Restore

Restore file to captured state

Every captured change carries its SHA-256-addressed content in BLOB_STORE. Restoring writes that content back to the original path — current file gets backed up to <path>.drift_restore_backup_<epoch> before overwrite.

What will change

Preview -- nothing has been written yet.

Target file	/etc/cron.d/imunify-core
Site	SSH-agent watch: /etc/cron.d on localhost-ssh-agent
Kind	ssh_agent
Captured at	2026-06-22 18:35:32
Captured SHA	159f035204c30a2741d9e009342222d7b38395f6679583ce781975283203a7aa

Current state on disk

Live check just now. If SHAs match, the restore is a no-op.

File present	no (new file)
Size	unknown
Current SHA
Same as captured?	no -- restore will change it

See exactly what's different →

Confirm restore

Backs current content to <target>.drift_restore_backup_<epoch>, writes the captured content, verifies SHA post-write.