LFCS 147 🐧 Backup Strategies - KandZ

⏱️ Estimated read: 10 min | |

The previous chapters covered security and monitoring. This chapter shifts the focus to disaster recovery: the principles of backup that determine whether the data survives a disk failure, a ransomware attack, an accidental deletion, or a natural disaster. The LFCS exam tests the conceptual model: the 3-2-1 rule, the distinction between full, incremental, and differential backups, the difference between RPO and RTO, and the trade-offs between the backup types. The critical trap is assuming that a single backup is sufficient. The 3-2-1 rule is the minimum standard: three copies of the data, two different media types, and one off-site copy.

Key point: The 3-2-1 rule defines the minimum viable backup strategy. The three copies are the primary data plus the backup plus the off-site backup. The two media types are the local disk plus a separate medium such as tape or cloud. The one off-site copy protects against the physical loss of the primary site. The backup type (full, incremental, differential) determines the balance between the backup time and the restore time.

Why backup strategies require a specific mental model

The 3-2-1 rule. The rule is the industry standard. The three copies mean that a single failure does not destroy the data. The two media types mean that a flaw in one medium (e.g., a disk controller bug) does not destroy both copies. The one off-site copy means that a fire, flood, or theft at the primary site does not destroy all copies. The rule does not specify the frequency or the retention; those depend on the data’s value and the acceptable data loss.

The RPO and RTO problem. The RPO (Recovery Point Objective) is the maximum acceptable data loss. An RPO of one hour means the backup must run at least every hour. The RTO (Recovery Time Objective) is the maximum acceptable downtime. An RTO of four hours means the restore must complete within four hours. The RPO determines the backup frequency. The RTO determines the restore strategy. A backup strategy that meets the RPO but not the RTO is a strategy that saves the data but takes too long to bring the system back online.

The full backup problem. A full backup copies every file. It is the simplest and the most reliable, but it is also the slowest and the largest. The full backup of a 1 TB filesystem takes hours, and it consumes 1 TB of storage. The daily full backup is impractical for the large filesystems. The incremental and differential backups are the alternatives.

The incremental versus differential problem. An incremental backup copies the files that changed since the last backup of any type. A differential backup copies the files that changed since the last full backup. The incremental backup is the smallest and the fastest to create, but the restore requires the full backup plus every incremental backup in the chain. The differential backup is larger than the incremental, but the restore requires only the full backup plus the latest differential.

The trade-off. The incremental backup minimizes the backup time and the storage, but it maximizes the restore time and the risk of a broken chain. The differential backup balances the two. The full backup minimizes the restore time, but it maximizes the backup time and the storage. The correct choice depends on the backup window and the restore time.

a. The backup types: full, incremental, and differential

A full backup copies all selected files. The archive bit (or the modification time) is used to identify the files for the other backup types.

Type	Copies	Backup Time	Restore Requirements
Full	All files	Long	Full only
Incremental	Files changed since last backup (any type)	Short	Full + all incrementals
Differential	Files changed since last full backup	Medium	Full + latest differential

The incremental backup chain is the key. If the chain has a full backup on Sunday, incrementals on Monday through Friday, and one of the incrementals is corrupted, the restore cannot proceed past that point. The differential backup does not have the chain: the restore is the full backup plus the most recent differential, regardless of how many differentials exist.

The tar command is the standard backup tool on Linux. The tar -czvf creates a compressed archive. The --newer flag creates an incremental or differential backup based on the modification time. The --listed-incremental flag creates a GNU incremental backup with a snapshot file.

# Full backup
tar -czvf /backup/full-2026-10-30.tar.gz /home/user/

# Incremental backup (files changed since snapshot)
tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar /home/user/

The --listed-incremental flag stores the state in the snapshot.snar file. The first run is a full backup, and the subsequent runs are incremental. The snapshot file tracks the changes. The --level flag is the alternative for the numbered levels.

b. The RPO and RTO in practice

The RPO and RTO are the business metrics that drive the technical decisions. The RPO is the acceptable data loss, which determines the backup frequency. The RTO is the acceptable downtime, which determines the restore strategy.

