Home / Devices / NAS External Drive

NAS Data Recovery Aberdeen

One box. On a shelf. The company files on it, and the family photographs too. This is where the majority of people learn that their "backup" has never been a real backup. And so... A single disk falls off. A rebuild stops dead. The entire unit fails to boot up one Monday morning. Volumes from Synology and QNAP devices, WD My Cloud, Buffalo and Netgear boxes are all brought back online here from the bare disks. First, get a quote; second, send your disks, each labelled with the bay it came from. Keep the case, unless you cannot pull the disks; if you cannot remove them, send us the entire NAS.

▲

Each NAS task is evaluated without cost. The fixed price will be sent to you in writing prior to any tools coming out.

In most cases you only pay if we recover your data. The exceptions are electronic/mechanical failures, chip level work, DVR and forensic jobs. All pricing information can be found on the data recovery cost page.

// twenty-five faults this bench knows cold

The twenty-five ways they quit

The very first step taken with each NAS job is to identify the cause of the symptoms. We have been working on NAS jobs for over twenty years now, and these twenty-five faults cover virtually every possible failure mode that may reach this bench.

One bay lit red

It was designed for, and it is survivable, but this is also the point where your array is one hiccup away from actual trouble. Consider this light a fire alarm; do not consider it something to check "next week".

The rebuild killed a second drive

It is the resilver load that causes a tired survivor to die. This is by far the most frequent type of NAS disaster that has been booked into this workshop, and not by a small margin.

Dashboard red, data unharmed

Array logic has failed. However, the data contained beneath the failing array logic has not failed. This is reconstruction work. Pressing the restore button located on the front panel does nothing towards restoring the original data.

A setup wizard being helpful

A simple reassuring click resets the configuration back to its default values and also begins overwriting your data on certain models. While good intent exists here, the process should be stopped immediately.

An update that bricked the box

The firmware expired during a flash process around an array which was in pristine condition. The drives have no idea that anything is wrong and don't even care. They come out and are placed in the imaging bays.

Members out of step with each other

Power loss while writing parity means both disk member volumes have different data and are unable to be mounted together. However, both can be reconciled from complete images, which makes the disagreement "something to look at" rather than "something to be afraid of."

Enclosure dead, drives fine

Box electronics fail around perfectly good disks much more frequently than the disks themselves fail. The imaged members bring the volume back to life virtually, and the enclosure was only ever the replaceable component.

Shares or snapshots deleted

Both can be carved back for as long as nobody else claims their blocks, so there's only one thing that matters, which is time. Move fast and don't touch anything during this time frame.

Ransomware reached the NAS

Any item accessible via the internet is considered an attractive target by potential attackers. Since attackers typically delete everything they can view, the tree(s) containing snapshots underneath these deleted items may still exist.

Drives put back from memory

Disks pulled, shuffled, second-guessed and reinserted into the array in a hurry, sometimes multiple times. The metadata of this array still contains the correct order of where each disk belongs (even though no one in the room can tell you), as long as the experimenting stops right now.

Synology layering torn by a hard stop

Since SHR combines multiple sized disks into a single pool, and since both mdadm and LVM sit below it, and btrfs or ext4 sits above it, losing power in the middle of performing a task on this stack causes the entire stack to tear apart. On a DS220+ or a DS923+ we rebuild this stack layer-by-layer from full images, starting with the lowest level first.

QNAP volumes slipping away

When a member fails in the middle of writing (and thus causes the pool to lose sight of how much space it has allocated), flexible volumes collapse. First, each drive is fully imaged; then, once complete, the volume is "stood up" virtually.

A My Cloud stuck mid-flash

Even though the box is bricked, a single-bay unit's Linux-formatted disk remains perfectly functional, so it can be mounted natively (locally) and the entire contents simply pulled off, thereby completing the job.

