Abstract: A database system is described in which changes to a database file are recorded in a journal file. The journal file comprises a sequence of after-image records each having a database identifier indicating which database record it relates. Periodically, a dump is taken of the database. At regular intervals, between dumps the journal file is merged with any previously archived journal file to form a merged file, the records are sorted into order of their database identifiers and the merged file is filtered to remove all but the latest after-image record relating to each particular database record. The filtered journal file is archived. If the database file is corrupted, it can be recovered by applying the filtered journal file to a dump file. Because the journal file has been filtered, recovery is faster. The filtered journal can also be used for performing an off-line integrity check on the reconstructed database file.