Search in book...
Toggle Font Controls
Create new playlist

Name your new playlist

Playlist description (optional)
Sign In

Email address

Password

Forgot Password?

or

Continue with Facebook

Continue with Google
Sign Up

Full Name

Email address

Confirm Email Address

Password

or

Continue with Facebook

Continue with Google

What to Do When Disaster Strikes

You’ve diligently performed the backups recommended in this book, and then, one fateful day, disaster strikes. It might be a small disaster (one important file is missing) or a large one (your whole computer is missing). In any case, the very first thing you should do is take a deep breath and remind yourself that everything is going to be fine. Once you’re finished not panicking, proceed with the instructions here, depending on the nature of your disaster.

Restore Individual Files

The easiest problem to recover from is a small number of files that are missing, or for which you need an older version. Follow these steps:

If you backed up the files using Time Machine, try restoring them using the steps in Restore Data with Time Machine; or, if you used another versioned backup app, follow the developer’s instructions (check the Help menu) for restoring your files.
If the files are missing from your backup, check your duplicate if you have one. Connect the drive (if it’s not already attached) and navigate to the location on the disk where the file should be. If it’s there, copy it to your main disk.
If steps 1 and 2 don’t work—for example, if your entire backup drive is missing—move on to your secondary backup. That may mean fetching an extra backup drive from another location and following steps 1 and 2 again, or using your internet backup app to find the file in your online backup.

Restoring Email from a Backup

I’ve said that with IMAP accounts your Mac has its own local copy of the messages in your email account. Those messages, in turn, should be backed up by whatever backup software you use. But if a message goes missing, the nature of IMAP means it will almost certainly be gone from both the server and your Mac. Even worse, if you do manage to restore it, the IMAP server might immediately instruct your client to delete it again, since the restored copy doesn’t match its master record!

How do you retrieve such a message from a backup and get it back into your email account?

If you use Time Machine, you might be able to restore messages from within Mail (see Restore Within Mail), though that process is notoriously flaky. If it doesn’t work—or if you don’t use both Time Machine and Mail—there’s a manual method you can try.

First, determine where your email app stores individual messages. (For Mail in Ventura, they’re in a series of subfolders within ~/Library/Mail/V10, each with the extension .emlx; some digging is required!) Go to the corresponding spot in your backups, use the date to find likely matches to the missing message(s), then restore the entire .mbox folder containing them to a different location (such as your desktop).

Finally, use your email app’s import feature (in Mail, use File > Import Mailboxes) to import the .mbox folder. Then you can sort through the messages, tossing those you don’t need and moving the ones you do to a new location.

Use Your Bootable Duplicate

In some situations it’s clear that your problem is worse than a few missing files. If your Mac won’t start up—it gets stuck at a blue or gray screen or displays a flashing question mark icon—turn next to your bootable duplicate, if you have one. (Yes, you can also use recovery mode to solve some of these problems, but running from your bootable duplicate gives you more options, including that of running all your apps and accessing your data!) Also use your duplicate if many files seem to be missing or damaged, apps won’t launch, or it exhibits other similar system-wide misbehavior. Follow these steps:

Attach the drive containing your bootable duplicate directly to your Mac.

Note: Remember that if you have an Intel Mac with a T2 chip (see full list here), then before you perform step 2 you must reboot in recovery mode, choose Utilities > Startup Security Utility, and select “Allow booting from external media” under External Boot; for details, see these instructions. (Do not change the Secure Boot setting.) Then restart your Mac.
Follow the instructions appropriate for the type of processor your Mac has:

Intel:
1. If your Mac is already running, restart it; if not, turn it on. Immediately (or as soon as it begins restarting) press and hold the Option key.
2. When your screen shows the volumes available for booting your Mac, release the Option key, use the arrow keys to select your duplicate, and press Return.
M-series:
1. Shut down the Mac.
2. Press and hold the power button until the text “Loading startup options” appears on the screen. Wait (possibly a bit longer than you might expect) for valid startup volumes to appear.
3. Select the volume containing your bootable duplicate and click Continue.
Note: The first time you boot from your duplicate—and the first time you boot from it after updating the signed system volume—you must jump through an additional hoop; see step 5 in Test a Duplicate on an M-Series Mac.
Your Mac should boot from the duplicate—but be aware that this may take considerably longer than booting from your regular internal startup disk.

