tar command in Linux: archiving and extracting files, examples

Q: Extracted it and scattered files into the current directory (a "tar bomb")

An archive with no top-level directory. First check tar tzf a.tar.gz | head; extract into a separate -C /tmp/x. --strip-components=1 removes an extra top-level directory.

Q: Permission denied / owners were lost

Extract system backups as root and with -p (permissions) / --same-owner (owners, the default for root).

Q: Very slow / a large archive

xz (J) compresses harder but is slower; gzip (z) is a balance; for multi-core, use pigz (tar -c dir | pigz > a.tgz). For incremental backups, rsync is better.

Q: Don't overwrite existing files on extraction

--keep-old-files (error if it exists) or --skip-old-files (skip it).

Overview

tar packs a tree of files into a single archive (.tar), often with compression (.tar.gz, .tar.xz). Flag mnemonic: create / extract / tlist, verbose, file, z=gzip, j=bzip2, J=xz.

Options

11

/

f requires an argument — the archive name — and by convention goes last in a group of letters (czf, not fcz). Before extracting an unfamiliar archive for the first time, look at its contents with tar tzf: if the listing has no common top-level directory, extraction will scatter files straight into the current directory.

Option	What it does	Example
`-c` `--create`	Create a new archive.	`tar czf backup.tar.gz /etc`
`-x` `--extract`	Extract files from an archive.	`tar xzf backup.tar.gz -C /restore`
`-t` `--list`	List the archive's contents without extracting.	`tar tvzf backup.tar.gz`
`-f` `--file` FILE	Archive file name; placed last in a group of single-letter flags.	`tar czf backup.tar.gz dir`
`-z` `--gzip`	gzip compression — a fast balance of speed and size.	`tar czf backup.tar.gz dir`
`-C` DIR	Change directory before packing or extracting.	`tar xzf backup.tar.gz -C /restore`
`-v` `--verbose`	Print the list of files being processed.	`tar czvf backup.tar.gz dir`
`-J` `--xz`	xz compression — stronger than gzip, but noticeably slower.	`tar cJf backup.tar.xz dir`
`--exclude` PATTERN	Exclude files and directories matching a pattern.	`tar czf b.tar.gz --exclude='*.log' dir`
`-p` `--preserve-permissions`	Preserve file permissions on extraction.	`sudo tar xpzf backup.tar.gz -C /`
`--strip-components` N	Strip N leading directory components on extraction.	`tar xzf release.tar.gz --strip-components=1`

Nothing found. Try a shorter query.

Recipes

1

Commands

bash

# create
tar czf backup.tar.gz /etc                 # pack /etc with gzip
tar cJf backup.tar.xz dir                  # with xz (stronger, slower)
tar czf b.tar.gz -C /var/www site          # pack site while inside /var/www (no /var/www/ in paths)
tar czf b.tar.gz --exclude='*.log' --exclude='cache' dir

# extract
tar xzf backup.tar.gz                      # extract here
tar xzf backup.tar.gz -C /restore          # extract into a directory
tar xzf b.tar.gz --strip-components=1       # strip the top directory (common with releases)
tar xzf backup.tar.gz etc/hosts            # extract a single file

# view/verify (without extracting)
tar tzf backup.tar.gz | head               # the listing
tar tvzf backup.tar.gz                     # with permissions/sizes/dates

# over the network (no intermediate file):
tar cz dir | ssh host 'tar xz -C /dest'    # send a tree to a host (see ssh-client)

Troubleshooting

5

tar: Removing leading '/'

Normal: tar stores relative paths (so it doesn't overwrite the system on extraction). Extract into the right directory with -C.

Extracted it and scattered files into the current directory (a "tar bomb")

An archive with no top-level directory. First check tar tzf a.tar.gz | head; extract into a separate -C /tmp/x. --strip-components=1 removes an extra top-level directory.

Permission denied / owners were lost

Extract system backups as root and with -p (permissions) / --same-owner (owners, the default for root).

Very slow / a large archive

xz (J) compresses harder but is slower; gzip (z) is a balance; for multi-core, use pigz (tar -c dir | pigz > a.tgz). For incremental backups, rsync is better.

Don't overwrite existing files on extraction

--keep-old-files (error if it exists) or --skip-old-files (skip it).

Danger zone

Extracting an unknown archive without previewing it first (tar tzf) can scatter hundreds of files into the current directory on top of existing ones — overwritten files can only be recovered from a backup. Extract unfamiliar archives into a separate empty directory (-C /tmp/x), not into a place that already holds important files.

Terms

5

backup copy: A data copy for recovery after a specified event; completeness, availability and recoverability require verification. Also appears in: fdisk and parted
restore test: A practical check that a backup produces the required recovered state.
archive member: A named object with contents or metadata stored within an archive.
restoration staging directory: A separate location to extract and verify recovered data before replacing the working version.
backup manifest: A description of expected backup objects and meaningful properties for checking completeness and recovery.

tar — archiving and extracting files

Cheat sheet