Skip to article

Temporary Rescue

Portable Rescue provides temporary remote access on a running operating system, including when the persistent Daemon is unavailable. It supports attended bootstrap, one-time work and recovery without permanent enrollment or a background support account. Follow the private shared page's instructions and enter its separately supplied code at the local prompt.

Packages and authority

Browser shared TARs contain forge-host, release-manifest.json and release-manifest.sig; they contain no embedded code or README.txt. CLI-prepared folders are different and can include generated private code/instructions. Never paste codes into chat, command arguments or logs. Verify package/platform trust before execution. Local Allow/End, fresh OS-admin approval and current owner-bound authority apply; a visible history row or shared URL alone does not permit control.

Active lifetime and returning after sign-out

Bridge 1.21.214, Daemon 0.24.0 and CLI 0.39.0 support fresh Rescue approval until End or device restart. The download/code still has a separate redemption expiry; that expiry does not stop an already-active task. Earlier signed capsules keep their original timed lifetime.

The approved worker runs in a protected temporary machine service so lock, sleep and sign-out do not end it. It does not enroll a permanent device, create a support account or automatically restore approval after reboot. The local launcher exposes End; reopen that same launcher after sign-out rather than requesting another session. Starting or reopening privileged local controls can require the normal OS administrator decision. Never automate that decision or bypass an OS warning.

Promotion, expiry and cleanup

Promotion requires separately authorized enrollment and preserves original Rescue identity/history. End/revocation removes access, not proof of remote deletion. An expired unused download cannot start new work. Unconfirmed closure retains protected recovery evidence; retrying the original End never starts the work again. Guarded bootstrap cleanup removes only verified executable/sidecars; unsafe paths or launch-policy failures retain them. Scheduled cleanup is not completed cleanup. Mac requires matching target hardware and technical-preview privacy/Gatekeeper limits. Access, diagnostics, installation and CLI retain exact supported workflows.

Repair Live USB

Repair Live USB boots a separate Linux operating system so an agent can investigate and repair a machine whose installed OS cannot boot. The live environment supplies shell access and repair tools; the agent can work on the installed system and check the outcome after reboot. A diagnostic collector is optional for shell work.

Get the source-only builder from Downloads and follow its bundled build and pairing instructions. The retained pairing combines SystemRescue 13.02 with signed Linux Rescue 0.15.1 and assembles an ISO locally. Follow that package's own pairing and expiry rules; compatibility with current companions has not been reverified.

  1. Boot and pair separately. Identify the intended USB or VM before writing the image; writing a USB image erases that selected medium. Boot the live OS, establish networking and arrange a Linux Rescue session. The person at the target enters its separately supplied private code. Booting alone grants no remote access and performs no automatic enrollment, disk mounting or upload.
  2. Identify the installed system. Live-OS measurements describe the running recovery environment. Identify the intended disk, partition and installation before interpreting evidence or changing its files.
  3. Carry out the agreed repair. Begin with read-only inspection. Preserve suitable backup and rollback material before corrective writes, taking disk health into account. Encrypted storage requires legitimate recovery keys or passphrases and permission to use them; the live OS does not bypass encryption.
  4. Verify and return to the installed OS. Check the repair, sync and unmount affected filesystems, then close Rescue and check its cleanup result. Boot the installed system without the live media and establish the outcome. Reconnection uses that OS's existing access path or separately authorized enrollment there; enrolling the live OS does not enroll the installed OS.

Recorded acceptance covers a Debian ext4/fstab repair and reboot in a BIOS VM. Physical USB/UEFI, general Windows recovery, wider hardware and encrypted-storage recovery need their own acceptance. Secure Boot is unsupported by this integration. The download provides a local builder; redistribution of a derived ISO has separate licensing and corresponding-source obligations.