LFCS 148 🐧 Backup with tar - KandZ

⏱️ Estimated read: 11 min | |

The previous chapter covered the conceptual backup strategies: the 3-2-1 rule, the RPO and RTO, and the distinction between full, incremental, and differential backups. This chapter covers the practical tool that implements those strategies on Linux: tar (Tape ARchive). Despite the name, tar is not just for tapes. It is the standard archiver for Linux, and it is used for backups, software distribution, and container image layers. The LFCS exam tests the three modes (create, extract, list), the compression options (-z, -j, -J), the exclusion flags (--exclude), the preservation flags (-p), and the incremental backup with --listed-incremental. The critical trap is the file overwrite behavior: tar -x overwrites the existing files without a prompt, and the extracted files can overwrite the ones outside the target directory if the archive contains absolute paths.

Key point: The tar command has three primary modes: -c (create), -x (extract), and -t (list). The -f flag specifies the archive file. The -v flag is verbose. The -z flag compresses with gzip, -j with bzip2, and -J with xz. The -p flag preserves the permissions. The --exclude flag skips matching files. The --listed-incremental flag creates an incremental backup. The archive of a directory should be created from the parent directory, not from inside the directory, to avoid the absolute path problem.

Why tar requires a specific mental model

The mode problem. tar does not infer the mode from the arguments. The -c, -x, and -t flags are mutually exclusive and must be specified. The -c mode creates an archive from the file list. The -x mode extracts the archive to the current directory or to the -C directory. The -t mode lists the contents without extracting. A command without one of the three modes produces a usage error.

The compression problem. The -z, -j, and -J flags are the compression modifiers. The -z is gzip, which is the fastest and the most compatible. The -j is bzip2, which compresses better but is slower. The -J is xz, which compresses the best but is the slowest. The compression is applied to the entire archive, not to the individual files. The .tar.gz, .tar.bz2, and .tar.xz extensions are the conventions.

The absolute path problem. The tar -czvf /backup/home.tar.gz /home/user/ command creates an archive with the absolute paths (/home/user/). When the archive is extracted, the files are restored to the absolute paths, which overwrites the existing files. The tar -czvf /backup/home.tar.gz -C /home user/ command is the safer form: it changes to /home and archives the relative path user/. The extraction restores the files under the current directory, not to the absolute path.

The permission problem. The tar -x command restores the permissions from the archive, but only if the extracting user has the permission to set them. The -p flag (or --preserve-permissions) preserves the ownership and the permissions. A regular user cannot restore the ownership of the files that belong to another user. The root user can. The backup of the system files must be restored by root.

The incremental problem. The --listed-incremental=<file> flag creates an incremental backup. The first run is a full backup, and the subsequent runs are incremental. The <file> is the snapshot file that records the state of the filesystem at the time of the last backup. The restore requires the full backup plus the incrementals in order. The --level=N flag is the older numbered-level alternative.

The trade-off. The tar command is the universal archiver. It does not have the deduplication or the snapshot capability of rsync --link-dest or a backup tool like Borg or Restic. The tar is the low-level tool; the advanced tools build on top of it. The exam tests the tar syntax and the compression options.

a. Creating an archive

The tar -c mode creates an archive. The -f flag specifies the archive file. The -v flag is verbose. The -z, -j, and -J flags compress.

# Create an uncompressed archive
tar -cvf /backup/home.tar /home/user/

# Create a gzip archive
tar -czvf /backup/home.tar.gz /home/user/

# Create a bzip2 archive
tar -cjvf /backup/home.tar.bz2 /home/user/

# Create an xz archive
tar -cJvf /backup/home.tar.xz /home/user/

The archive stores the files with their paths. The -C flag changes to a directory before archiving. The correct form for a portable archive is:

# Archive the relative path from the parent directory
tar -czvf /backup/home.tar.gz -C /home user/

The extraction of this archive creates the user/ directory under the current directory, not the absolute /home/user/. The backup is portable and safe.

b. Extracting and listing an archive

The tar -x mode extracts. The -C flag specifies the target directory. The -t mode lists the contents without extracting.