A TeraStation with amnesia

From time to time, Buffalo box enclosures will lose their array configuration. However, this doesn't affect the individual member disks' configurations, which remain intact. As such, the layout of the system may be recovered from the drives themselves (i.e., read directly off the disks) rather than attempting to coax it out of the enclosure.

IronWolves ageing in step

If you purchase a batch of ST4000VN006 drives, they will wear down uniformly with respect to each other; therefore, the second failure occurs soon after the first failure. The day one goes bad, image all of them rather than replacing a single disk.

An expansion abandoned partway

The broken capacity expansion that left the pool stretched halfway with a refusal to mount. Using images, we reconstruct this expansion in order (step-by-step) the same way it was first attempted.

A Red Plus voted off the island

WD40EFPX disks take too long to recover after they have experienced an error and are therefore dropped by the controller. However, put this same disk onto hardware that is willing to wait and it will image just fine.

Heat in a closed cupboard

After years locked inside a sealed cabinet running warm, the box loses drives at roughly the same time. The proximity in loss indicates that there are likely other issues with the remainder of the drives, and that you should image the entire group. It does not indicate replacing one drive.

Shingled drives exposed by a rebuild

SMR members can handle their duties every day but fail once resilvers begin. This was demonstrated by the industry publicly several years ago. The disks are imaged using shingle-aware pacing prior to beginning the rebuild process.

Rot surfacing on rebuild day

The hidden bad sector(s) that were accumulating over time on an archive nobody ever scrubbed are presented all at once in just a short period of time, specifically when there isn't enough redundancy left. Imaging it first defuses that.

System partitions failed, data untouched

The box's small operating system partitions are mirrored across each disk. If those partitions become corrupted, the box will refuse to boot; however, the underlying data volume may be perfect. The data is extracted directly from the images.

An SSD cache that brought the volume down

Put a cache in "read/write" (RW) mode and it holds data which has never been written out to disk. Lose the RW device, or one half of a cache pair, and the volume will refuse to mount, because a portion of it really is missing. We treat the cache as a complete member of the set, and image it as such.

Disks moved into another make of box

When a NAS fails, most people's first instinct is to place the disks into a different one. Most vendors design their arrays differently and therefore the new box will offer to format/initialise these disks. Once you accept this option, there is no going back, and the drives need a bench before that happens.

A btrfs volume with nowhere to work

Modern NAS file systems require free space just to track changes, so if your volume is full there is no way to delete files to clear some space. Snapshots occupy this same space, making it worse. It gets untangled from an image, without the risk of working live.

An encrypted folder without its key

Folder-level encryption is provided by both Synology and QNAP. They use a "key" file which they tell users to save somewhere secure. Wherever "secure" happens to be for those users, many times it's the NAS device itself. Without a "key" or a passphrase, the folder remains locked, and we tell you so at the diagnostic stage.

Redundancy buys uptime. It does not buy safety

RAID (or the vendor's version of RAID) is how most NAS devices spread data across their disks. For example, Synology sells SHR while Drobo sold "BeyondRAID", but none of these has anywhere near as much margin built in as their packaging implies. Most likely you will be able to recover if you lose just one disk. The real problem comes after this loss. A rebuild process uses all available resources on each surviving disk to read every single sector for many hours. This is exactly when the other disks in the system (same age, same manufacturing lot) also choose to fail. Your disks are kept well away from that here. First we take a full image of each of your disks. Then we derive order, stripe size and parity rotation from those images. Then we create the volume in software. Finally we build your files from the volume. No bytes are ever written back to your original hardware.

Getting a NAS into a box without wrecking it

Do not click on the "rebuild" option. The "reinitialise" option in the wizard is misleadingly worded and it is the most destructive option available. What to do instead: shut your device down properly, remove one caddy at a time, and label each disk you remove with the corresponding bay number. When the array is being put back together, the original order of the bays makes a big difference. Get a quote first via telephone or using our free online diagnostic; then post us the labelled disks, or drop them off at our Edinburgh lab (Monday to Friday, 9am to 5:30pm, no appointment needed), and keep the empty casing. For a unit containing a single disk (such as a My Cloud) simply open up the case, and send just the bare disk. If you cannot get the plastic clips undone, call rather than forcing them, and send the whole NAS instead, because the clips lose that argument and so does the disk behind them.

