Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse Restic to create encrypted, deduplicated snapshots of your VPS on storage that is separate from the server, then automate the job and prove that restoration works. The dependable sequence is: export databases, initialize a remote repository, back up only the paths your services need, verify snapshots and repository integrity, apply a reviewed retention policy, and perform repeat restore drills.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Restic backs up—and what it does not
Restic reads the files and directories you specify, encrypts and authenticates their contents on the VPS, deduplicates data, and records each run as a snapshot in a repository. A repository can be a local directory or a remote location reached over SFTP or S3-compatible object storage. Because encryption happens before data leaves the VPS, the storage operator does not need the repository password to read the backup.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Restic is a file-level backup tool. It does not pause a running database or turn concurrent application writes into one transactionally consistent filesystem image. A database file copied while pages are changing can be unusable even when Restic reports a successful snapshot. Export each database with its native dump utility, or quiesce the service during the backup, and include the resulting dump files.
Repository integrity is also different from application recoverability. restic check validates repository structure and data integrity; it cannot prove that your web server starts, that a database dump imports, or that file ownership and service configuration are correct. Those claims require an actual restore and a service-level test.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Deletion is a separate threat. An attacker who can delete objects or log in to the repository can damage your backups even though Restic encryption remains intact. A separate storage account, append-only or object-lock controls where available, geographic separation, and credentials that cannot administer the VPS reduce that risk.
Choose storage that survives loss of the VPS
Do not put the only repository on the VPS’s root disk. If the instance, disk, account, or hosting region is lost, a same-disk repository is lost with it. A local external drive can be useful as a second copy, but an off-site repository is the primary defense against host failure.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Destination | Separation from VPS | Credential and protection controls | Cost and restore characteristics | Operational burden |
|---|---|---|---|---|
| External USB backup drive | Separate device; off-site only if you physically move or replicate it | Restic encryption protects contents; protect the drive and its mount credentials | Hardware purchase and maintenance; no provider egress fee, but restore speed is limited by the drive and your access to it | Mounting, cable/device failure, rotation, and off-site handling are your responsibility |
| SFTP repository | Can be on another host or region | Use a dedicated account and SSH key restricted to the repository; disable interactive password prompts for unattended jobs | Recurring storage and transfer charges depend on the host; restore speed depends on network bandwidth and the SFTP server | You manage the remote account, disk capacity, updates, and monitoring unless it is managed SFTP storage |
| S3-compatible object storage | Typically separate account, host, and region; choose a different region when practical | Use a bucket policy limited to the repository, short-scope access keys, encryption controls, and append-only or object-lock features when supported | Recurring storage, request, and possible egress/restore charges vary by provider; parallel object transfers can make large restores fast | Provider handles durability and service operation; you still manage credentials, lifecycle rules, and deletion protection |
For a local repository, mount the external drive only when the backup job runs or keep it disconnected between jobs. For SFTP, use a key whose account cannot access unrelated directories. For S3-compatible storage, create credentials that can read and write the backup bucket but cannot delete the bucket, change account billing, or administer the VPS.
Prepare the VPS and the recovery plan
- Install a current Restic package from your distribution or the Restic release channel, and confirm that the executable is available to the account that runs the job.
- Have root or equivalent privilege to read service configuration, TLS keys, uploads, and database dump directories.
- Reserve temporary disk space for database exports and for a restore test. A full disk can prevent both the dump and the backup.
- Confirm outbound network access to the SFTP server or object-storage endpoint, and ensure the VPS clock is correct.
- Inventory what must be rebuilt:
/etcservice configuration, deployment files, application uploads, TLS material where policy permits, web content, container volume data, and database exports. - Write down who can retrieve the repository location, password, SFTP key or object-storage key, and any encryption or object-lock recovery credentials.
The repository password is not recoverable from the repository. The Restic project states: “Losing your password means that your data is irrecoverably lost.” Keep an escrowed copy in an independent password manager or offline recovery record. Do not make the only copy a file on the VPS that an attacker or a failed disk can take away.
