DenchClaw Backup and Recovery: Protect Your Data

Your DenchClaw workspace contains your entire CRM: contacts, deals, notes, account history, custom apps, memory files. If your laptop is stolen, fails, or you accidentally corrupt the DuckDB file, you need a way to restore. The good news: DenchClaw's local-first architecture makes backups straightforward — it's just files.

This guide covers automated backup strategies, cloud sync, encryption, and recovery procedures.

What Needs Backing Up#

The complete DenchClaw workspace is at ~/.openclaw-dench/workspace/. Within it:

Do not back up:

• browser-profile/ — browser session cookies (security risk)
• .openclaw/logs/ — large, regenerable, not needed for recovery

Backup Strategy: The 3-2-1 Rule#

The standard backup rule: 3 copies, 2 different media types, 1 offsite.

For DenchClaw:

• Copy 1: Live workspace on your laptop (original)
• Copy 2: Time Machine on external drive (local, different media)
• Copy 3: Encrypted cloud backup (iCloud, Dropbox, or S3 — offsite)

Method 1: Time Machine (macOS)#

The easiest backup for Mac users. If you have an external drive or Time Capsule:

1. Time Machine is configured in System Settings → General → Time Machine
2. By default, it backs up the entire home directory — including your DenchClaw workspace
3. Hourly backups, with history going back weeks

Recovery: If the DuckDB file is corrupted or accidentally deleted, open Time Machine, navigate to ~/.openclaw-dench/workspace/workspace.duckdb, and restore a specific version.

Time Machine covers the "I accidentally deleted something" and "hard drive failed" scenarios. It doesn't protect against laptop theft or total disaster.

Method 2: Automated Cloud Sync#

Set up a daily backup to cloud storage using an agent cron job:

"Every day at 2am, back up my DenchClaw workspace to ~/Dropbox/denchclaw-backup/ with today's date in the filename. Exclude the browser-profile and logs directories."

The agent creates a cron job that runs:

#!/bin/bash
DATE=$(date +%Y-%m-%d)
BACKUP_DIR="$HOME/Dropbox/denchclaw-backup"
WORKSPACE="$HOME/.openclaw-dench/workspace"
 
mkdir -p "$BACKUP_DIR"
 
# Backup DuckDB (the most critical file)
cp "$WORKSPACE/workspace.duckdb" "$BACKUP_DIR/workspace-$DATE.duckdb"
 
# Backup the rest (excludes browser profile and logs)
tar -czf "$BACKUP_DIR/workspace-files-$DATE.tar.gz" \
  --exclude="$WORKSPACE/browser-profile" \
  --exclude="$WORKSPACE/.openclaw/logs" \
  "$WORKSPACE"
 
# Remove backups older than 30 days
find "$BACKUP_DIR" -name "*.duckdb" -mtime +30 -delete
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +30 -delete
 
echo "Backup complete: $DATE"

With Dropbox or iCloud Drive sync enabled, this backup immediately syncs to the cloud.

Method 3: Git Version Control#

For workspace schema and document versioning:

cd ~/.openclaw-dench/workspace
 
# Create .gitignore
cat > .gitignore << 'EOF'
workspace.duckdb
*.duckdb
.env
browser-profile/
.openclaw/logs/
EOF
 
git init
git add .
git commit -m "initial workspace snapshot"
 
# Add remote (use a private repo)
git remote add origin git@github.com:yourusername/denchclaw-workspace-private.git
git push -u origin main

Set up auto-commit via the agent:

"Every night at midnight, commit any changes in my workspace to git with a message showing today's date and a summary of what changed."

Git gives you version history for your object YAML files, documents, and skill files — not the DuckDB data (binary files don't diff well), but all the structural pieces.

Important: Use a private repository. Never push the .env file (add it to .gitignore first).

