There was a problem loading the comments.

How to restore BURP based backups

Support Portal  »  Knowledgebase  »  Viewing Article

  Print
For client-side restoring of backups made with BURP, we'll first need to check which backup number we want to probe/restore from, by running [-action list]:
> burp -a l

From this, we should see a list of recoverable backups, and select the backup number [first column] based on the desired date, IE:
> burp -a l
Backup: 0000001 2021-08-24 21:14:41 -0400 (deletable)
Backup: 0000043 2021-10-15 07:12:04 -0400 (deletable)
Backup: 0000085 2021-12-24 20:50:06 -0500 (deletable)
[etc.]

Once the backup number has been selected [IE: say #85 in above example], we should do a list to look for the file/directory/whatnot we're after [-action list, backup#, regex_to_match]:
> burp -a l -b 85 -r [regex to match]

It's important to note, that the exact path, or full path & file name can be used as the regex, instead of worrying about a more complicated regex string.  Assuming executing the command above exactly matches the file we're after, and *only* the file we're after, we can choose one of two actions:

Recover in place [-action recover, backup#, regex_to_match, directory/restore destination]:
> burp -a r -b 85 -r [regex to match] -d /

[Note: -f can be used to "'force overwrite'. Without this option set, a restore will not overwrite existing files."
Also, note: "'-d' is also required, because you need to tell burp the target directory for the restore"]

Recover to temporary directory [-action recover, backup#, regex_to_match, directory/restore destination]:
> burp -a r -b 85 -r [regex to match] -d /[path-to]/[temp-directory]/

In general, the burp "-a r" string should *always* match your successful/desired burp "-a l" string, with simply "-d /[...]" appended per above. 

Burp will create the full tree to a given restoring file/path as necessary (even if buried in a temp directory], unless directories are stripped with "-s [number of parent directories to prune]", so you may end up with something like "/tmp/restore/var/log/messages" if attempting to restore "/var/log/messages" within a temporary directory of "/tmp/restore/".  This is normal.

Original BURP restore documentation: https://burp.grke.org/docs/restoring.html   

Share via
Did you find this article useful?  

Related Articles


Comments

Add Comment

Replying to  

Captcha
© Priority Colo Inc.