# List the contents
tar -tzvf /backup/home.tar.gz

# Extract to the current directory
tar -xzvf /backup/home.tar.gz

# Extract to a specific directory
tar -xzvf /backup/home.tar.gz -C /tmp/restore/

# Extract a single file
tar -xzvf /backup/home.tar.gz home/user/file.txt

The tar -t is the verification step. It lists every file in the archive without extracting. The -v flag adds the permissions, the size, and the timestamp. The --wildcards flag enables the shell-style wildcards in the extract pattern.

The --strip-components=N flag removes the first N directory levels from the extracted paths. The tar -xzvf archive.tar.gz --strip-components=1 extracts the contents of home/user/ directly to the target directory, removing the home level.

c. The exclusion, preservation, and incremental flags

The --exclude flag skips files that match the pattern. The -p flag preserves the permissions. The --listed-incremental flag creates an incremental backup.

# Exclude cache and temp files
tar -czvf /backup/home.tar.gz -C /home user/ --exclude='.cache' --exclude='*.tmp'

# Exclude from a file
tar -czvf /backup/home.tar.gz -C /home user/ --exclude-from=/backup/exclude.txt

# Preserve permissions
tar -cpzvf /backup/home.tar.gz -C /home user/

# Incremental backup
tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/

The --exclude patterns are relative to the archived path. The --exclude='.cache' matches any file or directory named .cache in the archive. The --exclude-from reads the patterns from a file, one per line.

The -p flag is important for the system backups. Without it, the extraction uses the current umask, which can change the permissions of the restored files. The -p preserves the original permissions and ownership (if the extracting user has the permission to set them).

The --listed-incremental flag creates a snapshot file. The first run is a full backup. The subsequent runs are incremental. The restore is the full backup followed by the incrementals in order.

# First run: full
tar -czvf /backup/full-2026-10-30.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/

# Second run: incremental
tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/

# Restore: full then incremental
tar -xzvf /backup/full-2026-10-30.tar.gz -C /restore/
tar -xzvf /backup/inc-2026-10-31.tar.gz -C /restore/

The restore must be in order. The full backup is applied first, then the incremental backups in chronological order. The snapshot file must be kept with the backups; without it, the incremental backup cannot determine what changed.

Complete Example Session

# ============================================
# PART 1: CREATE A FULL BACKUP
# ============================================

tar -czvf /backup/home-2026-10-30.tar.gz -C /home user/

# ============================================
# PART 2: LIST THE CONTENTS
# ============================================

tar -tzvf /backup/home-2026-10-30.tar.gz | head

# ============================================
# PART 3: EXTRACT TO TEST DIRECTORY
# ============================================

mkdir -p /tmp/restore
tar -xzvf /backup/home-2026-10-30.tar.gz -C /tmp/restore/

# ============================================
# PART 4: COMPARE
# ============================================

diff -r /home/user/ /tmp/restore/user/

# ============================================
# PART 5: EXCLUDE CACHE
# ============================================

tar -czvf /backup/home-clean.tar.gz -C /home user/ --exclude='.cache' --exclude='*.tmp'

# ============================================
# PART 6: PRESERVE PERMISSIONS
# ============================================

sudo tar -cpzvf /backup/home-perm.tar.gz -C /home user/

# ============================================
# PART 7: INCREMENTAL BACKUP
# ============================================

tar -czvf /backup/full-2026-10-30.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/
tar -czvf /backup/inc-2026-10-31.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/

# ============================================
# PART 8: RESTORE INCREMENTAL
# ============================================

tar -xzvf /backup/full-2026-10-30.tar.gz -C /restore/
tar -xzvf /backup/inc-2026-10-31.tar.gz -C /restore/

# ============================================
# PART 9: SINGLE FILE EXTRACT
# ============================================

tar -xzvf /backup/home-2026-10-30.tar.gz -C /tmp/restore/ user/file.txt

The nine parts trace the tar workflow: full backup, list, extract, compare, exclude, preserve, incremental, restore, and single file.

