How To Clone Your Mac Using ASR
In certain circumstances, it can be helpful to create a bootable clone of your Mac or macOS system, especially for testing software or system changes. Unfortunately, the cloning process has become more difficult because of the Signed System Volume in macOS Big Sur and later. There is only one tool that can successfully copy the Signed System Volume, and that is Apple Software Restore (ASR). This user tip details the overall process for creating a clone using ASR and provides an example case.
Is this guide right for you?
Cloning your Mac via ASR requires using the command line (Terminal), and being able to work with disks, partitions, and volumes. If you don’t feel comfortable with this, don’t use these steps.
If you would like to have a second copy of macOS available, it’s easier to erase your destination appropriately (APFS as format, GUID Partition Map as scheme if prompted), install macOS onto it, and then import any desired data when prompted.
If you still need an exact clone of your Mac's system, follow the steps in this guide to create one.
What macOS versions does this guide cover?
This guide assumes that your Mac is running macOS Catalina (10.15) or later. ASR is also available for macOS Mojave and earlier, but you’ll need to use the command differently than what is described here to clone your startup volume.
Disclaimers
- ASR is best used for cloning, not imaging. If you must restore a clone using ASR onto an empty Mac with no existing macOS installed, make sure to run the macOS installer afterwards so that the appropriate firmware updates are applied.
- ASR is broken on Apple silicon in early versions of macOS Big Sur. I think Apple fixed it in 11.4 or 11.5, but I could be wrong. It should work as expected in macOS Monterey and later.
- ASR clones are not cross-platform. You can’t clone macOS from an Intel-based Mac and boot it on a Mac with Apple silicon, or vice versa. That said, reinstalling macOS onto a clone should automatically convert it to the correct platform type.
- Bootable clones cannot be used on Apple silicon Macs if the internal SSD fails for any reason. It is critical for system startup, regardless of what you intend to boot.
- A cloned system made with ASR will always be unencrypted, even if the source is encrypted. To encrypt the clone, start up from it and enable FileVault in System Settings or System Preferences.
Materials needed
You will need:
- A working Mac with macOS Catalina or later installed, or at least able to access macOS Recovery for Catalina or later
- A working macOS system (either your Mac itself - easiest, or on an external disk or disk image)
- Sufficient free space on the destination, which can either be an external SSD or your Mac’s internal drive
- Full Disk Access permissions for Terminal. This is required for ASR to successfully clone the running macOS system, at least in macOS Ventura and later. To grant Full Disk Access permissions, follow these steps:
In macOS Ventura and later:
- Open System Settings and select Privacy & Security -> Full Disk Access.
- If Terminal doesn’t appear in the list, click the (+) button and select the Terminal app (in Applications -> Utilities).
- Make sure that the switch is enabled for Terminal.
- If needed, quit and reopen Terminal.
In macOS Monterey and earlier:
- Open System Preferences and select Security & Privacy -> Privacy -> Full Disk Access.
- Click the padlock in the bottom left corner if it appears. Provide admin credentials when prompted.
- If Terminal doesn’t appear in the list, click the (+) button and select the Terminal app (in Applications -> Utilities).
- Make sure that the switch is enabled for Terminal.
- If needed, quit and reopen Terminal.
Prepare to clone
Identify your source and destination
Your source is the macOS system that you wish to clone. It can be from your Mac, an external drive, or even a disk image (if you already used ASR to clone into said image).
Your destination is the Apple File System (APFS) Container that will hold your new clone. This can reside directly on your Mac, on an external SSD, or inside a disk image (you can’t boot disk images). You can even clone your source system to the same drive that holds it, but you'll likely need macOS Recovery's Terminal for that.
If your destination disk is different than your source disk, make sure that your destination disk is set up appropriately. If you’re not sure, you can erase it and set it up using these steps:
- Eject and disconnect all external disks from your Mac.
- Connect your destination disk.
- Open Disk Utility, located in Applications -> Utilities.
- In Disk Utility, select View -> Show All Devices.