Initialize a repository on separate storage
Set the repository location and password file for the account that will run Restic. The password file should contain only the repository password, end with a newline, and be readable only by that account. The following S3-compatible example uses the repository URL format documented by Restic:
install -d -m 0700 /etc/restic
printf '%sn' 'use-a-long-random-repository-password' > /etc/restic/password
chmod 600 /etc/restic/password
export RESTIC_REPOSITORY='s3:https://s3.example.com/vps-backups'
export RESTIC_PASSWORD_FILE='/etc/restic/password'
restic initThe string in the example is not a password to copy; generate a unique random value and store an independent recovery copy. If the storage endpoint requires an access key and secret, provide them through the provider’s supported environment variables or a root-readable secret mechanism rather than putting them on a command line where they can appear in process listings.
For SFTP, use a URL such as sftp:user@host:/srv/restic-repo. Install an SSH key for the job’s account, restrict the remote account to the repository, verify the host key, and test a non-interactive connection before scheduling Restic. An unattended job must never stop waiting for an SSH password or host-key confirmation.
For a local external drive, mount it at a stable path and initialize a repository there, for example export RESTIC_REPOSITORY='/mnt/external-backup/restic-repo' followed by restic init. Keep that path off the VPS’s system disk.
Initialization is performed once per repository. After it completes, run restic snapshots; an empty repository should return no snapshots rather than an error. Save the repository URL, backend credentials, password-recovery record, and the date of initialization in your recovery documentation.
Export databases and quiesce application state
Place exports in a protected directory that is included in the backup:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →install -d -m 0700 /var/backups/dbUse each database’s native, recovery-oriented dump command. For example, a PostgreSQL deployment commonly creates a logical dump with pg_dump or pg_dumpall, while a MySQL-compatible deployment uses mysqldump or its equivalent. Run the command as a database account with the required privileges, write the output under /var/backups/db, check its exit status, and remove or rotate old dumps according to the space available.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For applications that write files as well as database rows, define a short maintenance window or put the application in read-only mode while the dump and file snapshot are taken. Otherwise, the database may describe uploads that were not yet copied, or the filesystem may contain files whose database rows were not committed.
Include the paths that make a rebuild possible, replacing this example with the directories used by your services:
restic backup /etc /home /srv /var/lib/docker/volumes /var/backups/db
--exclude-caches --tag vps/etccontains service configuration, scheduled jobs, repository environment files, and system identity data. Review whether private keys and secrets are permitted by your security policy before including them./homecaptures administrator or application data stored there./srvis common for deployed web and application content./var/lib/docker/volumesis relevant only when containers store durable data in Docker volumes./var/backups/dbcontains the consistent database exports created before the snapshot.
Do not blindly back up the entire root filesystem. Pseudo-filesystems such as /proc, /sys, /dev, and runtime trees contain ephemeral kernel state, sockets, or device files that should be recreated. Include package lists and deployment definitions if they help rebuild the host, but exclude package caches, compiler caches, temporary files, logs that are already shipped elsewhere, and other reproducible data when they add no recovery value.
--exclude-caches recognizes common cache directories. Add explicit exclusions for application-specific caches with additional --exclude options, and review the resulting file list on the first run. Excluding a directory is a data-loss decision: never exclude uploads, user content, encryption keys, or database exports merely because they are large.
Automate backups without overlapping jobs
A systemd service and timer provide locking, logging, persistent scheduling after downtime, and a clear exit status. Create a root-readable environment file containing the repository settings:
install -d -m 0700 /etc/restic
cat > /etc/restic/env <<'EOF'
RESTIC_REPOSITORY=s3:https://s3.example.com/vps-backups
RESTIC_PASSWORD_FILE=/etc/restic/password
EOF
chmod 600 /etc/restic/envStore provider access variables with the same restrictive permissions or use a secret manager. The repository password and the storage access key are different secrets; losing either can block recovery, while exposing either can weaken the backup.
