How To Clone Your Mac Using ASR

In certain circumstances, it can be helpful to create a bootable clone of your Mac or macOS system, especially for testing software or system changes. Unfortunately, the cloning process has become more difficult because of the Signed System Volume in macOS Big Sur and later. There is only one tool that can successfully copy the Signed System Volume, and that is Apple Software Restore (ASR). This user tip details the overall process for creating a clone using ASR and provides an example case.

This guide was initially made for macOS Monterey on Oct 31 2022. It has now been updated for macOS Sonoma on July 6 2024.

Is this guide right for you?

Cloning your Mac via ASR requires using the command line (Terminal), and being able to work with disks, partitions, and volumes. If you don’t feel comfortable with this, don’t use these steps.

If you would like to have a second copy of macOS available, it’s easier to erase your destination appropriately (APFS as format, GUID Partition Map as scheme if prompted), install macOS onto it, and then import any desired data when prompted.

If you still need an exact clone of your Mac's system, follow the steps in this guide to create one.

What macOS versions does this guide cover?

This guide assumes that your Mac is running macOS Catalina (10.15) or later. ASR is also available for macOS Mojave and earlier, but you’ll need to use the command differently than what is described here to clone your startup volume.

Disclaimers

- ASR is best used for cloning, not imaging. Don't use ASR to clone a macOS system onto an empty Mac with no existing macOS installed. It likely won't work on Intel, and it certainly won't work on Apple silicon.

- To use a clone on Apple silicon, you must already have another copy of macOS installed. You’ll need it to make the clone bootable on your particular Mac. 

- These steps will not work on Apple silicon Macs running macOS Big Sur. They will work on macOS Monterey and later though.

- ASR clones are not cross-platform. You can’t clone macOS from an Intel-based Mac and boot it on a Mac with Apple silicon, or vice versa. That said, reinstalling macOS onto a clone should automatically convert it to the correct platform type.

- Bootable clones cannot be used on Apple silicon Macs if the internal SSD fails for any reason. It is critical for system startup, regardless of what you intend to boot.

- A cloned system made with ASR will always be unencrypted, even if the source is encrypted. To encrypt the clone, start up from it and enable FileVault in System Settings or System Preferences.

Materials needed

You will need:

- A working Mac with macOS Catalina or later installed

- A working macOS system (either your Mac itself - easiest, or on an external disk or disk image)

- Sufficient free space on the destination, which can either be an external SSD or your Mac’s internal drive

- Full Disk Access permissions for Terminal. This is required for ASR to successfully clone the running macOS system, at least in macOS Ventura and later. To grant Full Disk Access permissions, follow these steps:

In macOS Ventura and later:

1. Open System Settings and select Privacy & Security -> Full Disk Access.
2. If Terminal doesn’t appear in the list, click the (+) button and select the Terminal app (in Applications -> Utilities).
3. Make sure that the switch is enabled for Terminal.
4. If needed, quit and reopen Terminal.

In macOS Monterey and earlier:

1. Open System Preferences and select Security & Privacy -> Privacy -> Full Disk Access.
2. Click the padlock in the bottom left corner if it appears. Provide admin credentials when prompted.
3. If Terminal doesn’t appear in the list, click the (+) button and select the Terminal app (in Applications -> Utilities).
4. Make sure that the switch is enabled for Terminal.
5. If needed, quit and reopen Terminal.

Prepare to clone

Identify your source and destination

Your source is the macOS system that you wish to clone. It can be from your Mac, an external drive, or even a disk image (if you already used ASR to clone into said image).

Your destination is the Apple File System (APFS) Container that will hold your new clone. This can reside directly on your Mac, on an external SSD, or inside a disk image (you can’t boot disk images). You can even clone your source system to the same drive that holds it if desired.

If your destination disk is different than your source disk, make sure that your destination disk is set up appropriately. If you’re not sure, and it's an external disk, you can erase it and set it up using these steps:

1. Eject and disconnect all external disks from your Mac.
2. Connect your destination disk.
3. Open Disk Utility, located in Applications -> Utilities.
4. In Disk Utility, select View -> Show All Devices.
5. Select the top level of your destination disk and click Erase. Choose these options, then click Erase:
   1. Name: Untitled
   2. Format: APFS
   3. Scheme: GUID Partition Map
6. When the erase is complete, quit Disk Utility.

Now, complete these steps to get a detailed view of your source and destination. You’ll need this info in a later section.

1. Eject and disconnect all external disks from your Mac.
2. Connect both your source and destination disks.
3. Open Terminal, located in Applications -> Utilities.
4. Type this command and hit Enter (Return): diskutil list
5. Review the output and get the disk identifiers for your source and destination.

