LFCS 150 🐧 Restore Procedures - KandZ

⏱️ Estimated read: 10 min | |

The previous chapters covered backup strategies and the tools that create the backups: tar and rsync. This chapter covers the reverse operation: the restore. A backup that has never been restored is a backup that might not work. The restore is not a single command; it is a sequence of decisions that determine whether the data is recovered correctly and how long it takes. The LFCS exam tests the distinction between a full restore and a selective restore, the order of the restore for the incremental chains, the verification step that confirms the data is correct, and the recovery of the bootloader and the system files. The critical trap is the restore of a system that has already been partially recovered. The restore should be performed on a clean target, not on a partially overwritten system, because the stale files and the inconsistent permissions are the source of subtle failures.

Key point: A restore has three phases: prepare the target, apply the backup, and verify the result. The target must be clean for the full restore. The incremental backup chain must be applied in chronological order. The verification confirms that the restored data matches the backup and that the permissions are correct. The bootloader and the filesystem metadata may require additional restore steps beyond the file copy.

Why restore procedures require a specific mental model

The full versus selective problem. A full restore recovers the entire system or the entire data set. A selective restore recovers a specific file or a directory. The full restore is the disaster recovery scenario: the disk failed, the system is rebuilt, and the entire backup is applied. The selective restore is the daily scenario: a file was deleted, and the backup copy is restored without touching the rest of the system. The two scenarios use different commands and different caution.

The restore order problem. The incremental backup chain must be applied in chronological order. The full backup is applied first, then the first incremental, then the second incremental, and so on. The restore order is the only way to reconstruct the final state. The tar archive is the same: the full backup followed by the incrementals in the order they were created.

The target state problem. The restore should be applied to a clean target. The rsync with the --delete flag makes the target match the source, which effectively cleans the stale files. The tar extraction into a directory with existing files is the source of the conflict: the archive files overwrite the existing files, but the files that are not in the archive remain. The restore to a clean directory is the correct approach for the full recovery.

The bootloader problem. The filesystem backup does not include the bootloader. The /boot partition and the MBR/GPT are separate from the files. The restore of the system requires the reinstall of the bootloader with grub-install and the regeneration of the initramfs with dracut (RHEL) or update-initramfs (Debian). The restore of the data is not the restore of the bootability.

The permission and SELinux problem. The restored files must have the correct ownership and permissions. The tar -p flag preserves them, and the rsync -a preserves them by default. The SELinux contexts are also part of the file metadata. The restorecon -Rv / command relabels the restored files according to the policy. Without it, the system may fail to boot or the services may be denied.

The trade-off. The full restore is slower and more disruptive, but it is the only reliable recovery from the disk failure. The selective restore is faster and less disruptive, but it requires the precise identification of the file and the correct target path. The exam tests both and the verification.

a. The full restore from tar

The full restore extracts the archive to the target directory. The -C flag specifies the target. The -p flag preserves the permissions. The -v flag is verbose.

# Extract the full backup to the root of the new filesystem
sudo tar -xpzvf /backup/full-2026-10-30.tar.gz -C /mnt/new-root/

# Extract the incremental backups in order
sudo tar -xpzvf /backup/inc-2026-10-31.tar.gz -C /mnt/new-root/
sudo tar -xpzvf /backup/inc-2026-11-01.tar.gz -C /mnt/new-root/

The -C /mnt/new-root/ targets the mounted new filesystem. The -p preserves the permissions and ownership (the command requires root). The -x is the extract mode. The -z is the gzip decompression. The -v shows the extracted files.

The --listed-incremental restore is the same sequence. The full backup is applied first, then the incrementals.

b. The selective restore from tar

The selective restore extracts a single file or a directory from the archive. The path must match the path in the archive.

# List the archive to find the file
tar -tzvf /backup/full-2026-10-30.tar.gz | grep "file.txt"

# Extract the single file
tar -xzvf /backup/full-2026-10-30.tar.gz -C /tmp/restore/ home/user/file.txt

The grep filter finds the exact path. The -C /tmp/restore/ is the safe target. The extraction creates the home/user/file.txt under the target, not in the actual /home/user/file.txt. The administrator then copies the file to the correct location after verifying its content.

