Linux Backup and Disk Imaging Cheat Sheet

cp -a /src/. /dst/

# Preserve mode, ownership, timestamps, and symlinks.

rsync -aHAX --info=progress2 /src/ /dst/

# Powerful local or remote copy preserving metadata and ACLs when supported.

rsync -a --delete /src/ /dst/

# Make the destination match the source exactly.

rsync -aP /src/ user@host:/backup/

# Efficiently transfer deltas to a remote server.

tar -czf backup.tar.gz /data

# Package and compress a directory tree.

tar -xzf backup.tar.gz -C /restore

# Restore archive contents to a target directory.

tar -tf backup.tar.gz

# Inspect what an archive contains before extracting.

find . -print | cpio -ov > archive.cpio

# Useful in some initramfs and recovery workflows.

tar -cf - /data | pv | gzip > backup.tar.gz

# Add transfer progress to streaming backup pipelines.

sha256sum backup.tar.gz > backup.tar.gz.sha256

# Record integrity hashes for backup artifacts.

sudo dd if=/dev/sdb of=disk.img bs=64K status=progress conv=sync,noerror

# Image a disk device to a raw file.

sudo dd if=disk.img of=/dev/sdb bs=64K status=progress conv=fsync

# Restore a disk image onto a target device.

sudo ddrescue -f -n /dev/sdb disk.img disk.log

# Preferred over dd for failing disks because it tracks progress and retries.

sudo sgdisk --backup=gpt.backup /dev/sdb

# Save GPT headers and partition entries to a file.

sudo sgdisk --load-backup=gpt.backup /dev/sdb

# Restore GPT layout from a saved backup file.

qemu-img info disk.qcow2

# Show image format, virtual size, and backing file info.

qemu-img convert -O qcow2 disk.raw disk.qcow2

# Convert between raw, qcow2, and other image formats.

gzip -1 disk.img

# Compress large raw images for storage or transfer.

xz -T0 disk.img

# Use stronger compression for cold storage backups.

cmp disk1.img disk2.img

# Quick equality check for cloned images of the same size.

iostat -xz 1

# Inspect per-device read/write rates and utilization over time.

sudo iotop

# Find which processes generate the most disk I/O.

pidstat -d 1

# Track read/write activity by process over time.

vmstat 1

# Quick check for iowait, swap, and block device pressure.

dmesg | egrep -i 'sd[a-z]|nvme|md|I/O error|ext4|xfs'

# Look for hardware and filesystem errors in kernel logs.

journalctl -k | egrep -i 'I/O error|blk_update_request|nvme|md'

# Kernel journal view for storage-related problems.

sudo ncdu /

# Find large paths interactively with a terminal UI.

find /var -xdev -type f -size +1G -printf '%s %p
' | sort -n

# Locate unexpectedly large files on a filesystem.

sudo lsof | grep '(deleted)'

# Useful when df is full but du cannot explain it.

sudo fstrim -av

# Discard unused blocks on mounted SSD-backed filesystems.