Backup and recovery strategies are the safety net for your digital life. They ensure that when a hard drive fails, a file gets deleted by accident, or a system is compromised by malware, you can restore everything to a working state. For the LPIC-1 exam, you need to know the tools that make this possible — rsync, cpio, and dd — and how to use them correctly so you can pass the test and protect real data in a job.
Jump to a section
A simple way to picture Backup and Recovery Strategies
You have 37 moving boxes organised in your new garage after a house move. Each box contains specific items: one has kitchen utensils, another has books, and a third has holiday decorations. Your friend asks to borrow your spare kettle, which is in the kitchen box. You could lug the entire heavy kitchen box into the living room, rummage through everything, and then haul it back. That is like backing up your entire computer every day — slow and wasteful.
Instead, you simply open the kitchen box in the garage, pull out the kettle, and hand it to your friend. This is incremental backup: you only copy the changed items, like the kettle, not the whole box. Now, imagine a shelf collapse that crushes the kitchen box but leaves the others untouched. Because you kept each box separate, you do not lose the books or decorations. This mirrors a full backup strategy where you keep separate copies for different data types. The garage itself is your off-site location — it protects your boxes from a house fire. In IT, rsync works like your careful hands: it only moves what has changed, saving time and space. dd, on the other hand, is like making an exact, block-by-block copy of a box by taking a photograph of every single item's position, even the dust between the plates. This is how you clone an entire hard drive.
Backup and recovery is the practice of copying data so you can restore it after a loss. The core idea is simple: you have a source (the original data) and a destination (the backup storage). The tools you use define how efficiently and accurately that copy is made.
Let us start with rsync. It stands for 'remote synchronisation'. Rsync is a command-line tool that copies files from one location to another, but with a clever trick: it only transfers the parts of files that have changed since the last copy. This is called delta encoding. Think of a 10-page document. If you edit page 3, rsync does not send all ten pages again. It sends only the changed blocks on page 3. This saves enormous amounts of time and bandwidth, especially for large files or slow network connections. You use it like this: rsync -av /home/user /backup/. The -a flag stands for archive mode, which preserves permissions, timestamps, and other attributes. The -v flag makes it verbose, so you can see what it is doing. Rsync can copy locally between folders or remotely over SSH (Secure Shell), which encrypts the data in transit.
Next is cpio, which stands for 'copy in, out'. It is older than rsync and works with streams. Cpio takes a list of files from standard input (stdin) and packages them into a single archive file sent to standard output (stdout). It is often combined with tools like find to select files. For example: find /home/user -name '*.txt' | cpio -ov > backup.cpio. The -o flag means 'output mode', creating an archive. The -v flag is verbose. To restore, you use cpio -idv < backup.cpio, where -i means input mode and -d creates directories as needed. Cpio is useful when you need to back up files that match complex criteria, because you can pipe any list of files into it. It is also very portable across Unix-like systems.
Then there is dd, short for 'data duplicator'. Unlike rsync and cpio, which work at the file level, dd works at the block level. It reads raw data directly from a storage device, block by block, and writes it to another device or file. This means it copies everything — the files, the file system structure, the boot loader, even empty space. You might use it to clone an entire hard drive: dd if=/dev/sda of=/dev/sdb bs=4M status=progress. Here, if stands for input file (the source drive), of stands for output file (the destination drive), bs is block size (4 megabytes), and status=progress shows you how far along the copy is. Because dd operates at the block level, it can recover data from damaged drives where the file system can no longer be read. However, it is also dangerous: a simple mistake like swapping if and of can overwrite your source drive with garbage.
Why do we need these different tools? Each solves a different problem. Rsync is ideal for regular backups of changing data over a network. Cpio is perfect for one-off backups of specific file selections, especially when combined with other commands. Dd is the tool of last resort for cloning drives or recovering raw data from failing hardware. In the LPIC-1 exam, you will be asked to choose the right tool for a given scenario, so understanding their differences is critical.
Recovery is the reverse process. With rsync, you simply reverse the source and destination in the command to restore files. With cpio, you extract the archive. With dd, you run the same command but swap the input and output files. The key point is that a backup is useless if you cannot restore it. Therefore, you must always test your backups by performing a recovery to a temporary location to ensure the data is intact and readable.
Assess the data and choose a tool
First, determine what you need to back up: individual files, a directory, or an entire drive. For individual files that change often, use rsync. For a specific set of files found by a search, use cpio. For a full disk clone or raw recovery, use dd. Choosing the wrong tool can waste time or fail to protect the data.
