Design and implement a source control strategy · Topic 3 of 3
Recovering and Removing Data with Git
AZ-400 Git recovery: reflog, reset, revert and restore, plus removing leaked secrets and large files from history with filter-repo and BFG.
- 5 min
git revertadds an undo commit and is safe for shared history.git resetmoves a branch and rewrites history.git reflogfinds commits after a reset or a branch deletion.- Deleting a file in a new commit does not remove it from history. Use
git filter-repoor BFG, then force push.
What it is
Two opposite jobs come up in source control. Recovering data means bringing back something that was lost or changed: a deleted branch, a bad merge, an old file version. Removing data means making something disappear from history for good, such as a leaked secret or a huge binary.
They use different tools. Recovery uses commands that add history or move pointers. Removal has to rewrite history, which changes every commit after the change.
How it works
Undoing and recovering
| Goal | Command | Notes |
|---|---|---|
| Undo a commit that is already shared | git revert <commit> | Adds a new commit that reverses the change. Safe on shared branches because history is not rewritten |
| Move a branch back and discard later commits | git reset --hard <commit> | Rewrites the branch pointer. Fine locally, dangerous on shared branches |
| Keep the changes but undo the commit | git reset --soft <commit> or --mixed | --soft keeps changes staged, --mixed unstages them |
| Restore one file from a commit | git restore --source=<commit> <path> | Older form: git checkout <commit> -- <path> |
| Discard uncommitted edits to a file | git restore <path> | Cannot be undone |
| Bring one commit onto another branch | git cherry-pick <commit> | Copies the change as a new commit |
| Park unfinished work | git stash and git stash pop | Saves local changes without committing |
| Find lost commits | git reflog | Lists where HEAD and branches have been, even after a reset or a deleted branch |
Recovering a deleted branch or lost commit
Git rarely loses a commit right away. If you deleted a branch locally, look it up in the reflog and recreate it.
git reflog
git branch rescued-work 4f2a9c1On the server side, Azure Repos lets you search for a deleted branch on the Branches page and restore it. GitHub shows a Restore branch button on a closed pull request. Both depend on the commits still existing on the server.
Removing specific data
A new commit that deletes a file does not remove it. Anyone can still read it from older commits. To purge data you rewrite history.
| Tool | Use |
|---|---|
git filter-repo | The recommended tool for rewriting history, for example removing a file or path everywhere (git filter-repo --path secrets.env --invert-paths) or replacing text |
| BFG Repo-Cleaner | A simpler, fast tool for common cases such as deleting large files or replacing passwords |
git filter-branch | The older built in command. Slow and discouraged |
git rm --cached <file> | Stops tracking a file going forward. It does not touch history |
The process after a secret leaks:
- Revoke and rotate the secret first. Treat it as compromised the moment it was pushed.
- Rewrite history with
git filter-repoor BFG on a fresh mirror clone. - Force push the cleaned branches and tags (
git push --force --all, then--tags). - Ask every collaborator to re-clone, because their copies still contain the old commits.
- Remove cached copies: close old pull requests and, on GitHub, contact support for cached views if needed. Run
git gcafter expiring the reflog locally. - Add the file pattern to
.gitignoreand turn on secret scanning with push protection so it cannot happen again.
Choosing revert, reset or rewrite
| Situation | Use |
|---|---|
| Bad commit already merged to a shared branch | git revert |
| Local commits not yet pushed need to go | git reset |
| Deleted a branch by accident | git reflog then git branch |
| Password committed and pushed | Rotate, then git filter-repo, then force push |
| Repository is bloated by an old binary | git filter-repo or BFG, then LFS going forward |
A worked scenario
A developer pushes a storage account key to main. The security lead has the key rotated within minutes, which is the step that actually stops misuse. The team then creates a mirror clone, runs git filter-repo --path config/prod.env --invert-paths, force pushes, and asks everyone to re-clone. They add *.env to .gitignore and enable push protection, which blocks pushes that contain recognised secrets.
What to remember for the exam
git revertadds an undo commit and is safe for shared history.git resetmoves a branch and rewrites history.git reflogfinds commits after a reset or a branch deletion.- Deleting a file in a new commit does not remove it from history. Use
git filter-repoor BFG, then force push. - Rotate leaked secrets first, then clean history. Collaborators must re-clone.
- Secret scanning with push protection prevents the repeat.
Rewriting history changes commit IDs. Open pull requests and every clone are affected, so coordinate it.
How the exam asks about this
- "Undo a change on main without rewriting history."
git revert. - "Recover a branch deleted locally."
git reflogthen recreate the branch. - "Remove a committed file from all history."
git filter-repoor BFG, then force push. - "A password was pushed. What is the first step?" Rotate the password.
Common mistakes
Cleaning history but not rotating the secret. Copies and caches may already exist.
Using git reset --hard on a shared branch. It forces everyone else to repair their clones.
Forgetting tags. Tags can still point at old commits that hold the data.
Not telling the team. Old clones can push the removed data right back.
Check yourself
Which command safely undoes a pushed commit by adding a new one?
git revert.
Which command lists previous positions of HEAD so a lost commit can be found?
git reflog.
What must you do before cleaning a repository of a leaked key?
Revoke and rotate the key.
Topic 3 of 3 in Design and implement a source control strategy
Test yourself on Design and implement a source control strategy
The full Microsoft AZ-400 question bank has 766 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.