo\n", ModTime: time.Now()},
+				"bar": File{Data: "content: a\n", ModTime: time.Now()},
+			},
+		},
+		{
+			Nodes: map[string]Node{
+				"foo": File{Data: "content: a\n", ModTime: time.Now()},
+				"bar": File{Data: "content: bar\n", ModTime: time.Now()},
+			},
+		},
+	}
+
+	repo := repository.TestRepository(t)
+	tempdir := filepath.Join(rtest.TempDir(t), "target")
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	for _, snapshot := range snapshots {
+		sn, id := saveSnapshot(t, repo, snapshot, noopGetGenericAttributes)
+		t.Logf("snapshot saved as %v", id.Str())
+
+		res := NewRestorer(repo, sn, Options{Overwrite: OverwriteIfChanged})
+		rtest.OK(t, res.RestoreTo(ctx, tempdir))
+		n, err := res.VerifyFiles(ctx, tempdir)
+		rtest.OK(t, err)
+		rtest.Equals(t, 2, n, "unexpected number of verified files")
+	}
+}
+
+func TestRestoreIfChanged(t *testing.T) {
+	origData := "content: foo\n"
+	modData := "content: bar\n"
+	rtest.Equals(t, len(modData), len(origData), "broken testcase")
+	snapshot := Snapshot{
+		Nodes: map[string]Node{
+			"foo": File{Data: origData, ModTime: time.Now()},
+		},
+	}
+
+	repo := repository.TestRepository(t)
+	tempdir := filepath.Join(rtest.TempDir(t), "target")
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sn, id := saveSnapshot(t, repo, snapshot, noopGetGenericAttributes)
+	t.Logf("snapshot saved as %v", id.Str())
+
+	res := NewRestorer(repo, sn, Options{})
+	rtest.OK(t, res.RestoreTo(ctx, tempdir))
+
+	// modify file but maintain size and timestamp
+	path := filepath.Join(tempdir, "foo")
+	f, err := os.OpenFile(path, os.O_RDWR, 0)
+	rtest.OK(t, err)
+	fi, err := f.Stat()
+	rtest.OK(t, err)
+	_, err = f.Write([]byte(modData))
+	rtest.OK(t, err)
+	rtest.OK(t, f.Close())
+	var utimes = [...]syscall.Timespec{
+		syscall.NsecToTimespec(fi.ModTime().UnixNano()),
+		syscall.NsecToTimespec(fi.ModTime().UnixNano()),
+	}
+	rtest.OK(t, syscall.UtimesNano(path, utimes[:]))
+
+	for _, overwrite := range []OverwriteBehavior{OverwriteIfChanged, OverwriteAlways} {
+		res = NewRestorer(repo, sn, Options{Overwrite: overwrite})
+		rtest.OK(t, res.RestoreTo(ctx, tempdir))
+		data, err := os.ReadFile(path)
+		rtest.OK(t, err)
+		if overwrite == OverwriteAlways {
+			// restore should notice the changed file content
+			rtest.Equals(t, origData, string(data), "expected original file content")
+		} else {
+			// restore should not have noticed the changed file content
+			rtest.Equals(t, modData, string(data), "expeced modified file content")
+		}
+	}
+}

internal/restorer/restorer_unix_test.go

@@ -5,6 +5,7 @@ package restorer
 
 import (
 	"context"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -118,3 +119,34 @@ func TestRestorerProgressBar(t *testing.T) {
 		AllBytesSkipped: 0,
 	}, mock.s)
 }
+
+func TestRestorePermissions(t *testing.T) {
+	snapshot := Snapshot{
+		Nodes: map[string]Node{
+			"foo": File{Data: "content: foo\n", Mode: 0o600, ModTime: time.Now()},
+		},
+	}
+
+	repo := repository.TestRepository(t)
+	tempdir := filepath.Join(rtest.TempDir(t), "target")
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sn, id := saveSnapshot(t, repo, snapshot, noopGetGenericAttributes)
+	t.Logf("snapshot saved as %v", id.Str())
+
+	res := NewRestorer(repo, sn, Options{})
+	rtest.OK(t, res.RestoreTo(ctx, tempdir))
+
+	for _, overwrite := range []OverwriteBehavior{OverwriteIfChanged, OverwriteAlways} {
+		// tamper with permissions
+		path := filepath.Join(tempdir, "foo")
+		rtest.OK(t, os.Chmod(path, 0o700))
+
+		res = NewRestorer(repo, sn, Options{Overwrite: overwrite})
+		rtest.OK(t, res.RestoreTo(ctx, tempdir))
+		fi, err := os.Stat(path)
+		rtest.OK(t, err)
+		rtest.Equals(t, fs.FileMode(0o600), fi.Mode().Perm(), "unexpected permissions")
+	}
+}