- Select the top level of your destination disk and click Erase. Choose these options, then click Erase:
- Name: Untitled
- Format: APFS
- Scheme: GUID Partition Map
- When the erase is complete, quit Disk Utility.
Now, complete these steps to get a detailed view of your source and destination. You’ll need this info in a later section.
- Eject and disconnect all external disks from your Mac.
- Connect both your source and destination disks.
- Open Terminal, located in Applications -> Utilities.
- Type this command and hit Enter (Return): diskutil list
- Review the output and get the disk identifiers for your source and destination.
I’ll use an example throughout this guide to help. For my example, I want to clone my Mac’s system onto my external SSD. Unlike most setups, my external SSD has two APFS containers (most will only have one), as described below. I’m using an M1 MacBook Air running macOS Monterey 12.6, and my diskutil list output is given below:
Encryptor5000@My-MacBook-Air ~ % diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *1.0 TB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 994.7 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3
/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +994.7 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 15.4 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 15.4 GB disk3s1s1
2: APFS Volume Preboot 5.6 GB disk3s2
3: APFS Volume Recovery 3.2 GB disk3s3
4: APFS Volume Macintosh HD - Data 174.6 GB disk3s5
5: APFS Volume VM 20.5 KB disk3s6
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *2.0 TB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 1.8 TB disk4s2
3: Apple_APFS Container disk6 250.0 GB disk4s3
/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +1.8 TB disk5
Physical Store disk4s2
1: APFS Volume Backups 423.9 GB disk5s1
/dev/disk6 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +250.0 GB disk6
Physical Store disk4s3
1: APFS Volume Untitled 843.8 KB disk6s1
For me, my source resides in disk3 (inside my Mac). I’ll select the system volume, disk3s1 (Macintosh HD). My destination will be the APFS container disk4s3, also represented as disk6, from my external SSD (disk4).
Looking at the expanded container on disk6, there is an empty APFS volume (disk6s1) named “Untitled” inside. If you completely erased your destination disk as recommended above, this is the volume that got created inside your new destination container. For me, I want to replace this volume with my clone, so I’ll select it as my target. If I wanted to either remove all volumes from the destination container, or just add the clone into it while keeping “Untitled”, I would select disk4s3 (the container itself) as my target.
To make sure that I have enough free space in my destination container for the clone, I'll do some math using the output above:
250 GB total space in destination container (disk4s3, expanded as disk6)
My source macOS volumes:
15.4 GB Macintosh HD (disk3s1, source system volume)
5.6 GB Preboot (disk3s2)
3.2 GB Recovery (disk3s3)
174.0 GB Macintosh HD - Data (disk3s5, source data volume)
+ 20.0 GB extra free space for safety
-------------------------------------------
218.2 GB total space required for me. My 250 GB destination should have enough room to hold the clone inside.
(If I wanted to preserve the volume "Untitled" from my destination, I'd have to add its used storage to the total space required as well. Luckily for me, it's negligible - it's using less than 1 MB. 1000 MB = 1 GB.)
Get the startup snapshot name or UUID
macOS Big Sur and later uses a Signed System Volume to protect most system content. This is implemented as a sealed snapshot on the system volume. In order for the clone to boot successfully, this snapshot must be copied over exactly as is. ASR can do this – it just needs to know what the snapshot’s name or UUID is.
First, run diskutil mount sysvol to mount the system volume. Replace sysvol with the disk ID for the source system volume. For me, that’s disk3s1:
Encryptor5000@My-MacBook-Air ~ % diskutil mount disk3s1
Volume Macintosh HD on disk3s1 mounted
Now that the source system volume is mounted, run diskutil apfs listsnapshots sysvol to get the name and UUID of the sealed snapshot. Again, replace sysvol with the disk ID for the source system volume:
Encryptor5000@My-MacBook-Air ~ % diskutil apfs listsnapshots disk3s1
Snapshot for disk3s1 (1 found)
|
+-- E08AB5EF-18E8-456F-B78F-1FC2656BA381
Name: com.apple.os.update-BF1DBCA6141B430194B034207E3FA291F4CA4BF9DB67777796325119C61D343F
XID: 45
Purgeable: No
For me, the UUID of the sealed snapshot is “E08AB5EF-18E8-456F-B78F-1FC2656BA381” (shown above the name). Either the snapshot’s UUID or name can be used in the next steps, but I recommend using the UUID.
