The restore process should be modeled after management/backup.py:
If this is on a machine with Mail-in-a-Box already running, perhaps force a backup before proceeding.
If this is on a fresh machine, backup dependencies (openssl, duplicity, etc.?) need to be installed and STORAGE_ROOT and STORAGE_USER need to be determined. Perhaps this means the restore should be baked into setup/start.sh.
Call openssl to decrypt files to a new directory.
Run duplicity to restore the unencrypted files to $STORAGE_ROOT. Duplicity needs to be told to use some other temp path as a cache and that temp dir needs to be purged at the end. The user will also need to be asked which timestamp to restore.
Run setup/start.sh to ensure things are in working order.
I just wanted to make a note here that the link in the previous reply links to outdated information. Please do not follow the link and attempt to follow the procedure in it as you will only frustrate yourself.
The information provided by @luanntvn was absolutely relevant at the time it was written as that was in the early days of MiaB and guides were not yet in place, however not so now as new versions have changed the procedures.