Non-destructive restore by default

By Lucas Flores, IT Systeme Flores UG. Last updated 2026-10-29

Restore in Restow is granular or complete (a single email, a folder, a file, a specific file version, or an entire mailbox or OneDrive), into the original account or a different one. By default it does not overwrite anything that already exists: it writes new items rather than silently replacing live data, because the one thing worse than a missing backup is a restore that destroys something that wasn't actually lost. For mail, calendar and contacts there is no mode that overwrites: an existing item is kept next to the restored one or skipped. Two newer targets offer overwrite as an explicit choice, described below: files in a SharePoint library and files at the original location of a file share.

A restore also says plainly how it ended. Since 0.4.7 a completed restore in which items failed and none was restored reads "Nothing restored" (red) and raises restore.failed and the job.failed webhook; one that skipped every item reads "Everything skipped" (amber) and says so instead of claiming it restored something. A restore back into the original mailbox, OneDrive or site of an account that is disabled, unlicensed or locked is refused with the reason: restore into another account or download the data instead. An IMAP restore whose connection drops fails and is retried on a fresh connection, where the Message-ID check skips what was already appended, instead of ending as completed with every remaining item failed. A retried SharePoint list restore or contacts restore in "Keep both" mode no longer adds items or contacts twice, and a restore into a mailbox given by address resolves the mailbox the API accepted, so a duplicate address no longer picks another one. The detection of disabled, unlicensed and locked accounts behind the refusal was tested against a simulated Graph API, not against a real Microsoft 365 tenant.

Self-service, and restore for others

Today, end users sign in with a passkey or the emergency password with TOTP and can restore only their own mailbox or OneDrive, with no admin ticket required for the common case. Signing in with a Microsoft (Entra ID) account is planned: the sign-in code exists, but nothing yet links an account to a Microsoft identity, so nobody can sign in with Microsoft today and the login page does not offer it. Single sign-on (SSO) is planned. Restoring on someone else's behalf needs the Global Admin role for that tenant, or a Provider Admin role in the Service Provider edition; every such restore is impersonation, and in every edition every impersonation is written to Restow's tamper-evident, hash-chained audit log: who ran it, when, for whom, and from which IP. The viewer for that log, with search, filters, details and chain verification, ships in Business and Service Provider, and since 0.3.1 so does its export, as CSV and as JSON with hashes.

Since 0.4.0, restore operators, a role per tenant that sees and restores backups without administering jobs, storage or users, also open Servers & clients, File restore. They list the machines, browse restore points, download files as a ZIP and restore files onto a machine, and for Proxmox VE they browse and download files of container and VM restore points. Backing up, jobs, settings, tokens and restoring a whole guest stay with the administrators. Every read, download and restore is written to the audit log with the operator as the actor.

Browsing before you restore

The restore explorer lets you look at a backup before anything is written. A slim timeline of restore points runs along the bottom of the screen, with the newest one centred, so you can move between points in time. A folder without subfolders says so.

Since 0.4.2 the explorer lists one entry per person. A person's mailbox, OneDrive and linked IMAP account are grouped, and the second column shows Mail, Calendar, Contacts and OneDrive, each with its own restore points. SharePoint and Teams sites, and since 0.4.5 Microsoft 365 groups (group calendar and conversations), have a section of their own, and a OneDrive whose account was deleted is listed under its owner's name as "Account deleted". The list comes a page at a time, with search over names, addresses and account ids and a type filter, so a large tenant never loads everyone at once; it is fine up to about 10,000 people per tenant and slower beyond.

A mailbox's calendar has a month view, day by day across all its calendars or one. A recurring series stands once in the list and opens onto its occurrences, calculated from the stored pattern with the changed occurrences in place, following the series' time zone across summer and winter time. Events sort by when they start, newest first or upcoming first, with When, Location and Organizer columns. A single occurrence that was deleted in Outlook is not recorded in the backup (Microsoft Graph names no cancelled occurrences), so it can still appear here, as it would after restoring the series.

Since 0.4.4 a large mailbox or OneDrive opens in milliseconds instead of seconds to minutes. A folder listing used to read every entry of the restore point, twice per request; it now reads the folder's children and the folders below it from two indexes. In a test with 120,000 messages and 200,000 files, the mail folder list went from 2.5 seconds to 15 milliseconds, the root of the mailbox and of the OneDrive from over a minute to 15 milliseconds, and each OneDrive folder from 1.5 to 2.5 seconds to about 10 milliseconds; a folder of 50,000 messages shows its first page in about half a second (it took 1.9 seconds). The versions OneDrive kept of a file and the calendar's month view use the same indexes, and a mail preview or an attachment download reads only the bytes it needs from storage instead of the whole pack. Restore points of 0.3.4 and earlier that the worker has not converted yet are listed as before. The indexes are built while the update runs, which takes longer on a large installation: plan its update outside the backup window. These are figures of a test, not a promise for every installation.

Restoring from mail files, machines, file shares and Proxmox VE

A mailbox imported from mail files (see mail import and export) can be restored into a Microsoft 365 or IMAP mailbox, or downloaded. It has no original account, so restoring to the original is not offered for it. A server or client backed up with the agent (see server and client backup) is restored into a new folder on that machine, never over existing files, or downloaded as a ZIP. A VM or container backed up on Proxmox VE (a preview, see Proxmox VE backup) is restored as a new VMID in the pool restow-restore. Files of a container, or as a preview of a VM, can also be browsed and downloaded as one ZIP, without restoring the guest; they are downloaded, not put back into a running guest.