Once your Mac finishes booting, you can continue working from your duplicate if you want to. But if possible, you should check your internal drive and repair it.
Run Disk Utility (in /Applications/Utilities on your duplicate). Select your internal disk in the list on the left. Click First Aid, followed by Run. Disk Utility attempts to fix the disk. If it succeeds, you can restart your Mac right away, and you’ll automatically go back to using your internal disk. If Disk Utility is unable to repair the disk, you have three options:
- Try a third-party disk repair utility, such as Micromat’s Techtool Pro.
- Erase the internal disk and then reverse the duplication process.
- Restore your entire disk using Time Machine (or another backup app, if you made a versioned backup of the entire disk).
If you decide to take the second route—restoring your disk from a bootable duplicate—read on for instructions. For help restoring an entire disk from a Time Machine backup, refer back to Restore Your Startup Volume Using Time Machine.

Restore a Disk from a Bootable Duplicate

If your internal storage has become so badly damaged that it can’t be repaired by disk utilities—or if your drive, or your entire Mac, had to be replaced—your best bet is to erase the damaged drive and then restore its entire contents. Although you can restore your disk from a Time Machine backup, the process usually takes a very long time, and of course it won’t include any files you excluded from Time Machine. A better tactic, assuming you have a functioning and up-to-date bootable duplicate, is to restore your disk from the duplicate.

To restore the contents of your bootable duplicate to your internal disk, follow these steps:

Follow steps 1–3 under Use Your Bootable Duplicate (just previously) to start up from the duplicate.
Open Disk Utility (in /Applications/Utilities).
Select your computer’s internal disk in the list on the left.
Click Erase, enter a name for the drive, and click Erase again. Disk Utility erases the disk.
Follow the steps in Create and Use a Duplicate to copy the contents of your duplicate back onto your internal disk—but in this case, choose the external disk containing your duplicate as the source and your internal disk as the destination.
When the restoration is complete, restart from your internal disk.
Allow data (particularly files you added or modified since you last updated your duplicate) to sync from the cloud using services such as iCloud Drive, iCloud Photos, and Dropbox; this reduces the number of items you’ll need to find in your backups. (See Can Cloud Sync Simplify Backups?)
If you have further files to restore that weren’t synced from the cloud, and your versioned backup software (Time Machine or otherwise) ran after the most recent update of your bootable duplicate, you may want to use that software now to copy any new or changed files back to your main disk. Unfortunately, most backup apps (including Time Machine) have no way to select only files that changed after a specified date and time—namely, those that changed and were backed up after you last updated your bootable duplicate. See the sidebar Finding Recently Backed-Up Files, ahead.

After you restore a bootable duplicate in this manner, Time Machine may conclude that all the files on your disk have changed and try to create an additional copy of all of them. Read the sidebar Restarting Time Machine Backups After a Restore, earlier, for more details and a possible solution.

A Word About Ransomware

Ransomware is a notorious type of malware that encrypts your files and then demands a ransom payment (usually quite a large one, paid in a cryptocurrency such as Bitcoin) in exchange for the key to decrypt them. If you don’t pay the ransom, you’ll be unable to read your files—unless, of course, you backed them up before they were encrypted! In which case, the joke’s on them; you’re facing a minor inconvenience at most.

Although ransomware designed for macOS exists, it’s quite rare. It most often infects computers when people click links in email messages from unknown senders or pop-up windows on sketchy websites, download pirated software, or engage in other similarly risky activities. If you don’t do those things, your chances of encountering ransomware in the first place are vanishingly small. You can also install anti-malware software such as Malwarebytes to monitor your Mac for signs of ransomware and to remove any that’s found. (You can learn more about ransomware and anti-malware apps in Glenn Fleishman’s book Take Control of Securing Your Mac.)

Alternatively, a free utility called RansomWhere? can monitor your Mac for the type of activity ransomware typically performs—namely, encrypting a lot of files in the background—and alert you so that if the encryption is not being performed by a legitimate app, you can stop it immediately. That’s handy, but note: backup software, including Backblaze’s bztransmit process, does encrypt a lot of files in the background (on purpose!) and therefore may trigger a RansomWhere? alert. Don’t assume that any alert is necessarily a sign of a problem!