Create and boot from the clone
If you’re not using macOS Recovery, log in to an administrator account. Then, in Terminal, assemble the specific ASR command that you’ll use. Here’s the general format:
sudo asr restore --source /dev/sysvol --target /dev/yourTarget --toSnapshot sysSnap --no-personalization --erase
- Replace sysvol with the source system volume’s disk ID (disk3s1 for me)
- Replace yourTarget with the disk ID for the target volume or container (disk6s1 for me)
- Replace sysSnap with the UUID or name of the source system snapshot. For me, the UUID is “E08AB5EF-18E8-456F-B78F-1FC2656BA381”.
The command can also be modified to fit your needs depending on how the source macOS and target APFS container are set up. Here's a couple of examples:
To replace an APFS volume (for me, disk6s1) in the container (for me, disk6, or disk4s3) with the clone, I'd use this command: sudo asr restore --source /dev/disk3s1 --target /dev/disk6s1 --toSnapshot E08AB5EF-18E8-456F-B78F-1FC2656BA381 --no-personalization --erase
To completely erase the destination APFS container (delete all volumes inside it) and then put the clone inside it, I'd change my target to the container (disk4s3 for me): sudo asr restore --source /dev/disk3s1 --target /dev/disk4s3 --toSnapshot E08AB5EF-18E8-456F-B78F-1FC2656BA381 --no-personalization --erase
To preserve the existing data and volumes inside the destination container and install the clone alongside it, I would target the container, but remove the --erase flag, like this: sudo asr restore --source /dev/disk3s1 --target /dev/disk4s3 --toSnapshot E08AB5EF-18E8-456F-B78F-1FC2656BA381 --no-personalization
If I was cloning an installation of macOS Catalina or earlier, where there is no Signed System Volume, and erase the target container (disk4s3 for me), I would exclude the --toSnapshot and --no-personalization flags: sudo asr restore --source /dev/disk3s1 --target /dev/disk4s3 --erase
If I’m running from macOS Recovery, I remove “sudo” from the start of the command.
For my scenario, I'll use the first example command, where I use disk3s1 as the source, "E08AB5EF-18E8-456F-B78F-1FC2656BA381" as my source system snapshot, and disk6s1 as the target APFS volume I want to replace with my clone.
Once you run the command and enter your admin password (Terminal won't show any characters as you type it), ASR will prompt you to confirm your request if you asked to erase the target. If you're sure, type "y" and hit Enter (Return).
Encryptor5000@My-MacBook-Air ~ % sudo asr restore --source /dev/disk3s1 --target /dev/disk6s1 --toSnapshot E08AB5EF-18E8-456F-B78F-1FC2656BA381 --no-personalization --erase
Password:
Validating target...done
Validating source...done
Erase contents of /dev/disk6s1 (/Volumes/Untitled)? [ny]: y
Replicating ....10....20....30....40....50....60....70....80....90....100
Replicating ....10....20....30....40....50....60....70....80....90....100
Restored target device is /dev/disk6s1.
Remounting target volume...done
Restore completed successfully.
ASR will then show two progress bars. When both are complete, you'll get the message "Restore completed successfully". At this point, your clone has been made, but it isn't bootable yet. There are two or three steps needed to get that done, which the next sections will cover.
If an error message appears instead, open Disk Utility. Select View -> Show All Devices. There should be a volume that has "ASR" in its name. Select this volume and click Erase. When prompted to confirm, choose "Erase Volume Group" to remove the failed clone. If no "ASR" volumes appear, and the original destination volume still exists (likely named "Destination"), nothing needs to be removed or erased.