I’ll use an example throughout this guide to help. For my example, I want to create a clone of my Mac mini’s system into another container on the internal drive. I manually partitioned my internal drive by shrinking my main APFS container (disk0s2) and creating another one (disk0s3) to hold my clone. I’m using an M1 Mac Mini running macOS Sonoma 14.5, and my diskutil list output is given below:

encryptor5000@My-Mac-Mini ~ % diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk0
   1:             Apple_APFS_ISC Container disk1         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk3         300.0 GB   disk0s2
   3:                 Apple_APFS Container disk4         194.4 GB   disk0s3
   4:        Apple_APFS_Recovery Container disk2         5.4 GB     disk0s4
 
/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +300.0 GB   disk3
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            10.3 GB    disk3s1
   2:              APFS Snapshot com.apple.os.update-... 10.3 GB    disk3s1s1
   3:                APFS Volume Preboot                 5.4 GB     disk3s2
   4:                APFS Volume Recovery                923.1 MB   disk3s3
   5:                APFS Volume Macintosh HD - Data     23.6 GB    disk3s5
   6:                APFS Volume VM                      20.5 KB    disk3s6
 
/dev/disk4 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +194.4 GB   disk4
                                 Physical Store disk0s3
   1:                APFS Volume Untitled                766.0 KB   disk4s1
 

WARNING: This isn't a standard setup on Apple silicon. The default setup only has 1 normal APFS container on disk0s2. APPLE_APFS_ISC and APPLE_APFS_Recovery are critical containers; do NOT use them or interfere with them.

For me, my source resides in disk3 (inside my Mac, the expanded container of disk0s2). I’ll select the system volume, disk3s1 (Macintosh HD). My destination will be the APFS container disk0s3, also represented as disk4, on the internal SSD (disk0).

Looking at the expanded container on disk4, there is an empty APFS volume (disk4s1) named “Untitled” inside. If you completely erased your destination disk or container as described above, this is the volume that got created inside your new destination container. For me, I want to replace this volume with my clone, so I’ll select it as my target. If I wanted to either remove all volumes from the destination container, or just add the clone into it while keeping “Untitled”, I would select disk0s3 or disk4 (the container itself) as my target.

To make sure that I have enough free space in my destination container for the clone, I'll do some math using the output above:

195 GB total space in destination container (disk0s3, expanded as disk4)

My source macOS volumes in disk0s2 (disk3):

   10.3 GB Macintosh HD (disk3s1, source system volume)

     5.4 GB Preboot (disk3s2)

 923.1 MB Recovery (disk3s3)

    21.9 GB Macintosh HD - Data (disk3s5, source data volume)

+ 20.0 GB extra free space for safety

 -------------------------------------------

58.52 GB total space required for me. My 195 GB destination should have enough room to hold the clone inside.

(If I wanted to preserve the volume "Untitled" from my destination, I'd have to add its used storage to the total space required as well. Luckily for me, it's negligible - it's using less than 1 MB. 1000 MB = 1 GB.)

Boot to macOS Recovery if required

You must start up in macOS Recovery and perform the clone there if all of the below apply:

• Your Mac is running macOS Big Sur or later, and
• The target APFS container holds the current booted macOS.

Why is this required? In macOS Big Sur and later, System Integrity Protection blocks most writes to the Preboot volume for the booted macOS. All macOS installations in a given APFS container share the same Preboot volume, and if the Preboot volume in the destination container is locked (because the current macOS uses it), ASR won’t be able to update it as part of the cloning process.

macOS Recovery doesn’t have this restriction and freely allows the Preboot volume to be modified.

To prepare for cloning in macOS Recovery:

1. Make sure at least one copy of macOS on your Mac has FileVault enabled, or that Find My Mac is enabled.
   1. There’s a bug with ASR in Recovery that makes it fail if Recovery Assistant doesn’t appear at startup.
   2. Turning on FileVault or Find My Mac ensures that Recovery Assistant will appear and ask you for admin credentials when you boot macOS Recovery.
2. Start up in macOS Recovery:
   1. Apple silicon: Shut down your Mac, then press and hold the power button (laptops: Touch ID) for 10 seconds until Startup Options starts loading. Then, choose Options and click Continue.
   2. Intel: Power on or restart your Mac while holding Command-R. Release the keys when the Apple logo and a progress bar appears.
3. Provide an administrator password when prompted. If you weren’t asked for admin credentials, go back to macOS and enable FileVault or Find My Mac. Then, try again.
4. When the list of utilities appears, go to the top of the screen and choose Utilities -> Terminal.
5. Use diskutil list again to identify your source and destination. The IDs might have changed. DO NOT SKIP THIS STEP.
6. If the source macOS is encrypted (has FileVault enabled), use “diskutil apfs listvolumegroups” and “diskutil apfs unlock” to unlock the Data volume for the source macOS. If the source has macOS Catalina installed, you’ll also need to unlock the system volume.

