Linux Tutorial / Create tar Backups and Verify a Restore

Compression reduces data size; a backup preserves a recoverable copy from a chosen point in time. A completed archive is not sufficient evidence of a usable backup: restore separately and verify contents, metadata, and the application’s ability to use them.

First restore a manual backup into a separate location and compare contents and permissions. Automate that verified procedure in scheduled backups and independent health checks.

Distinguish compression, archiving, and synchronization

A second directory on the same disk may help with an accidental overwrite but can disappear with the disk. Plan independent storage, multiple recovery points, and copies that compromised production credentials cannot immediately modify. If encrypting backups, protect the keys separately and ensure authorized recovery staff can retrieve them.

Prepare a small isolated source tree

lab=$(mktemp -d "$HOME/linux-backup-lab.XXXXXX")
mkdir -p "$lab/source/docs" "$lab/archives" "$lab/restore"
printf "version 1\n" > "$lab/source/docs/note.txt"
printf "enabled=yes\n" > "$lab/source/settings.conf"
chmod 600 "$lab/source/settings.conf"
find "$lab/source" -type f -print

Confirm that the source is under the newly created temporary directory. The archive is kept outside the source, avoiding accidental inclusion of the backup itself. This lab handles ordinary user files; it does not validate root ownership, access-control lists, extended attributes, or database consistency.

Create an archive with relative member paths

tar -czf "$lab/archives/source.tar.gz" -C "$lab" source
tar -tzf "$lab/archives/source.tar.gz"
(cd "$lab/archives" && sha256sum source.tar.gz > source.tar.gz.sha256)
(cd "$lab/archives" && sha256sum -c source.tar.gz.sha256)

-c creates, -z selects gzip, and -f names the archive. -C chooses a base directory so the archive stores source/... rather than absolute paths. Verify the two expected files and an OK checksum result. A checksum detects a change relative to the recorded digest; it does not authenticate data against an attacker who can replace both files.

Restore elsewhere and compare the result

tar -xzf "$lab/archives/source.tar.gz" -C "$lab/restore"
diff -r "$lab/source" "$lab/restore/source"
stat -c "%a %n" "$lab/source/settings.conf" "$lab/restore/source/settings.conf"
cat "$lab/restore/source/docs/note.txt"

A silent diff with status 0 indicates matching traversed contents. Compare mode 600 using stat and read version 1 from the restored file. Diff does not validate all ownership, ACL, or extended-attribute requirements, so a production restore needs additional metadata checks.

Change the original note to version 2 and rerun diff to observe a difference. The archive still contains version 1, demonstrating the difference between synchronization and point-in-time recovery. Keep the restored copy separate while checking it instead of overwriting the original.

Handle untrusted archives and live services deliberately

Inspect an unfamiliar archive before extracting it into a fresh isolated directory as an unprivileged account. Check unexpected paths, symbolic links, counts, and sizes. Do not extract it as root into the system tree. Listing an archive is not a complete safety guarantee, so separate it from important systems.

Archiving a live database directory can mix inconsistent file states. Use the database’s supported logical or physical backup procedure and its consistency requirements, including quiescing or coordinated snapshots where applicable. Define acceptable data loss and recovery time, then evaluate them through a real restore.

Preview synchronization before applying it

rsync -av --dry-run "$lab/source/" "$lab/restore/source/"

With rsync installed, --dry-run previews changes. A trailing slash on the source means its contents rather than the containing directory. This example omits --delete, which can remove destination-only files. Verify both paths and retain independent recovery points before applying synchronization.

Official references

• GNU tar manual
• Official rsync manual
• GNU SHA-2 checksum tools