Create an executable backup script that first runs your database-export routine and then starts Restic. The export routine below is a concrete file you create and tailor to the database engines on this VPS:
cat > /usr/local/sbin/restic-vps-backup <<'EOF'
#!/bin/sh
set -eu
umask 077
/usr/local/sbin/export-databases
exec /usr/bin/restic backup /etc /home /srv /var/lib/docker/volumes /var/backups/db
--exclude-caches --tag vps
EOF
chmod 700 /usr/local/sbin/restic-vps-backupYour export-databases script must stop on a failed dump. If it exits successfully while producing an empty or truncated file, Restic will faithfully preserve the bad export. Have it write to a temporary filename, verify the dump command’s exit status, and rename the completed file into place.
Create /etc/systemd/system/restic-vps-backup.service:
[Unit]
Description=Back up Linux VPS with Restic
[Service]
Type=oneshot
User=root
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/flock -n /run/restic-vps-backup.lock /usr/local/sbin/restic-vps-backupThe flock invocation makes a second run exit instead of competing for bandwidth and repository locks. If your distribution places flock elsewhere, use the path reported by command -v flock.
Create /etc/systemd/system/restic-vps-backup.timer:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
[Unit]
Description=Schedule Restic VPS backups
[Timer]
OnCalendar=*-*-* 02:30:00 UTC
Persistent=true
RandomizedDelaySec=15m
[Install]
WantedBy=timers.targetEnable and start it:
systemctl daemon-reload
systemctl enable --now restic-vps-backup.timer
systemctl start restic-vps-backup.service
systemctl status restic-vps-backup.service
journalctl -u restic-vps-backup.serviceRun the service manually once before relying on the timer. Confirm that the database export completes, Restic returns exit status zero, and the job is not silently blocked by an SFTP prompt or an expired object-storage credential.
If cron is the only scheduler available, use a locked entry rather than a bare command. For example, a root crontab can call flock -n /run/restic-vps-backup.lock /usr/local/sbin/restic-vps-backup at a selected time, redirect output to a protected log, and send failures to your monitoring system. Do not place the repository password directly in the crontab.
Verify snapshots and repository integrity
After the first successful run, inspect the snapshots:
restic snapshotsCheck that the expected tag, timestamp, host, and paths appear. A successful command with an unexpectedly small snapshot can indicate that a mount was absent, a database export failed, or an exclusion matched too broadly.
Run the repository consistency check regularly:
restic checkSchedule checks outside the main backup window if they consume significant storage bandwidth. Treat a failed check as an incident: preserve the error output, avoid pruning until you understand the condition, and verify the backend's availability and credentials. A passing check does not replace a restore drill because it does not execute your application or import your database.
Alert on non-zero exit status from the systemd service or cron command. Also alert when no new snapshot appears within the expected interval; a scheduler that runs but cannot reach the repository may otherwise look healthy from the VPS alone.
Apply retention, then prune deliberately
Retention is a policy decision. The following example keeps seven daily, four weekly, and twelve monthly snapshots:
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --dry-runReview the dry-run list against your recovery requirements, including month-end, pre-deployment, and incident snapshots. Once the result is approved, run the same policy without --dry-run:
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12forget changes which snapshots are retained; it does not immediately remove every unreferenced data pack. prune reclaims repository data no longer needed by retained snapshots:
restic prunePruning can be I/O- and bandwidth-intensive. Schedule it separately from the backup window, ensure a restore or consistency check is not running at the same time, and keep deletion protections on the storage backend. Never use an unreviewed retention command as the first response to a full repository.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prove recovery with repeat restore drills
The Restic README puts the priority plainly: “Much more important than backup is restore.” Perform both a file-level test and a rebuild test on a schedule appropriate to the VPS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Single-file restore
- List available snapshots with
restic snapshotsand choose a known snapshot ID or timestamp. - Restore into a disposable directory, never directly over production files:
restic restore latest --target /var/tmp/restic-restore-test- Check the restored file's contents, ownership, permissions, and checksum:
sha256sum /var/tmp/restic-restore-test/path/to/important-fileRemove the test directory after recording the result and any permission adjustments required during a real recovery.
