In order to back up the IOS you need a TFTP server, SolarWinds offers a Free TFTP Server.

If you have no idea what version of the IOS you are using use the show flash command.

Router#show flash
System flash directory:
File Length Name/status
1 3289170 d1206.bin
[3289236 bytes used, 905068 available, 4194304 total]
4096K bytes of processor board System flash (Read/Write)

Backup

From the console in privileged EXEC mode enter the copy flash tftp command. When requested enter the IP address of the TFTP server.

Router#copy flash tftp
Source filename []? d1205.bin
Address or name of remote host []? 192.168.1.21
Destination filename [d1205.bin]? y
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3289170 bytes copied in 47.668 secs (69982 bytes/sec)

Restore

To copy the IOS from a TFTP server use the copy tftp command. When requested enter the IP address of the TFTP server containing the IOS.

Router#copy tftp flash
Address or name of remote host []? 192.168.1.21
Source filename []? d1206.bin
Destination filename [d1206.bin]?
Accessing tftp://192.168.1.21/d1206.bin...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading d1206.bin from 192.168.1.21 (via Ethernet0): !!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 3289170/6578176 bytes]
Verifying checksum... OK (0xB6BD)
3289170 bytes copied in 89.272 secs (36956 bytes/sec)

Connect a PC with a terminal emulation software to the console port on the Cisco router. Cisco 2620 router, IOS 12.2.

Settings for the terminal

9600 baud rate
No parity
8 data bits
1 stop bit
No flow control

Turn off the router, then back on.

After the router is on press the BREAK key(Alt + b on Tera Term) within 60 seconds of start to have the router in ROMMON.

The prompt will show.

rommon 1>

Then type confreg 0×2142 to boot from flash (this will bypass startup configuration).

rommon 1>confreg 0×2142

Type reset at the prompt (ignores saved configuration, then reboots).

rommon 2>reset

Press Ctrl-c to skip the initial procedure.

Type enable at the prompt.

Router>enable

Then the prompt changes to Router#.

Now type.

Router#configure memory

or

Router#copy startup-config running-config

commands will copy NVRAM in to memory.

To show the current configuration on the router use.

Router#show running-config

The output will be :
enable passwords
enable secret
vty
console password

which will be in encrypted or unencrypted format, encrypted passwords should be change to a new one.

To change encrypted or enable secret password do the following.

Router#
Router#configure terminal
Router(config)#enable secret
Router(config)#exit

Issue the no shutdown command on every interface.

Router#
Router(config)#interface serial 0/1
Router(config-t)#no shutdown
Router(config-t)#exit

Type config-register use the value 0×2102.

Router(config)#config-register 0×2102

Press Ctrl-z to leave configuration mode.

Router#

Type write memory or copy running-config startup-config to commit all of the new changes and configurations.