A file share (see file shares) is restored from a restore point in one of four ways: a ZIP download, a new folder in the same share, the original location (overwrite, keep both or skip existing files), or another share. Permissions are put back where the target allows it, and the files whose permissions could not be set are listed. A restore into a share needs "Allow restore to this share" on it, which is off by default.

A SharePoint site (see Microsoft 365 and IMAP backup) is restored from the explorer: files and folders into the original library or another library of a backed-up site of the same source ("Keep both", "Overwrite", with SharePoint keeping the old file as a version, or "Skip existing"), list items into their original list as new items, or the whole selection as a ZIP. Restoring needs the application permission Sites.ReadWrite.All; permissions are never restored.

Since 0.4.5 a Microsoft 365 group (see Microsoft 365 and IMAP backup) is restored from the explorer as well, from its areas "Group calendar" and "Conversations". Into a user's mailbox of the same source it brings back events and conversations (the conversations as mail in a Conversations folder). Into the group itself it brings back calendar events only, because Microsoft Graph lets no app post into a group conversation: each post is reported as not restorable, with the ways that work. There is no "Overwrite" mode for a group: "Keep both" puts copies next to what is there, and "Skip existing" leaves events that are in the group already. Download as a ZIP and export work as for mailboxes.

Where "non-destructive by default" is going next

For OneDrive files, an optional "Replace" mode is planned: the current file would become an earlier version in OneDrive's own version history, so nothing is deleted. Mail, calendar and contacts will never be overwritten. Full, per-item restore verification (reading back and checking every backed-up item, not a weekly sample) is the other piece of "restore that's actually proven," covered on the verification page.

Frequently asked

Can a Restow restore overwrite my existing mail?

Not mail, calendar or contacts, and not by default anywhere. Restore writes items into the target (the original account or a different one) rather than silently replacing what's already there. For mail there is no mode that overwrites: the API refuses one, so an existing item is always either kept next to the restored one or skipped. Two newer targets have overwrite as an explicit choice: files restored into a SharePoint library (SharePoint keeps the old file as a version) and files restored to the original location of a file share.

Who can restore data for someone else?

Today, end users sign in with a passkey or the emergency password with TOTP and can only restore their own mailbox or OneDrive. Signing in with a Microsoft (Entra ID) account is planned: the sign-in code exists, but nothing yet links an account to a Microsoft identity, so nobody can sign in with Microsoft today and the login page does not offer it. Single sign-on (SSO) is planned. Restoring on behalf of another user needs the Global Admin role for that tenant, or Provider Admin, and every such restore (impersonation) is written to Restow's tamper-evident, hash-chained audit log in every edition: who, when, for whom, from which IP. The viewer for that log (search, filter, details, chain verification) ships in Business and Service Provider, and since 0.3.1 so does its export, as CSV and as JSON with hashes. A restore operator, a role that sees and restores backups without administering anything, can browse and download files of machines and Proxmox VE guests and restore files onto a machine since 0.4.0; every read, download and restore is audited.

What can be restored: a whole mailbox, or a single email?

Both, and everything in between: a single email, a folder, a file, a specific file version, or a complete mailbox/OneDrive, from any point Restow has a backup for.

How does the restore explorer list what is backed up?

Since 0.4.2, one entry per person: a person's mailbox, OneDrive and a linked IMAP account are grouped, and the second column shows Mail, Calendar, Contacts and OneDrive, each with its own restore points. SharePoint and Teams sites, and since 0.4.5 Microsoft 365 groups (group calendar and conversations), have a section of their own, and a OneDrive whose account was deleted is listed under its owner's name as "Account deleted". The list comes a page at a time with search and a type filter; it is fine up to about 10,000 people per tenant and slower beyond. Since 0.4.4 the folders of a large mailbox or OneDrive open in milliseconds, not seconds to minutes: in a test with 120,000 messages and 200,000 files the root of a mailbox went from over a minute to 15 milliseconds.

Can I look at a mailbox's calendar by month before restoring?

Yes, since 0.4.2. The calendar of a mailbox has a month view, day by day across all its calendars or one, and a recurring series opens onto its occurrences, calculated from the stored pattern with the changed occurrences in place. A single occurrence that was deleted in Outlook can still appear, as it would after restoring the series, because Microsoft Graph does not name cancelled occurrences.

Can I restore from something other than a Microsoft 365 or IMAP backup?

Yes. A mailbox imported from mail files (EML, MSG, MBOX, a MailStore export) can be restored into a Microsoft 365 or IMAP mailbox, or downloaded. A server or client backed up with the agent can be restored into a new folder on that machine, never over existing files, or downloaded as a ZIP. A file share can be downloaded as a ZIP, restored into a new folder, to the original location or into another share. A SharePoint site can be downloaded as a ZIP or restored into a library or list. A Proxmox VE VM or container is restored as a new VMID in the pool restow-restore, and files of a container or (as a preview) a VM can be downloaded as a ZIP.

What does Restow say when a restore did not restore anything?

Since 0.4.7 it says so. A completed restore with failed items and none restored reads "Nothing restored" (red) and raises restore.failed and the job.failed webhook; one that skipped every item reads "Everything skipped" (amber) instead of claiming it restored something. A restore into the original mailbox, OneDrive or site of an account that is disabled, unlicensed or locked is refused with the reason, and an IMAP restore whose connection drops is retried on a fresh connection, where the Message-ID check skips what was already appended.

How restore is verified →