The --strip-components flag removes the leading directory levels. The tar -xzvf archive.tar.gz --strip-components=2 -C /tmp/restore/ home/user/file.txt extracts the file.txt directly to /tmp/restore/ without the home/user/ path.

c. The full restore with rsync

The rsync -a --delete command restores the backup to the target. The --delete flag removes the files in the target that are not in the source, which makes the target an exact mirror.

# Restore the backup to a mounted new filesystem
sudo rsync -aHAX --delete /backup/home/ /mnt/new-root/home/

The -a preserves the permissions and the timestamps. The -H preserves the hard links. The -A preserves the ACLs. The -X preserves the extended attributes. The --delete removes the stale files.

The snapshot backup with --link-dest is restored by copying the latest snapshot. The snapshot is a full directory tree, so the restore is a simple rsync.

# Restore the latest snapshot
sudo rsync -aHAX /backup/latest/ /mnt/new-root/home/

The restore from the snapshot is faster than the tar extraction because the files are already on disk. The restore from the tar archive requires the extraction, which is CPU-intensive for the compressed archives.

Complete Example Session

# ============================================
# PART 1: PREPARE THE TARGET
# ============================================

sudo mkfs.ext4 /dev/sdb1
sudo mount /dev/sdb1 /mnt/new-root/

# ============================================
# PART 2: RESTORE THE FULL TAR BACKUP
# ============================================

sudo tar -xpzvf /backup/full-2026-10-30.tar.gz -C /mnt/new-root/

# ============================================
# PART 3: RESTORE THE INCREMENTALS
# ============================================

sudo tar -xpzvf /backup/inc-2026-10-31.tar.gz -C /mnt/new-root/
sudo tar -xpzvf /backup/inc-2026-11-01.tar.gz -C /mnt/new-root/

# ============================================
# PART 4: VERIFY THE RESTORE
# ============================================

sudo diff -r /home/user/ /mnt/new-root/home/user/
# No output: the files match.

# ============================================
# PART 5: RESTORE WITH RSYNC
# ============================================

sudo rsync -aHAX --delete /backup/home/ /mnt/new-root/home/

# ============================================
# PART 6: RESTORE A SINGLE FILE
# ============================================

tar -xzvf /backup/full-2026-10-30.tar.gz -C /tmp/restore/ home/user/file.txt
cp /tmp/restore/home/user/file.txt /home/user/file.txt

# ============================================
# PART 7: RESTORE THE BOOTLOADER
# ============================================

# Chroot to the new root
sudo mount --bind /dev /mnt/new-root/dev
sudo mount --bind /proc /mnt/new-root/proc
sudo mount --bind /sys /mnt/new-root/sys
sudo chroot /mnt/new-root/
grub-install /dev/sdb
grub-mkconfig -o /boot/grub/grub.cfg

# ============================================
# PART 8: RESTORE SELINUX CONTEXTS
# ============================================

sudo restorecon -Rv /mnt/new-root/

# ============================================
# PART 9: REBOOT AND VERIFY
# ============================================

sudo umount /mnt/new-root/
sudo reboot

The nine parts trace the restore procedure: prepare, full restore, incremental restore, verify, rsync restore, single file, bootloader, SELinux, and reboot.

Quick Reference

tar Restore

Flag	Purpose
`-x`	Extract
`-p`	Preserve permissions
`-v`	Verbose
`-C`	Target directory
`--strip-components`	Remove path levels

rsync Restore

Flag	Purpose
`-a`	Archive mode
`-H`	Hard links
`-A`	ACLs
`-X`	Extended attributes
`--delete`	Mirror target

Verification

Command	Purpose
`diff -r`	Compare directories
`tar -t`	List archive
`sha256sum`	Verify checksums

Bootloader

Command	Purpose
`chroot`	Enter new root
`grub-install`	Install bootloader
`grub-mkconfig`	Regenerate config
`restorecon -Rv`	Relabel SELinux

Best Practices

✅ Do This:

sudo tar -xpzvf /backup/full.tar.gz -C /mnt/new-root/
<!-- Restore with permissions to a clean target -->   # ✅

sudo diff -r /home/user/ /mnt/new-root/home/user/
<!-- Verify the restore -->                           # ✅

sudo restorecon -Rv /mnt/new-root/
<!-- Relabel SELinux contexts -->                     # ✅