Quick Reference

Modes

Flag	Mode
`-c`	Create
`-x`	Extract
`-t`	List

Compression

Flag	Compression	Extension
`-z`	gzip	`.tar.gz`
`-j`	bzip2	`.tar.bz2`
`-J`	xz	`.tar.xz`
(none)	Uncompressed	`.tar`

Common Options

Flag	Purpose
`-f`	Archive file
`-v`	Verbose
`-C`	Change directory
`-p`	Preserve permissions
`--exclude`	Skip pattern
`--exclude-from`	Skip from file
`--strip-components`	Remove path levels

Incremental Backup

Flag	Purpose
`--listed-incremental=<file>`	Snapshot file
`--level=N`	Numbered level

Best Practices

✅ Do This:

tar -czvf /backup/home.tar.gz -C /home user/
<!-- Use relative paths for portability -->           # ✅

tar -tzvf /backup/home.tar.gz
<!-- List the archive before extracting -->          # ✅

tar -cpzvf /backup/home.tar.gz -C /home user/
<!-- Preserve permissions -->                         # ✅

❌ Don’t Do This:

tar -czvf /backup/home.tar.gz /home/user/
<!-- Absolute paths in archive -->                   # ❌

tar -xzvf /backup/unknown.tar.gz
<!-- Extract without listing first -->               # ❌

# Forget the snapshot file for incremental
<!-- The incremental cannot determine changes -->     # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Archive extracted to absolute path	Used absolute source	Use `-C` and relative path
Permissions not preserved	No `-p`	Add `-p`
Incremental restore broken	Wrong order or missing snapshot	Restore full + incrementals in order
Exclude not working	Wrong pattern	Use the path relative to archive
Slow compression	Used `-j` or `-J`	Use `-z` for speed

Real-World Examples

1. Create gzip Archive

tar -czvf /backup/home.tar.gz -C /home user/

2. Create bzip2 Archive

tar -cjvf /backup/home.tar.bz2 -C /home user/

3. Create xz Archive

tar -cJvf /backup/home.tar.xz -C /home user/

4. List Contents

tar -tzvf /backup/home.tar.gz

5. Extract

tar -xzvf /backup/home.tar.gz -C /tmp/restore/

6. Single File

tar -xzvf /backup/home.tar.gz user/file.txt

7. Exclude

tar -czvf /backup/home.tar.gz -C /home user/ --exclude='.cache'

8. Preserve

tar -cpzvf /backup/home.tar.gz -C /home user/

9. Incremental

tar -czvf /backup/inc.tar.gz --listed-incremental=/backup/snapshot.snar -C /home user/

10. Strip Components

tar -xzvf archive.tar.gz --strip-components=1

Visual

Mode Flow

┌──────────────────────────────────────────────┐
│  tar -c (create)                             │
│  → /backup/archive.tar.gz                    │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  tar -t (list)                               │
│  → Contents of archive                       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  tar -x (extract)                            │
│  → Files restored to target                  │
└──────────────────────────────────────────────┘

Relative vs Absolute Paths

┌──────────────────────────────────────────────┐
│  tar -czvf archive.tar.gz /home/user/        │
│  → Archive contains /home/user/              │
│  → Extract writes to /home/user/ (overwrite) │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  tar -czvf archive.tar.gz -C /home user/     │
│  → Archive contains user/                    │
│  → Extract writes to ./user/ (safe)          │
└──────────────────────────────────────────────┘

Summary

Item	Value
Create	`tar -cf`
Extract	`tar -xf`
List	`tar -tf`
gzip	`-z` (`.tar.gz`)
bzip2	`-j` (`.tar.bz2`)
xz	`-J` (`.tar.xz`)
Change dir	`-C`
Preserve	`-p`
Exclude	`--exclude`
Incremental	`--listed-incremental`

Key takeaways:

The three modes are create, extract, and list. The -c, -x, and -t flags are mutually exclusive and mandatory. The -f flag is the archive file. The -v flag is verbose.
The compression flags are -z, -j, and -J. The gzip is the fastest and the most compatible. The bzip2 and xz compress better but are slower. The extension matches the compression.
The absolute path problem is the trap. The tar -czvf /backup/home.tar.gz /home/user/ creates an archive with absolute paths. The extraction overwrites the original files. The -C /home user/ form creates an archive with relative paths, which is portable and safe.
The -p flag preserves permissions. The backup of the system files must be restored by root and with the -p flag. Without it, the extraction uses the current umask.
The --listed-incremental creates an incremental backup. The snapshot file records the state. The first run is a full backup, the subsequent runs are incremental. The restore requires the full backup plus the incrementals in order.

Remember: tar is the universal archiver. The -c is create. The -x is extract. The -t is list. The -f is file. The -v is verbose. The -z is gzip. The -p is preserve. The -C is the safe form. The --listed-incremental is the incremental. The exam tests the syntax and the path trap.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!