RPO	Backup Frequency
24 hours	Daily backup
1 hour	Hourly backup or continuous replication
0	Synchronous replication or database-level replication

RTO	Restore Strategy
48 hours	Restore from tape or cold storage
4 hours	Restore from disk backup
0	Automatic failover

The RPO of zero requires a replication mechanism, not a backup. The backup is a point-in-time copy; the replication is a continuous sync. The RTO of zero requires a high-availability setup, not a restore. The backup strategy is the recovery, not the availability.

c. The backup verification and the restore testing

A backup that has never been restored is a backup that might not work. The verification step confirms that the backup can be read and that the contents are correct. The restore testing confirms that the restore procedure works within the RTO.

The tar -tzvf command lists the contents of an archive without extracting it. The tar -xzvf command extracts the archive. The diff -r command compares the restored directory to the original.

# Verify the archive
tar -tzvf /backup/full-2026-10-30.tar.gz

# Restore to a test directory
mkdir /tmp/restore-test
tar -xzvf /backup/full-2026-10-30.tar.gz -C /tmp/restore-test

# Compare
diff -r /home/user/ /tmp/restore-test/home/user/

The verification is not a one-time activity. The restore test should be scheduled on a regular basis—monthly or quarterly—to ensure that the backup is still readable and that the restore procedure is still documented.

The rsync command is the alternative for the backup. The rsync -av --delete command mirrors the source to the destination. The --link-dest flag creates hard links for the unchanged files, which saves the storage for the full backups. The --backup flag creates the backup copies of the changed files.

# Snapshot-style backup with hard links
rsync -av --delete --link-dest=/backup/latest /home/user/ /backup/2026-10-30/

The --link-dest option compares the files with the reference directory and creates hard links for the unchanged files. The result is a full backup that looks like a complete copy, but the unchanged files share the inodes with the reference. The storage is the size of the changes, not the full copy.

Complete Example Session

# ============================================
# PART 1: CREATE A FULL BACKUP
# ============================================

tar -czvf /backup/full-2026-10-30.tar.gz /home/user/

# ============================================
# PART 2: CREATE AN INCREMENTAL BACKUP
# ============================================

tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar /home/user/

# ============================================
# PART 3: VERIFY THE ARCHIVE
# ============================================

tar -tzvf /backup/full-2026-10-30.tar.gz | head
# Lists the files in the archive.

# ============================================
# PART 4: RESTORE TO TEST DIRECTORY
# ============================================

mkdir /tmp/restore-test
tar -xzvf /backup/full-2026-10-30.tar.gz -C /tmp/restore-test

# ============================================
# PART 5: COMPARE THE RESTORE
# ============================================

diff -r /home/user/ /tmp/restore-test/home/user/
# No output: the files match.

# ============================================
# PART 6: RSYNC WITH HARD LINKS
# ============================================

rsync -av --delete --link-dest=/backup/latest /home/user/ /backup/2026-10-30/

# ============================================
# PART 7: UPDATE THE LATEST LINK
# ============================================

ln -sfn /backup/2026-10-30 /backup/latest

# ============================================
# PART 8: DOCUMENT THE RPO AND RTO
# ============================================

# RPO: 24 hours → daily backup
# RTO: 4 hours → restore from local disk

# ============================================
# PART 9: TEST THE RESTORE
# ============================================

# Restore to test directory
# Verify with diff -r
# Document the procedure

The nine parts trace the backup strategy: full backup, incremental, verification, restore to test, comparison, rsync with hard links, latest link, RPO/RTO documentation, and restore testing.