In my scenario, I don’t need to start up in Recovery. If I did, and my disk identifiers remained the same in diskutil list, I’d use this command to unlock the source Data volume with my login password: diskutil apfs unlock disk3s5

Get the startup snapshot name or UUID

macOS Big Sur and later uses a Signed System Volume to protect most system content. This is implemented as a sealed snapshot on the system volume. In order for the clone to boot successfully, this snapshot must be copied over exactly as is. ASR can do this – it just needs to know what the snapshot’s name or UUID is.

First, run diskutil mount sysvol to mount the system volume. Replace sysvol with the disk ID for the source system volume. For me, that’s disk3s1:

encryptor5000@My-Mac-Mini ~ % diskutil mount disk3s1
Volume Macintosh HD on disk3s1 mounted

Now that the source system volume is mounted, run diskutil apfs listsnapshots sysvol to get the name and UUID of the sealed snapshot. Again, replace sysvol with the disk ID for the source system volume:

encryptor5000@My-Mac-Mini ~ % diskutil apfs listsnapshots disk3s1
Snapshot for disk3s1 (1 found)
|
+-- D3E0AF1F-8272-4121-AB7A-9418612CAA97
    Name:        com.apple.os.update-4F9A570DA7279961C47EEA23ABADB587664D0494C3460AB72D34FF0DA60BEA62
    XID:         68
    Purgeable:   No 

For me, the UUID of the sealed snapshot is “D3E0AF1F-8272-4121-AB7A-9418612CAA97” (shown above the name). Either the snapshot’s UUID or name can be used in the next steps, but I recommend using the UUID.

Create and boot from the clone

If you’re not using macOS Recovery, log in to an administrator account. Then, in Terminal, assemble the specific ASR command that you’ll use. Here’s the general format:

sudo asr restore --source /dev/sysvol --target /dev/yourTarget --toSnapshot sysSnap --no-personalization --erase

-   Replace sysvol with the source system volume’s disk ID (disk3s1 for me)

-   Replace yourTarget with the disk ID for the target volume or container (disk4s1 for me)

-   Replace sysSnap with the UUID or name of the source system snapshot. For me, the UUID is “D3E0AF1F-8272-4121-AB7A-9418612CAA97”.

-   If you’re on an Intel-based Mac, exclude the --no-personalization flag.

The command can also be modified to fit your needs depending on how the source macOS and target APFS container are set up. Here's a couple of examples:

To replace an APFS volume (for me, disk4s1) in the container (for me, disk4, or disk0s3) with the clone, I'd use this command: sudo asr restore --source /dev/disk3s1 --target /dev/disk4s1 --toSnapshot D3E0AF1F-8272-4121-AB7A-9418612CAA97 --no-personalization --erase

To completely erase the destination APFS container (delete all volumes inside it) and then put the clone inside it, I'd change my target to the container (disk0s3 for me): sudo asr restore --source /dev/disk3s1 --target /dev/disk0s3 --toSnapshot D3E0AF1F-8272-4121-AB7A-9418612CAA97 --no-personalization --erase

To preserve the existing data and volumes inside the destination container and install the clone alongside it, I would target the container, but remove the --erase flag, like this: sudo asr restore --source /dev/disk3s1 --target /dev/disk0s3 --toSnapshot D3E0AF1F-8272-4121-AB7A-9418612CAA97 --no-personalization

If I was cloning an installation of macOS Catalina or earlier, where there is no Signed System Volume, and erase the target container (disk0s3 for me), I would exclude the --toSnapshot and --no-personalization flags: sudo asr restore --source /dev/disk3s1 --target /dev/disk0s3 --erase

If I’m running from macOS Recovery, I remove “sudo” from the start of the command.

For my scenario, I'll use the first example command, where I use disk3s1 as the source, "D3E0AF1F-8272-4121-AB7A-9418612CAA97" as my source system snapshot, and disk4s1 as the target APFS volume I want to replace with my clone.

Once you run the command and enter your admin password (Terminal won't show any characters as you type it), ASR will prompt you to confirm your request if you asked to erase the target. If you're sure, type "y" and hit Enter (Return).

encryptor5000@My-Mac-mini ~ % sudo asr restore --source /dev/disk3s1 --target /dev/disk4s1 --toSnapshot D3E0AF1F-8272-4121-AB7A-9418612CAA97 --no-personalization --erase
Password:
     Validating target...done
     Validating source...done
     Erase contents of /dev/disk4s1 (/Volumes/Untitled)? [ny]: y
     Replicating ....10....20....30....40....50....60....70....80....90....100
     Replicating ....10....20....30....40....50....60....70....80....90....100
     Restored target device is /dev/disk4s1.
     Remounting target volume...done
Restore completed successfully.

