Restore

Restore file to captured state

Every captured change carries its SHA-256-addressed content in BLOB_STORE. Restoring writes that content back to the original path — current file gets backed up to <path>.drift_restore_backup_<epoch> before overwrite.

What will change

Preview -- nothing has been written yet.

Target file	/etc/cron.d/imunify-notifier-timed-trigger
Site	SSH-agent watch: /etc/cron.d on localhost-ssh-agent
Kind	ssh_agent
Captured at	2026-07-12 07:21:01
Captured SHA	5f1d3fcaca44e52fd61a86fad0f1e87ec50293fa856d0eabb63e744aefa500ba

Current state on disk

Live check just now. If SHAs match, the restore is a no-op.

File present	no (new file)
Size	unknown
Current SHA
Same as captured?	no -- restore will change it

See exactly what's different →

Confirm restore

Backs current content to <target>.drift_restore_backup_<epoch>, writes the captured content, verifies SHA post-write.