Linux Backup and Restore: tar, cpio, dd and rsync Guide

Backup and restore is one of the most critical Linux admin responsibilities. This guide covers all RHCA-level backup tools: tar, cpio, dd, rsync, and dump/restore.

Backup Types

tar — Most Common Linux Backup Tool

# Create archive:
# tar -cvf /backup/etc.tar /etc/          # create, verbose, file
# tar -czvf /backup/etc.tar.gz /etc/      # with gzip compression
# tar -cjvf /backup/etc.tar.bz2 /etc/    # with bzip2 compression
# tar -cJvf /backup/etc.tar.xz /etc/     # with xz compression (best ratio)

# Extract archive:
# tar -xvf /backup/etc.tar               # extract to current dir
# tar -xvf /backup/etc.tar -C /restore/  # extract to specific dir
# tar -xzvf /backup/etc.tar.gz           # extract gzip

# List archive contents:
# tar -tvf /backup/etc.tar

# Incremental backup with tar:
# tar -czvf /backup/full_$(date +%Y%m%d).tar.gz /data/
# tar -czvf /backup/incr_$(date +%Y%m%d).tar.gz \
     --newer /backup/full_20260601.tar.gz /data/

# Exclude files:
# tar -czvf /backup/home.tar.gz /home/ --exclude=/home/*/Downloads

# Backup and transfer over SSH in one step:
# tar -czvf - /data/ | ssh root@backup-server 'cat > /backups/data.tar.gz'

cpio — Copy In/Out Archive

# Backup (copy-out mode):
# find /etc -depth | cpio -ov > /backup/etc.cpio

# Restore (copy-in mode):
# cpio -iv < /backup/etc.cpio

# Pass-through (copy files to another directory):
# find /etc -depth | cpio -pvd /restore/etc/

dd — Disk/Partition Cloning

# Clone entire disk:
# dd if=/dev/sda of=/dev/sdb bs=4M status=progress

# Backup partition to file:
# dd if=/dev/sda1 of=/backup/sda1.img bs=4M status=progress

# Restore partition from file:
# dd if=/backup/sda1.img of=/dev/sda1 bs=4M

# Create a bootable USB (replace /dev/sdX with USB device):
# dd if=rhel7.iso of=/dev/sdX bs=4M status=progress

# Create an empty file (useful for swap or LUN testing):
# dd if=/dev/zero of=/root/testfile bs=1M count=100

# Zero out a disk (secure wipe):
# dd if=/dev/zero of=/dev/sdb bs=4M status=progress

rsync — Efficient Incremental Sync

# Basic local sync:
# rsync -av /source/ /destination/

# Remote sync over SSH:
# rsync -avz /data/ root@backup::/backups/data/
# rsync -avz -e ssh /data/ root@192.168.1.100:/backups/

# Mirror (delete files on dest that don't exist on source):
# rsync -avz --delete /data/ root@backup:/backups/

# Dry run (preview without making changes):
# rsync -avzn /data/ root@backup:/backups/

# Options:
# -a  archive mode (preserve permissions, timestamps, symlinks)
# -v  verbose
# -z  compress during transfer
# -h  human readable sizes
# --progress  show progress per file

dump and restore — ext4 Filesystem Backup

# Full backup (level 0):
# dump -0 -f /backup/data.dump /dev/sdb1

# Incremental backup (level 1 = changes since level 0):
# dump -1 -f /backup/data_incr.dump /dev/sdb1

# Restore interactively:
# restore -if /backup/data.dump

# Restore specific file:
# restore -xf /backup/data.dump ./etc/passwd

# Restore everything:
# restore -rf /backup/data.dump

Scheduling Automated Backups with cron

# vim /etc/cron.daily/backup.sh
#!/bin/bash
DATE=$(date +%Y%m%d)
DEST=/backup

# Full backup on Sundays, incremental on weekdays
DAY=$(date +%u)
if [ $DAY -eq 7 ]; then
    tar -czvf $DEST/full_$DATE.tar.gz /data/
else
    tar -czvf $DEST/incr_$DATE.tar.gz \
        --newer $DEST/full_$(date -d 'last sunday' +%Y%m%d).tar.gz /data/
fi

# Remove backups older than 30 days:
find $DEST -name "*.tar.gz" -mtime +30 -delete

# Make executable:
# chmod +x /etc/cron.daily/backup.sh

Backup Best Practices

• 3-2-1 rule: 3 copies, 2 media types, 1 offsite
• Always verify backups by doing test restores
• Store backups on a different physical server
• Compress and encrypt sensitive backups
• Schedule during off-peak hours
• Keep backup logs and monitor for failures