Clean-directory and database test
Restore a complete application directory into an empty location and compare its expected structure. Import one of the restored database dumps into a disposable database instance using that engine's normal restore or import command. Confirm that tables, users, migrations, and representative application queries work; a dump file existing on disk is not proof that it can be imported.
VPS rebuild drill
- Provision a disposable instance with the operating system and network access your production VPS uses.
- Install Restic and retrieve the repository URL, backend credentials, and independently escrowed repository password.
- Run
restic snapshots, select the intended snapshot, and restore configuration, deployment files, uploads, TLS material allowed by policy, volumes, and database dumps. - Reinstall service packages, correct ownership and permissions, and import the database dump.
- Start the application and test authentication, background jobs, uploads, HTTPS, and a representative read/write transaction.
- Record the date, snapshot ID, paths restored, problems encountered, and elapsed recovery time. Update the runbook with every manual step discovered.
Use a disposable target so the drill cannot overwrite production. Repeat after major operating-system, database, storage, or deployment changes, and keep the measured recovery time aligned with the outage your service can tolerate.
Fix common failures
“Repository does not exist” or an empty snapshot list
Check that the job uses the same RESTIC_REPOSITORY value used at initialization, including the backend prefix and path. Confirm that the S3 bucket or SFTP directory is reachable and that the account can read it. An accidentally changed endpoint can make a new empty repository appear valid.
Password or decryption errors
Verify that RESTIC_PASSWORD_FILE points to the intended file, contains no extra spaces, and is readable by the service account. Do not repeatedly initialize repositories in an attempt to fix a password error; locate the escrowed password for the existing repository.
SFTP jobs wait forever
Test the exact SSH command as the service account. Install the correct private key, preload and verify the host key, restrict permissions on the key, and remove any configuration that asks for an interactive password or confirmation.
Permission denied during backup
Run the service with the account that can read the selected paths, or adjust only the necessary ACLs. Avoid making an entire application tree world-readable just to simplify backup. Check mounted volumes and bind mounts; a missing mount can result in a successful backup of an empty directory.
Database dump is inconsistent or empty
Inspect the export script's exit status and output size before Restic runs. Use the database's native dump mode, quiesce writes where required, and perform an import test. A filesystem snapshot cannot repair a dump that was invalid before it was backed up.
Jobs overlap or pruning stalls backups
Keep the flock lock, separate pruning from backup, and monitor runtime. If a run exceeds its interval, lower concurrency, adjust the schedule, or allocate more bandwidth and temporary space rather than allowing competing jobs to contend for the repository.
Operational checklist
- Repository is on storage separate from the VPS and, preferably, in another failure domain.
- Repository password has an independent offline or password-manager recovery record.
- Storage credentials are least-privilege and cannot administer the VPS.
- Database exports complete before each filesystem snapshot and are periodically imported in a test environment.
- Backup paths include configuration, application data, uploads, permitted TLS material, durable volumes, and database dumps.
- Caches, package downloads, pseudo-filesystems, and reproducible temporary data are excluded intentionally.
- Systemd or cron jobs cannot overlap, report failures, and produce a fresh snapshot within the required interval.
restic snapshotsis reviewed after setup and after major changes;restic checkruns regularly.forgetpolicy is reviewed with a dry run beforeprune.- Single-file, clean-directory, database, and disposable-VPS restore drills are documented with recovery time.
A Linux VPS backup is complete only when the repository is independent, the data is consistent, the password is recoverable by the authorized operator, retention cannot erase required history unexpectedly, and a real restore has started the service successfully.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