If you’re unlucky enough to encounter ransomware, then as long as you have good backups, don’t panic (and don’t pay the ransom)! First get yourself an anti-malware app that will remove the malware, so it does no further damage. Then restore your data from your most recent backup before the ransomware was installed. (Figuring out when that was may require some trial and error.) If you find that local backups were also affected by the ransomware, then instead restore your data from your offsite backup.

Restore a Disk from a Data-Only Duplicate

If you decided to Create a Data-Only Duplicate, you can of course connect that drive to your Mac and Restore Individual Files from it. But if you have to start over from scratch and replace the entire contents of your internal storage with the data from a data-only duplicate, you’ll need to perform additional steps to make it bootable. There are a few ways to go about this task; here’s the procedure I recommend:

Enter recovery mode (see Something Recovery Something). Confirm that you’re connected to a Wi-Fi network. (If not, click the Wi-Fi icon on the menu bar, select a network, enter its password, and click Join.) Click Reinstall macOS Ventura (or Monterey or Big Sur or Catalina) to download and run the macOS installer.
When asked to select a destination, click Show All Disks and select your internal drive. Proceed with the installation. (Here, to avoid the “Conflict” message you would otherwise have to deal with later, after you select your user account you can uncheck “Copy account settings from account name.” Then click Install.)
When you get to the Migration Assistant screen, select “From a Mac, Time Machine backup or Startup disk” and click Continue.
If prompted, enter your password and click OK.

Note: If you see the error message “This Mac can’t be used to migrate data,” click OK, then click Back, then click Continue. That may clear the error.
On the “Transfer information to this Mac” screen, select the disk containing your data-only duplicate and click Continue.
On the “Select the information to transfer” screen, make sure everything is selected and click Continue.
If prompted, create secure passwords for each Administrator account. (These should be the same as your previous account passwords.) To do so, click Set Password, enter and confirm the password, and click Set Password; repeat for any remaining accounts. Click Continue.
If you see a screen that says “This Mac already has a user account with the same name as the one you are transferring. Do you want to replace the user on this Mac or keep both accounts?”, leave the default option (“Delete the existing user ‘username’ from this Mac and transfer ‘username’ from your other Mac.”) as is but uncheck “Keep the data from the deleted user in the Users folder.” Click Continue.
If prompted to provide the password from a user who is already authorized, click the Authorize button next to that username, enter that user’s password, and click OK. Then click Continue.
The migration will proceed, possibly taking multiple hours. When you see “Migration Complete,” click Done.

At this point your Mac should be running from the internal drive.

Finding Recently Backed-Up Files

Most backup apps let you easily find and select the most recent version of any file—or the last version backed up before an arbitrary time—for restoration. But what if you want to restore only the files that were backed up since an arbitrary time? If you’ve restored your disk from a bootable duplicate or data-only duplicate and want to put back all the files that your versioned backup copied after that duplicate was last updated, that’s surprisingly challenging to do. Here are some tips:

If your backup app lets you search your backups by modification date, you might be able to use that as a substitute. Look for all files modified since your last duplicate; even though that’s not the same as when they were backed up, it stands to reason that if files with a later modification date are stored in your backup, they were backed up after they were modified!
If your backup app stores files in a Finder-readable format, use Spotlight’s advanced search features to specify that “Last modified date is after” is the date when your duplicate was last updated. (See Using Finder’s Advanced Search to Find Recently Modified Files by Jim Tanous of the Mac Observer for instructions.)
If all else fails, you’ll have to search manually through your backups for files you might have changed recently. The most likely locations are your ~/Desktop, ~/Documents, and ~/Downloads folders, but you may have to look around elsewhere.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.

Table of Contents for What to Do When Disaster Strikes

Create new playlist

Sign In

Sign Up

What to Do When Disaster Strikes

Restore Individual Files

Use Your Bootable Duplicate

Restore a Disk from a Bootable Duplicate

Restore a Disk from a Data-Only Duplicate

Table of Contents for
What to Do When Disaster Strikes