Method 4: Encrypted DuckDB Backup#

For maximum security, encrypt the DuckDB backup before storing it:

Using macOS Disk Images#

# Create an encrypted disk image
hdiutil create -size 1g -encryption AES-256 \
  -volname "DenchClaw Backup" \
  -fs HFS+ \
  ~/secure-denchclaw-backup.dmg
 
# Mount it
hdiutil attach ~/secure-denchclaw-backup.dmg
 
# Copy the backup
cp ~/.openclaw-dench/workspace/workspace.duckdb /Volumes/DenchClaw\ Backup/
 
# Unmount
hdiutil detach /Volumes/DenchClaw\ Backup

Using age Encryption (Cross-Platform)#

brew install age
 
# Generate a key pair
age-keygen -o my-backup-key.txt
# The public key is in the output — save it
 
# Encrypt the backup
cat ~/.openclaw-dench/workspace/workspace.duckdb | \
  age -r age1xxx...your_public_key... > \
  workspace-backup-encrypted.duckdb.age
 
# Decrypt for restore
age -d -i my-backup-key.txt workspace-backup-encrypted.duckdb.age > workspace-restore.duckdb

Store the age private key separately from the backup (password manager, separate encrypted drive).

Recovery Procedures#

Scenario 1: Corrupted DuckDB File#

Symptoms: DenchClaw fails to start, database error on query, unexpected data missing.

Recovery:

1. Stop DenchClaw: openclaw gateway stop
2. Copy backup: cp ~/Dropbox/denchclaw-backup/workspace-YYYY-MM-DD.duckdb ~/.openclaw-dench/workspace/workspace.duckdb
3. Restart: openclaw gateway start
4. Verify: Ask the agent "how many people entries do I have?" and confirm the number matches expectations

Data loss: You lose any changes made since the last backup. For daily backups, worst case is 24 hours of data.

Scenario 2: Accidental Record Deletion#

If you deleted a record you need back:

1. Identify the most recent backup before the deletion
2. Open the backup DuckDB alongside your live database:

   Copy

   duckdb ~/.openclaw-dench/workspace/workspace.duckdb

3. Attach the backup:

   Copy

   ATTACH '~/Dropbox/denchclaw-backup/workspace-2026-03-24.duckdb' AS backup;

4. Query the backup for the deleted record:

   Copy

   SELECT * FROM backup.entries WHERE id = [deleted_id];

5. Insert it back into the live database

Scenario 3: New Machine Setup#

If you're migrating to a new laptop:

1. Install DenchClaw on the new machine: npx denchclaw
2. Stop DenchClaw before replacing files: openclaw gateway stop
3. Copy your workspace backup to the new machine
4. Replace the new empty workspace with your backup:

   Copy

   cp -r /path/to/backup/.openclaw-dench/workspace/* ~/.openclaw-dench/workspace/

5. Restore your .env file (from your password manager)
6. Restart: openclaw gateway start

Your entire CRM, all apps, all memory files, all skills — restored completely.

Testing Your Backups#

A backup you've never tested is a backup you don't know works. Test your recovery procedure quarterly:

1. Pick a recent backup file
2. Open it in DuckDB: duckdb your-backup.duckdb
3. Query: SELECT COUNT(*) FROM entries; — confirm the count is reasonable
4. Check a specific record you know: SELECT * FROM v_people WHERE "Full Name" = 'Sarah Chen';

Knowing your backups are good is worth 15 minutes every quarter.

Frequently Asked Questions#

How large is a typical DenchClaw backup?#

For most users, the DuckDB file is 1-50MB. With hundreds of thousands of entries and rich documents, it might reach a few hundred MB. The entire workspace directory (including app code and documents) is typically under 500MB. This fits comfortably in any cloud storage free tier.

Can I use Time Machine and cloud backup simultaneously?#

Yes — that's the recommended approach. Time Machine protects against local failure; cloud backup protects against physical loss or disaster. The 3-2-1 rule: have both.

How do I back up on Linux?#

The same file paths apply (~/.openclaw-dench/workspace/). Use cron, rsync, and rclone (for cloud sync) instead of the macOS-specific tools. DenchClaw's agent can set up the backup cron job for you:

"Set up a daily backup script for Linux that copies my workspace to ~/backups/denchclaw/ using rsync and syncs to Backblaze B2 using rclone."

What about the .env file with API keys?#

Back it up, but encrypted and separately from the DuckDB file. Store it in your password manager (1Password, Bitwarden) rather than in plaintext backup files. The .env file should never be in a non-encrypted location — not cloud storage, not unencrypted external drives.

Ready to try DenchClaw? Install in one command: npx denchclaw. Full setup guide →