ASR will then show two progress bars. When both are complete, you'll get the message "Restore completed successfully". At this point, your clone has been made, but it isn't bootable yet. There are two or three steps needed to get that done, which the next sections will cover.

If an error message appears instead, open Disk Utility. Select View -> Show All Devices. There should be a volume that has "ASR" in its name. Select this volume and click Erase. When prompted to confirm, choose "Erase Volume Group" to remove the failed clone. If no "ASR" volumes appear, and the original destination volume still exists, nothing needs to be removed or erased.

Rename your clone

When ASR succeeds and completes, it gives the cloned volumes the same names as the original ones, as shown below. Here, the volumes in the container on disk3 comprise the original system, and the volumes in the container on disk4 comprise the clone:

encryptor5000@My-Mac-Mini ~ % diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk0
   1:             Apple_APFS_ISC Container disk1         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk3         300.0 GB   disk0s2
   3:                 Apple_APFS Container disk4         194.4 GB   disk0s3
   4:        Apple_APFS_Recovery Container disk2         5.4 GB     disk0s4
 
/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +300.0 GB   disk3
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            10.3 GB    disk3s1
   2:              APFS Snapshot com.apple.os.update-... 10.3 GB    disk3s1s1
   3:                APFS Volume Preboot                 5.4 GB     disk3s2
   4:                APFS Volume Recovery                923.1 MB   disk3s3
   5:                APFS Volume Macintosh HD - Data     25.4 GB    disk3s5
   6:                APFS Volume VM                      20.5 KB    disk3s6
 
/dev/disk4 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +194.4 GB   disk4
                                 Physical Store disk0s3
   1:                APFS Volume Macintosh HD            10.3 GB    disk4s1
   2:                APFS Volume Macintosh HD - Data     25.4 GB    disk4s2
   3:                APFS Volume Preboot                 10.6 GB    disk4s3
   4:                APFS Volume Recovery                2.2 GB     disk4s4

To help avoid confusion, you should immediately rename your cloned volumes in Disk Utility. Use the Device info field in Disk Utility to help you locate the cloned volumes. For me, I'll rename volume disk4s1 from "Macintosh HD" to "External macOS", and disk4s2 from "Macintosh HD - Data" to "External macOS - Data". If Disk Utility doesn't allow you to rename a volume, unmount it, then mount it again.

NOTE: The Preboot, Recovery, VM, and Update (hidden) volumes are special volumes, and their respective clones should not be renamed. For safety, they do not appear in Disk Utility.

Make your clone bootable

If you used macOS Recovery to create your clone, you’ll need to return to regular macOS to complete the above steps. If you don’t have a copy of macOS installed aside from your clone, create a blank APFS volume in Terminal or Disk Utility, then install macOS to that volume. Use that macOS installation for the above steps.

Once your clone has been renamed, open System Settings -> General -> Startup Disk (or in macOS Monterey and earlier, System Preferences -> Startup Disk). Your clone should appear. If a padlock appears in the bottom left corner, click on it and provide your admin password when prompted. Then, select it, enter your password again if asked, and click Restart. Click Restart again when prompted to confirm.

If you're on an Apple silicon Mac, you should then get the message "This volume does not have any authorized users for this computer". Click Authorize Users and follow the onscreen instructions. You will need to enter your password several times for this. This process grants the clone access to the Owner Identity Key. Without this access, the cloned macOS cannot install updates or change its security policy.

Make sure you can boot from external media

If your Mac has the T2 Security Chip (not M1 or later), start up in macOS Recovery and open Startup Security Utility. Make sure that your Mac is permitted to boot from external media. Save your changes and then restart.

Test!

If completely successful, you should now be able to boot from your clone. If you cloned to an external hard drive (not SSD), beware that the boot process can take longer than a minute to complete.

What if I get stuck in a boot loop?

If macOS somehow fails to boot on the clone, and your Mac shows an Apple logo, a progress bar, and then suddenly restarts repeatedly, you can still start up from the original source macOS that was cloned. Follow these steps:

1. On an Intel-based Mac, hold down the Option key as soon as the screen goes black. On a Mac with Apple silicon, hold down the power button (Touch ID on laptops) as soon as the screen goes black.
2. Release the Option key or power button when a list of startup disks appears (Intel), or the message “Loading startup options” appears (Apple silicon).
3. Hold down the Control key, select the original source macOS (usually “Macintosh HD), and click the circular arrow (Intel) or “Always Use” (Apple silicon).
4. Your Mac will set the source macOS as the default and will immediately start up from it. 

To resolve any boot or startup issues on the clone, start up from macOS Recovery and reinstall macOS onto the clone. You don't need to erase anything in order for this to succeed.