❌ Don’t Do This:

# Restore over a running system
<!-- Inconsistent state, partial overwrite -->        # ❌

# Skip the bootloader restore
<!-- The system does not boot -->                     # ❌

# Restore incrementals in the wrong order
<!-- Wrong final state -->                           # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Restore fails to boot	No bootloader install	`grub-install` + `grub-mkconfig`
Permissions wrong	No `-p` or `-a`	Use `-p` or `-a`
SELinux denials after restore	No relabel	`restorecon -Rv`
Incremental restore wrong	Wrong order	Full + incrementals in order
Files missing	No `--delete`	Use `--delete` or restore to clean target

Real-World Examples

1. Prepare Target

sudo mkfs.ext4 /dev/sdb1
sudo mount /dev/sdb1 /mnt/new-root/

2. Full Restore

sudo tar -xpzvf /backup/full.tar.gz -C /mnt/new-root/

3. Incremental Restore

sudo tar -xpzvf /backup/inc.tar.gz -C /mnt/new-root/

4. Verify

sudo diff -r /home/user/ /mnt/new-root/home/user/

5. rsync Restore

sudo rsync -aHAX --delete /backup/home/ /mnt/new-root/home/

6. Single File

tar -xzvf /backup/full.tar.gz -C /tmp/ home/user/file.txt

7. Chroot

sudo mount --bind /dev /mnt/new-root/dev
sudo chroot /mnt/new-root/

8. Bootloader

grub-install /dev/sdb
grub-mkconfig -o /boot/grub/grub.cfg

9. SELinux

sudo restorecon -Rv /mnt/new-root/

10. Reboot

sudo reboot

Visual

Full Restore Flow

┌──────────────────────────────────────────────┐
│  Prepare clean target                        │
│  mkfs + mount                                │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Extract full backup                         │
│  tar -xpzvf full.tar.gz -C /mnt/root/       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Extract incrementals in order               │
│  tar -xpzvf inc1.tar.gz -C /mnt/root/       │
│  tar -xpzvf inc2.tar.gz -C /mnt/root/       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Restore bootloader                          │
│  chroot + grub-install                       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Relabel SELinux + verify                    │
│  restorecon + diff                           │
└──────────────────────────────────────────────┘

Verification

┌──────────────────────────────────────────────┐
│  Source: /home/user/                         │
│  Restored: /mnt/new-root/home/user/          │
└──────────────────┬───────────────────────────┘
                   │
                   │ diff -r
                   ▼
┌──────────────────────────────────────────────┐
│  No output: restore is correct               │
│  Differences: investigate                    │
└──────────────────────────────────────────────┘

Summary

Item	Value
Full tar restore	`tar -xpzvf archive -C target`
Incremental order	Full then incrementals
rsync restore	`rsync -aHAX --delete`
Single file restore	`tar -xzvf archive -C target path`
Verification	`diff -r`
Bootloader	`grub-install` + `grub-mkconfig`
SELinux	`restorecon -Rv`
Chroot	`chroot /mnt/new-root/`

Key takeaways:

The restore has three phases: prepare, apply, verify. The target must be clean. The backup is applied. The verification confirms the result. A restore without verification is a restore that might not be correct.
The incremental chain must be in order. The full backup is applied first, then the incrementals in chronological order. The wrong order produces a wrong final state.
The bootloader is not in the file backup. The /boot partition and the MBR/GPT are separate. The grub-install and grub-mkconfig restore the bootability. The chroot is the mechanism for running the bootloader tools against the new root.
The SELinux contexts must be relabeled. The restorecon -Rv command applies the policy’s default context to the restored files. Without it, the services may be denied.
The rsync --delete is the mirror restore. It makes the target an exact copy of the backup, removing the stale files. The tar extraction requires a clean target, or the --delete equivalent is not available.

Remember: The restore is the test of the backup. The full restore is the disaster recovery. The selective restore is the daily recovery. The bootloader is the bootability. The SELinux is the policy. The verification is the proof. The exam tests the order and the verification.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!