// the kit behind the work

Engineering kit, not downloaded software and hope

Recovering a NAS is essentially RAID recovery but with vendor specific dialects, and the ones that matter are spoken fluently here:

Parallel imaging bays

Each member will be cloned at the same time on specialised hardware prior to anyone making recommendations on configuration. All other risks are then placed on clones. Original members remain static.

PC-3000 RAID and Data Extractor

Stripe size, stripe order, stripe rotation, and stripe offset determined based on the clone, and then the array is built virtually. Layout geometry verified through testing on the workbench, never assumed from documentation.

PC-3000 UDMA and repair bench

A "dead" member (or drive) must be a complete mechanical repair task unto itself. It gets everything it needs (heads, circuit board, firmware etc.) until it can be imaged alongside every other drive in the set.

Virtual RAID reconstruction software

When doing parity arithmetic and/or running entropy tests, there must be agreement between those results and the solved layout before any file is lifted off it; hunches don't survive this process. That is exactly why we do it.

Vendor layout parsers

This covers several different types of RAID and volume configurations including SHR, X-RAID, BeyondRAID, QNAP flexible volumes, mdadm under LVM, btrfs and ext4. Every proprietary layer is essentially stripped away and converted back into simple named folder structures.

Single-bay enclosure kit

Single drive home units are opened without causing damage, have their Linux-formatted disks mounted natively, and then all of the contents of each disk are copied out in one piece rather than in fragments.

// makes & models we see

NAS makes we recover

SynologyQNAPWestern DigitalBuffaloNetgearTerraMasterAsustorDroboLaCieZyxel / D-Link (legacy)

The units rebuilt most often

Two-bay DiskStations and the QNAP TS-x53 range are what you find humming away in the stockrooms, studies and back offices around Aberdeen and the shire, so those head the rebuild ledger. Open one up and you generally find IronWolf ST4000VN006 or WD Red Plus WD40EFPX disks purchased during the same afternoon. This would explain why they tire together and then fail in unison. When Drobo closed its doors, that left the owners of BeyondRAID with lab work as their last option, which is unfortunate and true. The drive order is the one thing that customers enquire about the most. Truthfully: yes, the array metadata still knows it. However, a marker pen applied to all caddies prior to removal from an enclosure will make each subsequent stage faster and safer. Whatever badge is on the front makes no difference to the drill. Turn off the power, number the drives, get a quote first via either phone or the free online diagnostic, then post the drives or drop them off at our Edinburgh lab (Monday to Friday, 9am to 5:30pm, no appointment needed), and keep the shell. If the disks won't come out, send the entire NAS.

Synology data recovery

DSM sits with a smiling face on top of an enormous stack. At the bottom, disks of different sizes are blended into a single pool by SHR, with mdadm and LVM underneath that, and either btrfs or ext4 rides on top of them all. Therefore, there is no way for most general-purpose disk utilities to make sense of what happens when a volume fails on a DS220+. These tools read through one layer of data but cannot find the answers, which lie spread across all three. Here the problem is addressed in build order, always working from complete member images: first solving how the SHR configuration is built, next mounting the file system virtually, and finally extracting your shared folders whole. The same method is used whether it is a two-bay device from a spare bedroom or a rackmount device from a server cupboard, whatever combination of drive capacities was fitted.

