A file which has been changed from a data storage system is restored. If the file was changed from an active file system, a set of twin pointers is created by copying from the latest pointers in the active file system before the file system was changed. A pointer from the twin pointers is compared with a pointer from a snapshot of the active file system. If a pointer from the twin pointers points to a same data block as the pointer from the snapshot, the twin pointer is written into the active file system to restore the file to the active file system. If the pointers do not point to the same data block, a data of the block is copied to a new block in the active file system to restore data changed since the snapshot was taken.