Cisco IOS File System

Scope note: this page covers the Cisco-side file-system model, flash: / nvram: / system:, copy syntax, boot system, config-register, image management. For the TFTP / FTP protocols themselves (how they work on the wire, when to pick each), see the companion topic → TFTP & FTP: Network File Transfer Basics.

Mental model

Cisco IOS treats every storage location as a named file system, the way Unix treats /, /proc, /dev, etc. as mount points. You move data between them using copy.

The four you’ll use 95% of the time:

Modern devices (3850/9300/9500/ISR4xxx) add bootflash:, usbflash0:, harddisk:, but the mental model is identical.

The four-line summary

Router# show file systems
Router# dir flash:
Router# copy running-config startup-config
Router# copy tftp: flash:

If you understand those four commands, you understand 80% of IOS file-system work.

show file systems: the directory of devices

Router# show file systems
File Systems:

       Size(b)       Free(b)      Type  Flags  Prefixes
             -             -    opaque     rw   system:
             -             -    opaque     rw   tmpsys:
             -             -    network     rw   tftp:
*  256487424   192385024     disk     rw   flash:
        4096          4055     nvram     rw   nvram:
             -             -    opaque     rw   bs:
             -             -    network     rw   ftp:
             -             -    network     rw   http:
             -             -    network     rw   scp:

The * marks the default file system: commands like dir, cd, delete use this if no device is specified. Usually flash:.

dir: list files

Router# dir flash:
Directory of flash:/

    1  -rw-     67541040           Mar 12 2026 09:14:00 +00:00  c2900-universalk9-mz.SPA.157-3.M5.bin
    2  -rw-          492           Apr 02 2026 11:22:30 +00:00  startup-config.backup
    3  -rw-         1242           May 18 2026 14:55:01 +00:00  vlan.dat

256487424 bytes total (192385024 bytes free)

You see the IOS .bin image, occasional backups, and vlan.dat (the VLAN database: stored separately from running-config).

copy: the universal move command

copy <source-device>:<filename> <destination-device>:<filename>

The day-one one you must know:

Router# copy running-config startup-config

This saves your live config to NVRAM so it persists across reboots. Short forms: write memory, wr.

Other essential copies:

! Back up running-config to a TFTP server
Router# copy running-config tftp:
Address or name of remote host []? 10.0.99.5
Destination filename [running-config]? R1-2026-05-25.cfg

! Restore startup-config from TFTP
Router# copy tftp: startup-config

! Upload new IOS image
Router# copy tftp: flash:
Address or name of remote host []? 10.0.99.5
Source filename []? c2900-universalk9-mz.SPA.158-3.M2.bin

copy prompts interactively. If you’ve ever scripted Cisco devices, you’ll learn to script the answers.

Image management: upgrading IOS

! 1. Download new image to flash
R1# copy tftp: flash:
   ! ...answer prompts...

! 2. Verify integrity (checksum vs Cisco's published MD5)
R1# verify /md5 flash:c2900-universalk9-mz.SPA.158-3.M2.bin

! 3. Tell the router which image to boot
R1(config)# no boot system   ! remove any old boot statements
R1(config)# boot system flash:c2900-universalk9-mz.SPA.158-3.M2.bin

! 4. Save and reload
R1# write memory
R1# reload

boot system order matters. Multiple boot system statements act as a fallback list, first found, first booted. Newest image typically goes first.

Free up flash before downloading: if flash is full, the transfer fails:

R1# delete flash:c2900-universalk9-mz.SPA.156-3.M0.bin
R1# squeeze flash:    ! reclaim deleted blocks on older devices

Boot-time decision tree

What happens at power-on:

1. Power-on Self Test (POST): basic hardware check.
2. Bootstrap loads from ROM, reads the config register.
3. Config register tells the bootstrap where to look for IOS:
   • 0x2102 (default): boot IOS as specified by boot system commands in startup-config.
   • 0x2120 / 0x0000: boot to ROMMON instead.
   • 0x2142: boot IOS but skip startup-config (used in password recovery, see Password Recovery).
4. IOS loads. If boot system exists in startup-config, that image. If not, first valid .bin in flash.
5. Startup-config copied from nvram: into system: (running-config in RAM), unless register said skip.
6. Prompt appears.

See also Catalyst Boot Process for the switch-specific flow.

Archiving configs: built-in IOS feature

For audit logs / change tracking, IOS can auto-archive each write memory:

R1(config)# archive
R1(config-archive)# path flash:/configs/R1-config
R1(config-archive)# maximum 14
R1(config-archive)# write-memory

R1# show archive       ! shows the archive history
R1# show archive config differences flash:/configs/R1-config-1 flash:/configs/R1-config-2

Per-version diffs straight from the CLI. Very handy when troubleshooting “what changed.”

SCP vs TFTP: security upgrade

TFTP is unauthenticated, plain text, UDP 69. Fine for a closed lab; never use across the internet.

SCP uses SSH for transport (TCP 22, encrypted, authenticated):

R1(config)# ip scp server enable

! From another device or laptop
scp R1-2026-05-25.cfg admin@10.0.0.1:flash:

Always prefer SCP in 2026 production environments.

Verification

Router# show version              ! shows running image, boot variable
Router# show flash:               ! flash contents
Router# show file systems
Router# show bootvar              ! boot variable (switches: show boot)
Router# show archive              ! config archive history

Common mistakes

1. copy startup-config running-config vs copy running-config startup-config: easy to swap. Source comes first. Running → startup saves. Startup → running merges (does NOT overwrite. It adds).

2. Flash full during upgrade. Always check dir flash: for free space before downloading. A failed mid-transfer can leave a corrupt image.

3. Forgetting to verify MD5. Corrupted image installs → device boots into ROMMON loop. Always run verify /md5 against the value published on cisco.com.

4. Missing boot system. No boot statement → router boots the first valid image file in flash (file order, not alphabetical). Could be an ancient backup image. Always set it explicitly.

5. Treating vlan.dat like running-config. VLAN database lives in flash:vlan.dat, separate from startup-config. Restoring a config without VLAN.dat means VLANs vanish. Backup both.

6. TFTP across the internet. Plain-text config including passwords flying over public links. Career-ending if it sniffs. Use SCP.

7. Naming images stuff like image.bin. Keep the original Cisco filename. It encodes platform, feature set, and version. Renaming hides info from show version.

Lab to try tonight

1. In Packet Tracer / CML / real router, run show file systems. Identify each device.
2. dir flash:: note the IOS filename.
3. Make a small config change (e.g., interface Lo99 with description). do show running-config | section Loopback99.
4. copy running-config startup-config. Reload. Verify the loopback survived.
5. Set up a TFTP server on your laptop (tftpd64 on Windows, tftp-hpa on Linux). copy running-config tftp: to back up the device.
6. Edit the backup file in a text editor. Change a description. copy tftp: running-config to re-apply.
7. Bonus: enable IOS archive (archive + path flash:/configs/$h-config + write-memory). Do three write memory calls. show archive config differences between two versions.
8. Bonus: enable SCP server, transfer a file from your laptop using scp.

Cheat strip