Rename your clone
When ASR succeeds and completes, it gives the cloned volumes the same names as the original ones, as shown below. Here, the volumes in the container on disk3 comprise the original system, and the volumes in the container on disk6 comprise the clone:
Encryptor5000@My-MacBook-Air ~ % diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *1.0 TB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 994.7 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3
/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +994.7 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 15.4 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 15.4 GB disk3s1s1
2: APFS Volume Preboot 5.6 GB disk3s2
3: APFS Volume Recovery 3.2 GB disk3s3
4: APFS Volume Macintosh HD - Data 174.6 GB disk3s5
5: APFS Volume VM 20.5 KB disk3s6
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *2.0 TB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 1.8 TB disk4s2
3: Apple_APFS Container disk6 250.0 GB disk4s3
/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +1.8 TB disk5
Physical Store disk4s2
1: APFS Volume Backups 423.9 GB disk5s1
/dev/disk6 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +250.0 GB disk6
Physical Store disk4s3
1: APFS Volume Macintosh HD - Data 170.5 GB disk6s2
2: APFS Volume Macintosh HD 15.4 GB disk6s1
3: APFS Volume Preboot 174.1 MB disk6s3
4: APFS Volume Recovery 1.9 GB disk6s4
To help avoid confusion, you should immediately rename your cloned volumes in Disk Utility. Use the Device info field in Disk Utility to help you locate the cloned volumes. For me, I'll rename volume disk6s1 from "Macintosh HD" to "External macOS", and disk6s2 from "Macintosh HD - Data" to "External macOS - Data". If Disk Utility doesn't allow you to rename a volume, unmount it, then mount it again.
NOTE: The Preboot, Recovery, VM, and Update (hidden) volumes are special volumes, and their respective clones should not be renamed. For safety, they do not appear in Disk Utility.
Make your clone bootable
Once your clone has been renamed, open System Settings -> General -> Startup Disk (or in macOS Monterey and earlier, System Preferences -> Startup Disk). Your clone should appear. If a padlock appears in the bottom left corner, click on it and provide your admin password when prompted. Then, select it, enter your password again if asked, and click Restart. Click Restart again when prompted to confirm.
If you're on an Apple silicon Mac, you should then get the message "This volume does not have any authorized users for this computer". Click Authorize Users and follow the onscreen instructions. You will need to enter your password several times for this. This process grants the clone access to the Owner Identity Key. Without this access, the cloned macOS cannot install updates or change its security policy.
If you used macOS Recovery to create your clone, you’ll need to start up from a working copy of macOS to complete the above steps. If you don’t have one, quit Terminal and run the macOS installer to complete the process.
Make sure you can boot from external media
If your Mac has the T2 Security Chip (not M1 or later), start up in macOS Recovery and open Startup Security Utility. Make sure that your Mac is permitted to boot from external media. Save your changes and then restart.
Test!
If completely successful, you should now be able to boot from your clone. If you cloned to an external hard drive (not SSD), beware that the boot process can take longer than a minute to complete.
What if I get stuck in a boot loop?
If macOS somehow fails to boot on the clone, and your Mac shows an Apple logo, a progress bar, and then suddenly restarts repeatedly, you can still start up from the original source macOS that was cloned. Follow these steps:
- On an Intel-based Mac, hold down the Option key as soon as the screen goes black. On a Mac with Apple silicon, hold down the power button (Touch ID on laptops) as soon as the screen goes black.
- Release the Option key or power button when a list of startup disks appears (Intel), or the message “Loading startup options” appears (Apple silicon).
- Hold down the Control key, select the original source macOS (usually “Macintosh HD), and click the circular arrow (Intel) or “Always Use” (Apple silicon).
- Your Mac will set the source macOS as the default and will immediately start up from it.
To resolve any boot or startup issues on the clone, start up from macOS Recovery and reinstall macOS onto the clone. You don't need to erase anything in order for this to succeed.
