Cisco Router File System: Flash, NVRAM, and Backup Methods

Every Cisco router runs on a small, purpose-built file system that stores the IOS image, configuration files, and a handful of supporting files. Understanding how it’s organized — and how to back it up properly — is a core skill for anyone managing Cisco equipment, whether that’s for CCNA study or day-to-day network administration.

This guide covers the Cisco IOS File System (IFS) structure, what actually lives in flash versus NVRAM, how switches differ slightly from routers, and three practical ways to back up and restore a configuration.

Viewing the File System

The show file systems command lists every file system available on the device, along with its size, free space, type, and access flags:

show file systems

File System Entries

Prefix	Description	Type	Access	Notes
flash:	Primary internal storage	disk	rw	Stores the IOS image, configuration backups, and other files
nvram:	Non-volatile RAM	nvram	rw	Stores startup-config, loaded at boot
system:	Internal virtual file system	opaque	rw	Used internally by IOS; rarely accessed directly
tmpsys:	Temporary system file system	opaque	ro	Read-only, used during runtime operations
null:	Bit-bucket file system	opaque	rw	Discards unwanted output, similar to /dev/null on Linux
usbflash0:	USB storage, if connected	disk	rw	Useful for backups, IOS upgrades, and config transfers
tar:	Access to .tar archive files	opaque	rw	Used for packaging IOS bundles and related files
ftp:	Remote FTP access	opaque	rw	Enables file access via a remote FTP server
scp:	Secure Copy Protocol	opaque	rw	File transfers secured over SSH
tftp:	Trivial File Transfer Protocol	opaque	rw	Lightweight transfers, commonly used during IOS upgrades

Type describes what kind of storage it is — a physical or virtual disk, NVRAM specifically, or an “opaque” special-purpose file system. rw/ro flags indicate whether you can write to it. A few entries, like null:, system:, and tmpsys:, exist mainly for internal IOS operations and rarely need direct administrator interaction.

The Flash File System

Flash is the default file system, so a plain dir command lists its contents:

dir

Or explicitly:

dir flash:

Typical contents of a router’s flash include:

Filename Pattern	Purpose
c1900-universalk9-mz.SPA.15X.bin	The Cisco IOS operating system image itself
config.txt	An optional saved backup of the running or startup configuration
sigdef-category.xml.sgn	A signature definition file, present when IOS IPS security features are configured
multiple-fs-objects.tar	An archived bundle containing multiple related files, commonly used for IOS package installs

A note on IOS image filenames: the naming convention isn’t arbitrary — it typically encodes the platform (c1900), the feature set (universalk9 indicates the full-featured “universal” image, which includes strong cryptography features like IPsec and SSL VPN), the file format (mz for a compressed, relocatable image), and the version. Recognizing this pattern makes it much easier to confirm you’re looking at the correct image before an upgrade, rather than guessing from a long filename.

The NVRAM File System

NVRAM is small compared to flash, but it holds the configuration that actually matters most for day-to-day operation. View its contents in user EXEC mode:

dir nvram:

Filename	Purpose
startup-config	The configuration loaded into running-config at boot
private-config	Encrypted passwords or private keys not visible in startup-config

startup-config is the one you’ll interact with constantly — it’s what the router loads on every boot, and it’s what copy running-config startup-config writes to.

Switch File Systems

Running show file systems on a Catalyst switch shows a very similar structure to a router, with a few switch-specific additions:

Prefix	Description
flash:	Internal flash memory, storing the IOS image and system files
nvram:	Non-volatile memory, storing startup-config
null:	Discards output, same role as on a router
usbflash0:	External USB storage, if connected
tar:	Handles .tar archive files
ftp: / tftp:	Remote file transfer, same as on a router
xmodem: / ymodem:	Serial-based file transfer protocols, rare and mostly used as a last-resort fallback

Unlike routers, switches also store a VLAN database file — typically vlan.dat — in flash, which holds the VLAN configuration used by VTP and local switching. This file doesn’t exist on router-only platforms without switching capability, since VLANs are fundamentally a Layer 2 switching concept.

Backing Up and Restoring Configurations

There are three practical methods for backing up a router or switch configuration, each suited to slightly different situations.

Method 1: Text Capture with Tera Term

This works anywhere you have a terminal connection and doesn’t require any network transfer at all.

Backup:

1. In Tera Term’s File menu, click Log.
2. Choose a save location — Tera Term begins capturing terminal output immediately.
3. At the privileged EXEC prompt, run show running-config or show startup-config. Everything displayed gets written to the log file.
4. Once the command finishes, select Close in the Log window.
5. Open the saved file to confirm it captured cleanly.

Restoring:

When a config file gets pasted back into a terminal window, IOS executes each line as if it were typed manually. This means the captured file needs editing before restoring it: any pagination artifacts like --More-- and other non-command text need to be stripped out, and encrypted password lines should be checked to confirm they’ll actually apply correctly rather than being interpreted as literal commands.