Quick Reference

Backup Types

Type	Copies	Restore Needs
Full	All files	Full only
Incremental	Changes since last backup	Full + all incrementals
Differential	Changes since last full	Full + latest differential

The 3-2-1 Rule

Rule	Meaning
3 copies	Primary + backup + off-site
2 media types	Disk + tape/cloud
1 off-site	Geographic separation

RPO and RTO

Metric	Meaning
RPO	Max acceptable data loss
RTO	Max acceptable downtime

Commands

Command	Purpose
`tar -czvf`	Create compressed archive
`tar -tzvf`	List archive contents
`tar -xzvf`	Extract archive
`tar --listed-incremental`	Incremental backup
`rsync -av --link-dest`	Snapshot-style backup

Best Practices

✅ Do This:

tar -tzvf /backup/full.tar.gz
<!-- Verify the archive before relying on it -->      # ✅

diff -r /home/user/ /tmp/restore-test/home/user/
<!-- Compare the restore to the source -->            # ✅

rsync -av --link-dest=/backup/latest /home/user/ /backup/new/
<!-- Use hard links to save storage -->              # ✅

❌ Don’t Do This:

# Rely on a single backup
<!-- The 3-2-1 rule requires multiple copies -->      # ❌

# Create incremental backups without testing the chain
<!-- A broken link destroys the restore -->          # ❌

# Skip the restore test
<!-- A backup that has never been restored is not a backup --> # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Backup cannot be restored	Never tested	Schedule restore tests
Incremental chain broken	One increment missing	Use differential or full
Data lost despite backup	Backup on same disk	Off-site copy
Backup exceeds window	Full backup too slow	Incremental
Restore exceeds RTO	Backup on tape	Local disk or replication

Real-World Examples

1. Full Backup

tar -czvf /backup/full-2026-10-30.tar.gz /home/user/

2. Incremental Backup

tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar /home/user/

3. Verify Archive

tar -tzvf /backup/full-2026-10-30.tar.gz

4. Restore

tar -xzvf /backup/full-2026-10-30.tar.gz -C /tmp/restore-test

5. Compare

diff -r /home/user/ /tmp/restore-test/home/user/

6. Rsync Snapshot

rsync -av --link-dest=/backup/latest /home/user/ /backup/2026-10-30/

7. Update Latest

ln -sfn /backup/2026-10-30 /backup/latest

8. RPO 24h

Daily backup

9. RTO 4h

Restore from local disk

10. Off-Site Copy

rsync to remote server

Visual

The 3-2-1 Rule

┌──────────────────────────────────────────────┐
│  Primary data (1)                            │
│  → Local disk                                │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Backup copy (2)                             │
│  → External disk or tape                     │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Off-site copy (3)                           │
│  → Cloud or remote site                      │
└──────────────────────────────────────────────┘

Backup Types

┌──────────────────────────────────────────────┐
│  Full backup                                 │
│  → All files                                 │
│  → Long backup, short restore                │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Incremental backup                          │
│  → Files changed since last backup           │
│  → Short backup, long restore                │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Differential backup                         │
│  → Files changed since last full             │
│  → Medium backup, medium restore             │
└──────────────────────────────────────────────┘

Summary

Item	Value
Minimum backup strategy	3-2-1 rule
Recovery point objective	Max acceptable data loss
Recovery time objective	Max acceptable downtime
Full backup	All files
Incremental backup	Changes since last backup
Differential backup	Changes since last full
Archive creation	`tar -czvf`
Archive verification	`tar -tzvf`
Snapshot backup	`rsync --link-dest`

Key takeaways:

The 3-2-1 rule is the minimum. Three copies, two media types, one off-site. A single backup is not a backup strategy. The physical separation protects against the site loss.
The RPO and RTO drive the strategy. The RPO determines the backup frequency. The RTO determines the restore strategy. The backup that meets the RPO but not the RTO is a backup that saves the data but takes too long to restore.
The incremental backup requires the chain. The restore requires the full backup plus every incremental backup. The differential backup requires only the full backup plus the latest differential. The trade-off is the backup time versus the restore time.
The restore test is mandatory. A backup that has never been restored is a backup that might not work. The tar -tzvf verifies the archive, and the diff -r compares the restore to the source.
The rsync --link-dest is the snapshot. It creates a full backup with hard links for the unchanged files, which saves the storage. The ln -sfn updates the latest link.

Remember: The backup strategy is the insurance policy. The 3-2-1 rule is the coverage. The RPO is the deductible. The RTO is the response time. The backup type is the premium. The restore test is the claim. The exam tests the concepts and the commands.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!