Should your startup system become unusable, it may be necessary to recover your entire startup volume using QRecall. These steps also apply to migrating a captured startup volume to another system.
Beginning with macOS 10.15 (Catalina) your startup volume is actually two volumes: a system volume containing the core operating system and a data volume that contains your content and everything else.; if you're running macOS 10.14 (Mojave) or earlier, perform a legacy restore.
The system volume is immutable (cannot be altered) and is cryptographically signed by the operating system installer. Which is just a long-winded way of saying that the system portion can only be installed by Apple.
Because of this division, when you capture your startup volume QRecall actually only captures the data volume. To restore your entire startup volume, use QRecall to restore the data volume and Apple's OS installer to restore the system volume.
Here are a few recipes for a quick and painless restoration of your entire system:
If you created a recovery volume, as suggested in the strategies section, then you're ready to go.
Connect your recovery volume, then follow these steps:
If you don't have a recovery volume, create a "Bootstrap" volume. A bootstrap volume is a temporary system volume created for the sole purpose of restoring your original startup volume. This essentially takes the place of a recovery volume—it just takes a bit more time to set up.
This is the simplest, and least desirable, method of restoring your system. It's undesirable because it involves restoring your system files while the system is running. This gives rise to unpredictable behavior because many of the files being recalled are actively open and being used by running processes. So be prepared that some data, particularly preferences and state information, won't get property restored.
It's best not to try to run any applications (other than QRecall) or do any work while your startup data volume is being recalled. As soon as the restore is finished, restart your system.
Startup volumes on macOS 10.14 (Mojave) and earlier can be restored directly by QRecall. The simplest method, by far, is to use a recovery volume. If you did not create a recovery volume in advance, use a variation of the bootstrap volume.
Connect your recovery volume, then follow these steps:
Connect your recovery volume, then follow these steps:
Restoring from an encrypted archive adds a touch of complexity to a system restore. This is because the encryption key file needed to access the archive is normally stored on the very system you're trying to restore.
If you're using the QRecall application to perform the restore, it's pretty easy:
¹This is where I remind you that without either a recovery key (and passphrase) or a backup of the encryption key file (and possibly its password), your archive cannot be opened.
Using the qrecall command line tool to restore from an encrypted archive is a bit tricker.
--keyfile option, like this:
qrecall restore blah blah blah … \
--keyfile '/Volumes/Flash/Archive Encryption Key.plist'
recoverkey command to extract the encryption key into a file.
qrecall recoverkey /Volumes/Backup/Archive.quanta \
--keyfile '/Volumes/Flash/Recovered Encryption Key.plist' \
--passphrase 'The answer is 42'
If your passphrase is in a file, you can read it from stdin, like this:
qrecall recoverkey /Volumes/Backup/Archive.quanta \
--keyfile '/Volumes/Flash/Recovered Encryption Key.plist' \
--passphrase - < '/Volumes/Flash/Passphrase.txt'
Once the encryption key file is extracted,
use it in the --keyfile option of the restore command.
--password option, like this:
qrecall restore blah blah blah … \
--keyfile '/Volumes/Flash/Archive Encryption Key.plist' \
--password 'Not-something-stupid'
And like the passphrase, a password can be read from a file, like this:
qrecall restore blah blah blah … \
--keyfile '/Volumes/Flash/Archive Encryption Key.plist' \
--password - < '/Volumes/Flash/Secret.txt'