diff --git a/src/file/backup.sh b/src/file/backup.sh
new file mode 100644
index 0000000..7a05c2c
--- /dev/null
+++ b/src/file/backup.sh
@@ -0,0 +1,28 @@
+# takes a list of space-separated absolute paths 
+# backs each path up, creating canonical or ephemeral copies as needed
+backup_paths() {
+  local paths="$1"
+  local canonical_path=
+  local ephemeral_path=
+
+  for path in $paths; do
+    canonical_path="$BACKUP_ROOT/canonical$path"
+    timestamp="$(date +'%Y-%m-%dT%H-%M-%S')"
+    ephemeral_path="$BACKUP_ROOT/ephemeral${path}_$timestamp"
+
+    if [ -f "$canonical_path" ]; then
+      log debug "[backup] Creating ephemeral copy for $path"
+      mkdir -p "$(dirname "$ephemeral_path")"
+      if [ -f "$ephemeral_path" ]; then
+        log debug "[backup] Overwriting ephemeral copy for $path"
+        cp -f "$path" "$ephemeral_path"
+      else
+        cp "$path" "$ephemeral_path"
+      fi
+    else
+      log debug "[backup] Creating canonical copy for $path"
+      mkdir -p "$(dirname "$canonical_path")"
+      cp "$path" "$canonical_path"
+    fi
+  done
+}
diff --git a/src/file/file_merge.sh b/src/file/file_merge.sh
index 7bf25dc..46e75be 100644
--- a/src/file/file_merge.sh
+++ b/src/file/file_merge.sh
@@ -53,9 +53,11 @@ file_merge_tree() {
       if [ "$strategy" -eq 0 ]; then
         return 0
       elif [ "$strategy" -eq 1 ]; then
+        backup_paths "$absolute_path"
         cp -vi "$config_path" "$absolute_path"
         return 1
       elif [ "$strategy" -eq 2 ]; then
+        backup_paths "$config_path"
         cp -vi "$absolute_path" "$config_path"
         return 1
       elif [ "$strategy" -eq 3 ]; then
diff --git a/src/index.sh b/src/index.sh
index 95c9f91..0af2c73 100644
--- a/src/index.sh
+++ b/src/index.sh
@@ -11,3 +11,4 @@
 . "$TORI_ROOT/src/package/update_package_cache.sh"
 
 . "$TORI_ROOT/src/file/file_merge.sh"
+. "$TORI_ROOT/src/file/backup.sh"
diff --git a/src/utility.sh b/src/utility.sh
index 82a8e91..78b6de3 100644
--- a/src/utility.sh
+++ b/src/utility.sh
@@ -134,6 +134,12 @@ prepare_directories() {
 
   if ! [ -d "$BACKUP_ROOT" ]; then
     mkdir -p "$BACKUP_ROOT"
+    if ! [ -d "$BACKUP_ROOT/canonical" ]; then
+      mkdir "$BACKUP_ROOT/canonical"
+    fi
+    if ! [ -d "$BACKUP_ROOT/ephemeral" ]; then
+      mkdir "$BACKUP_ROOT/ephemeral"
+    fi
   fi
 
   if ! [ -d "$CONFIG_ROOT" ]; then