Set up the backup destination
Identify where the backup will be stored. This could be a different hard drive, a network-attached storage (NAS) device, or a cloud storage volume. Ensure the destination has enough free space. For rsync, the destination can be a local path or a remote path via SSH, like `user@server:/backup/`. For dd, the destination is typically a block device or a file.
Execute the backup command
Run the chosen tool with the correct options. For rsync: `rsync -av /source /destination`. For cpio: first generate a file list (e.g., `find /source -name '*.pdf'`), then pipe it into `cpio -ov > backup.cpio`. For dd: `dd if=/dev/sda of=/dev/sdb bs=4M status=progress`. Always double-check the source and destination paths to avoid data loss.
Verify the backup integrity
After the backup completes, you must verify it. For rsync and cpio, you can compare file lists or run a checksum on a sample of files. For dd, you can perform a test restore to a different location and compare the checksum of the restored data against the original. A backup that cannot be read back is worthless.
Test the recovery procedure
Perform a full recovery test in a sandboxed environment, such as a virtual machine or a spare directory. Extract the cpio archive with `cpio -idv < backup.cpio` or reverse the rsync command: `rsync -av /backup/source /original/location`. For dd, boot from a live USB and use `dd if=backup.img of=/dev/sda`. Check that all files open correctly and applications work.
An IT professional at a small company needs to protect the payroll database, which is updated weekly. The database file is 50 gigabytes. He also wants to back up the company's shared drive, which contains thousands of small documents that change daily.
For the shared drive, he uses rsync. He writes a cron job (a scheduled task) that runs every night: rsync -av --delete /shared /backup/shared. The --delete flag is crucial: it removes files from the backup that have been deleted from the source. This ensures the backup mirrors the current state of the shared drive. He runs this over the local network to a NAS (Network Attached Storage) device. Because rsync uses delta encoding, only changed parts of files are transferred, so the nightly backup takes just minutes.
For the payroll database, he cannot use rsync because the database is often open and in use. He uses a combination of cpio and a database dump. He first runs a command to export the database to a plain SQL file: mysqldump -u root payroll > /tmp/payroll.sql. Then he backs up that file with cpio: echo '/tmp/payroll.sql' | cpio -ov > /backup/payroll/$(date +%Y%m%d).cpio. He keeps the last four weekly backups by naming them with dates. To recover, he runs cpio -idv < /backup/payroll/20250401.cpio to extract the SQL file, then imports it back into the database.
For the company's server operating system, he keeps a dd image of the boot drive. Once a quarter, he boots from a live USB and runs: dd if=/dev/sda of=/backup/server_image_2025Q1.img bs=4M status=progress. This captures the entire system, including the boot loader. If the hard drive fails, he can swap in a new drive and restore the image with: dd if=/backup/server_image_2025Q1.img of=/dev/sda bs=4M status=progress. This gets the server back online in under an hour.
The professional also labels all backups with dates and tests the recovery steps in a virtual machine every time a new backup strategy is introduced. He uses separate physical disks for backups, not the same disk as the original data. He stores one off-site copy, either in a cloud storage volume mounted via SSH or on a portable drive kept in a fireproof safe.
The LPIC-1 exam specifically tests your ability to choose and use rsync, cpio, and dd for backup and recovery. They love to set traps around common syntax errors and misuse of options.
Here are the key topics they test:
The -a (archive), -v (verbose), and -z (compress) options for rsync. They will ask which flags preserve file permissions. The answer is -a.
The --delete flag for rsync. They will ask what happens if you add this flag — the answer is that files deleted from the source are also deleted from the destination.
The difference between cpio's -o (output/create archive), -i (input/extract archive), and -p (pass-through/copy files directly). They will ask which flag creates a new archive. The answer is -o.
The correct order of operands in dd: if= before of=. A common trap is to show a command with if and of swapped, which would destroy the source drive.
The bs= (block size) option in dd and how a larger block size can speed up the copy.
The conv=noerror and conv=sync options for dd, which allow you to copy data from a failing drive by ignoring read errors and padding unreadable sectors.
Traps they set:
They might show an rsync command without -a and ask whether file permissions are preserved. They are not.
They might present a cpio command with -i (extract) combined with the wrong file redirection. You must know that input comes via < from a file, not directly as an argument.
They might ask which tool is best for cloning a hard drive. The correct answer is dd, not rsync or cpio.
They might ask about 'incremental backup' and expect you to select a scenario that mirrors what rsync does, but then the answer choices include dd with a large block size. Only rsync provides true incremental capability.