Netgear and D-Link NAS recovery

With every capacity addition, X-RAID modifies a ReadyNAS volume. The results appear as expansion zones built on top of each other. Each zone has been interpreted by general purpose utilities as damaged, and they have made their interpretation very clear. If the zones are put back into the original order they were created in, then the volume mounts exactly how the box intended. There is an easier version of this problem. Cheap single-bay units are generally formatted ext4 or XFS. Windows will see no familiar file system on the unit, pronounce the disk blank and suggest formatting it. Decline that suggestion. All of your shares are intact, and this workshop mounts both of these file systems natively.

// before it goes in the box

Before it goes in the box — free the drive if you can

Switch off the unit safely. Write each bay number on its disk individually, e.g., 'first', 'second' and 'third', before they go anywhere near a box. The labelling will pay for itself many times during the rebuild. Just send the disks. Your case stays with you, unless it is a sealed single-bay unit that nobody can open. Before sending us your disks, obtain a quote either via telephone, or through our free diagnostic process online. Once you have received your quote, post them to us tracked and insured, or book a courier yourself to bring them. Alternatively, please deliver them personally to reception at Edinburgh Data Recovery, 4 Redheughs Rigg, Westpoint, South Gyle, Edinburgh EH12 9DQ, which is about two and a half hours down the A90. We are open Monday to Friday, 9am to 5:30pm, with no appointment needed. Please note, collection services do not operate from our lab, so you would need to arrange transport yourselves.

// getting your device to us

Getting it to the bench — plainly done

Get a quote first by telephone or use our free online diagnostic. Most of what you see on this bench will then be delivered via tracked, insured post. This is one of the safest ways to move a failing drive and packages handed in at a North-East post office are normally delivered here the next working day.

Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.

  • Place bubble wrap around the drive then place inside of a rigid box or padded envelope. Pack as tightly as possible so that there are no loose objects within the container. Leave all cables, caddies and power supplies behind except for when sending an individual external drive. When posting an individual external drive, send it whole, in its housing along with its own cable and power supply.
  • Print off the shipping & booking-in form (PDF). Write down your name, mobile number, and a brief description of what occurred. Place this document into the same package as the drive.
  • The Royal Mail Special Delivery service offers both tracking and insurance from door-to-door. Using your own courier service will achieve the same results.
  • Want to hand it over yourself instead? After receiving your quote, reception will accept drop-offs at the address below, Monday to Friday, 9am to 5:30pm, with no appointment needed.
// where your device is headed

Edinburgh Data Recovery

4 Redheughs Rigg
Westpoint, South Gyle
Edinburgh, EH12 9DQ

↓ Print the shipping & booking-in form (PDF)

Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.

Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.

// nas external drive recovery questions

Common questions

It isn't as bad as the phrase might make it sound. Typically it is the array's own internal bookkeeping which has been damaged (the actual data lies undisturbed across the disk platters), and so each individual disk is imaged. The structure of the data is reassembled through software means. Shares are then pulled out of the newly reconstructed structure, never from your unit.
Frequently not. NAS manufacturers tend to be very quick to mark a disk as bad. In contrast lab quality imaging equipment is much more patient with poor quality sectors and many times a disk that the NAS marked as bad and immediately failed on can be fully read. Once a solid image of what is supposedly a lost or failed disk is obtained and placed alongside the other good drives in the set, typically enough redundancy exists for recovery.
Because rebuilding on worn out disk drives is the fastest way to totally lose an array. Shut off the system, label the individual disks, and get each one imaged. Then do a proper rebuild on completely new hardware, after your data is sitting somewhere else entirely.
Fully recoverable. This device has an internal single drive with a standard Linux file system. It's no wonder that when you plug it in directly, Windows will prompt you to format it. Give us a call to get a quote first, and then take a look at opening up the shell on your side of things and sending just the drive itself. If you can't get the case to disassemble, send us the entire NAS.
// related services

Other work this lab takes on

// specialist pages

Go deeper

The bench is ready when you are.

Free diagnosis, one fixed price quoted in writing, and in most cases you only pay if we recover your data. Start online or phone it in.