The device also needs to be in global configuration mode before the file is pasted in, since that’s the mode the captured commands expect:

1. In Tera Term’s File menu, click Send File.
2. Locate the edited configuration file and click Open.
3. Tera Term pastes the file’s contents into the device, and each line executes as a command.

Method 2: TFTP Backup and Restore

TFTP is the standard method for backing up to (and restoring from) a server over the network, and it’s worth including the resulting file in your broader network documentation rather than treating it as a standalone artifact.

Backup:

copy running-config tftp

Or, to back up the startup configuration specifically:

copy startup-config tftp

You’ll be prompted for the TFTP server’s hostname or IP address, then a filename to save the configuration as.

Restoring:

copy tftp running-config

Or:

copy tftp startup-config

Enter the TFTP server’s address and the filename to restore from when prompted.

Method 3: USB Backup and Restore

Useful when no network path to a TFTP server exists, or as a quick, portable backup method.

Backup:

First, confirm the USB drive is actually present and note its exact device name:

show file systems

Then copy the running configuration to it:

copy run usbflash0:/

Use the flash drive’s name exactly as shown in the file system output — a mismatched name is one of the more common reasons this fails. The IOS prompts for a filename, and will ask before overwriting an existing file of the same name. List files on the USB drive with:

dir usbflash0:

Restoring:

copy usbflash0:/Router-Config running-config

Where Router-Config is the backup file’s actual name on the USB drive.

Managing IOS Images During an Upgrade

Upgrading IOS is one of the most common reasons to interact with the file system directly, and it’s worth understanding the process rather than just running a copy command and hoping.

Check current flash usage and the active image before starting:

dir flash:
show version

Confirm there’s enough free space for the new image alongside the existing one — most upgrade procedures keep the old image in place until the new one is verified working, rather than deleting it immediately, in case a rollback is needed.

Copy the new image to flash, typically from a TFTP server:

copy tftp flash:

Verify the new image’s integrity before pointing the boot process at it. Cisco images typically include an MD5 checksum you can verify against:

verify flash:c1900-universalk9-mz.SPA.15X.bin

Set the boot system variable to point at the new image explicitly, rather than relying on the router’s default first-file-in-flash behavior:

boot system flash:c1900-universalk9-mz.SPA.15X.bin

Save the configuration and reload to apply the new image:

copy running-config startup-config
reload

Only after confirming the new image is stable should you consider removing the old one with delete and squeeze flash: to reclaim its space — keeping it around for a reasonable period after an upgrade gives you a straightforward rollback path if something unexpected surfaces.

Comparing the Three Backup Methods

Method	Requires Network	Requires Physical Access	Best For
Tera Term text capture	No	Yes	Quick manual backups, environments with no TFTP server
TFTP	Yes	No	Routine, scriptable backups across many devices
USB	No	Yes	Field work, air-gapped or isolated devices

Troubleshooting Flash Memory

Flash is full and a new IOS image won’t copy: check available space first.

dir flash:

If space is tight, delete files you no longer need:

delete flash:oldfile.bin

Deleted files aren’t always immediately purged — permanently reclaim the space with:

squeeze flash:

A file appears in dir output but won’t delete: some files are marked read-only or are actively in use (for example, the currently-running IOS image can’t be deleted while the router is running it). Confirm which image is active with show version before attempting to remove anything from flash.

USB drive isn’t recognized: confirm it’s actually detected at all with show file systems before troubleting the copy command itself — if usbflash0: doesn’t appear in the output, the issue is hardware detection, not your backup command syntax.

FAQs

What is the purpose of the flash file system in Cisco devices?

Flash is the router’s primary internal storage, holding the Cisco IOS image itself along with configuration backups and other supporting files. It’s the default file system, which is why a plain dir command with no prefix lists flash’s contents automatically.

How do I back up my router configuration using TFTP?

Run copy running-config tftp (or copy startup-config tftp for the startup configuration specifically), then provide the TFTP server’s IP address and a filename when prompted. This is the most practical method for routine, scriptable backups across multiple devices, since it requires no physical access to each router individually.

Can I use a USB drive on all Cisco routers?

USB support depends on the specific router model and platform — not every device has a USB port capable of storage. Verify support and the exact drive name with show file systems before attempting a USB-based backup, since using an incorrect device name is a common cause of failed transfers.

What does the NVRAM file system contain?

NVRAM primarily stores startup-config, the configuration file loaded into running-config every time the device boots. It may also contain private-config, which holds encrypted passwords or private keys that aren’t visible in the regular startup configuration.

How do I troubleshoot flash memory that’s running out of space?

Check current usage with dir flash:, remove files you no longer need with delete, and then run squeeze flash: to permanently reclaim the space — deleted files aren’t always fully purged until this step runs. Before deleting anything, confirm with show version which IOS image is actually active, since you can’t delete the image currently running.

What’s the difference between the router and switch file systems?

The core structure is nearly identical — both use flash for the IOS image and NVRAM for the startup configuration. The main practical difference is that switches also store a VLAN database file (commonly vlan.dat) in flash, since VLAN configuration is a Layer 2 switching function that doesn’t apply to router-only platforms.