To memorise: '- a in rsync means archive, preserving everything. - o in cpio means output (create). - if= in dd is input file (source). - conv=noerror is for ignoring errors while copying.'
Also, expect one question about verifying backups. The standard way is to run a test restore to a separate directory and then compare checksums using md5sum or sha256sum. They may also ask about the --dry-run option in rsync, which shows what would happen without actually copying anything — useful for testing.
Rsync uses delta encoding to transfer only the changed parts of files, making it ideal for incremental backups over a network.
The `-a` (archive) flag in rsync preserves permissions, ownership, timestamps, and symbolic links during a backup.
Cpio operates on file lists piped from standard input, making it perfect for backing up files that match specific criteria found by commands like `find`.
Dd copies raw data at the block level, not the file level, so it can clone entire drives including boot sectors and empty space.
In a dd command, `if=` specifies the input file (source) and `of=` specifies the output file (destination); swapping these will destroy the source data.
A backup is only reliable if you test it by performing a full restore to a separate location and verifying the data with checksums.
Always store backups on a separate physical device or off-site to protect against hardware failure, theft, or natural disaster.
These come up on the exam all the time. Here's how to tell them apart.
rsync
Transfers only changed parts of files (delta encoding)
Works at the file level, preserving metadata with -a flag
Best for periodic, incremental backups over networks
cpio
Creates a full archive of all listed files
Operates on a stream of filenames from stdin, not directories
Best for one-time backups of files matching complex criteria
dd
Copies raw blocks, including empty space and boot sectors
Can clone entire hard drives and partitions
Used for low-level recovery and forensic imaging
rsync
Copies only file contents, not empty space
Cannot clone boot loaders or partition tables
Used for regular file-level backups over networks
Full backup
Copies all selected data every time
Takes longer and uses more storage space
Simplifies restoration (only one archive needed)
Incremental backup
Copies only data that changed since the last full backup
Faster and uses less storage space
Restoration requires the full backup plus all subsequent incremental backups
Mistake
Backing up your files to a different folder on the same hard drive is a safe backup strategy.
Correct
If the hard drive fails entirely, both the original and the backup are lost. A backup must be on a different storage device, ideally in a different physical location.
Newcomers often think 'save a copy' is enough, not realising that a single hardware failure wipes out everything on that drive.
Mistake
The dd command works at the file level, so it can backup individual documents.
Correct
Dd works at the block level, copying raw data from an entire drive or partition. It does not understand files or file systems. To back up individual files, you should use rsync or cpio.
The name 'data duplicator' sounds like it should handle files. Beginners assume it works like cp (copy) but for bigger data.
Mistake
Rsync always compresses data during transfer by default.
Correct
Rsync does not compress data unless you explicitly add the `-z` flag. Without it, data is transferred uncompressed for maximum speed on local networks.
Many people associate rsync with network transfers and assume compression is automatic, but it is an optional feature to save bandwidth at the cost of CPU time.
Mistake
Cpio is a modern replacement for tar and is always better for creating archives.
Correct
Cpio is older than tar and is not a direct replacement. Tar is more common for general archiving. Cpio excels when you need to pipe file lists from other commands, like `find`, into an archive.
Because cpio appears in the LPIC-1 objectives alongside tar, beginners assume it is a modern, improved version. Actually, it is an alternative with a different use case.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Rsync transfers only changed parts of files and is best for ongoing backups of changing data over a network. Cpio creates archives from a list of files piped from another command and is better for one-time backups of specific file selections.
Technically yes, but dd backs up the entire partition or device, including empty space and system files you do not need. For a home directory, rsync or cpio are much more efficient because they only include the files you want.
The --delete flag makes rsync remove files from the destination that were deleted from the source. This ensures the backup is an exact mirror of the source, which is useful but dangerous if you accidentally delete something you need.
Use the command `cpio -idv < archive.cpio` in the directory where you want the files restored. The `-i` flag means input mode, `-d` creates directories, and `-v` shows progress. The files will be extracted with their original paths relative to your current directory.
The `bs=` parameter sets the block size for reading and writing. A larger block size (like 4M) speeds up the copy because fewer read/write operations are needed. A very small block size (like 512 bytes) is slower but uses less memory. The default is 512 bytes.
The best way is to perform a test restore to a separate location and then compare checksums of the original and restored files using `md5sum` or `sha256sum`. If the checksums match, the backup is intact.
You've finished Backup and Recovery Strategies. Continue through the LPIC-1 study guide to build a complete picture of the exam.
Done with this chapter?