NAS Data Recovery

Since 2004, we have been successfully recovering data from compact Network Attached Storage (NAS) server solutions from all manufacturers. You only pay if the data recovery is successful.

NAS Data Recovery for Logical Defects

With a logical defect the hardware of the network storage is intact. What is disturbed sits in the layers above it: the configuration of the array, the volume manager or the file system. The loss often goes unnoticed for a while. A volume no longer mounts after a restart, shares disappear from the network, or a folder suddenly shows no content even though the user data still sits physically unchanged on the drives.

That is exactly why one thing decides the outcome in this situation: that no further writes reach the system afterwards. If viruses, worms, trojans or ransomware have infected the device, we recover important files quickly and with a high success rate. Please note our first aid measures for data loss and our overview of logical defects on storage media.

NAS Data Recovery for Physical Damage

Power failure, overvoltage, the failure of individual hard drives: the causes of a defective NAS are varied. Unlike a single disk, the damage often goes unnoticed at first, because a redundant array absorbs the loss of one drive. Only when a second one follows does the storage system come to a halt.

With mechanical and electronic damage our specialists repair the affected disks in the clean-room laboratory, replace read/write heads or electronics with spare parts from the same model, and then read out each disk individually as a write-protected image. Only on those copies does the actual reconstruction begin. How mechanical defects arise is explained separately.

Why a NAS Is Treated Differently From a Single Hard Drive

A NAS is not one large storage device but a small Linux server that organises data storage across several stacked management layers. The data is spread over an array of hard drives, above it sits the RAID layer, above that a volume manager and only then the file system itself. A recovery succeeds only if every one of these layers is reassembled in the right order. The advantages of a redundant array in daily use therefore reverse in the event of damage: what raises availability makes the recovery more demanding.

There is a practical consequence. Off-the-shelf data recovery software and recovery tools see individual drives only and can reconstruct neither the array nor the structures above it; problems on a higher layer stay invisible to them. Attempting a recovery yourself on the running device therefore often makes the starting position worse rather than better. How an array distributes data and which RAID levels are involved is described in detail on our page about RAID data recovery.

Common Causes of NAS Data Loss

• a defective hard drive or the failure of several drives in the array
• overheating of the server system
• a deleted or overwritten RAID configuration
• an accidentally formatted volume
• overvoltage, lightning strikes and defective power supplies
• a failed RAID controller
• a damaged file system after a power cut
• a failed firmware or operating system update
• ransomware and other encryption by malware
• a rebuild aborted after replacing a disk

Many network storage devices use a RAID array as a safeguard. A RAID is not a backup, however; it raises availability. Why that is an important distinction is explained in our article RAID is not a backup.

First Steps After Data Loss on a NAS

1. Disconnect the NAS from the network and switch it off, especially if ransomware is suspected.
2. Do not start a second rebuild. An aborted rebuild can rarely be fixed by another one.
3. Do not re-initialise the array and do not create a new configuration, even if the device interface suggests it.
4. Do not run data recovery software on the original disks. Tools of that kind work at the level of individual drives and cannot represent the array.
5. Label the bay positions. The order of the disks is an important parameter for the reconstruction.
6. Document the sequence of events: what was the last change, which drive was replaced, which message appeared first? These details shorten the diagnosis.

One note on seemingly harmless steps: a firmware update, a reset to factory settings or the creation of a new volume also writes to the management data and should be avoided in the event of damage.

Ransomware on a NAS

Network storage is a popular target because it is permanently reachable and often holds the backups of a household or a company as well. Campaigns such as DeadBolt, Qlocker or eCh0raix exploit gaps in the firmware or in remote access functions and then encrypt folders and shares.

A ransom should not be paid. Whether a recovery without the key is possible depends on the method used and on how the malware treated the original files. If they were merely deleted after encryption rather than overwritten, they can often be retrieved from the file system. What matters is therefore to disconnect the device from the network immediately, delete nothing and leave the state unchanged until the analysis is complete.

File Systems and Arrays We Read

Most NAS devices run Linux internally and lay out their volumes accordingly. On top of that come vendor-specific methods that depart from the standard. We evaluate these structures independently of the device:

The device-specific particularities are covered on the respective pages. If a system reaches us that is not listed here, we determine its structure during the analysis.

What Determines the Chances of Success

A blanket success rate cannot be stated seriously for NAS systems - the starting positions differ too widely. From more than 20 years of experience with failed network storage in companies, public authorities and private households, however, we can name the factors that shift the outcome in an individual case:

The diagnosis therefore always comes first. Only once the condition and readability of every single drive are established can we say reliably what is achievable. You receive that assessment before placing the order, together with a binding fixed-price offer. Before handover we present a list of the recovered files and folders. Our overall approach is described on our page about the data recovery process.

Costs and Prices of NAS Data Recovery

• Standard NAS data recovery: from 449 EUR for typical faults. These prices are the lowest possible ones. Individual fixed prices based on a preliminary analysis are available on request.
• 24/7 express NAS data recovery: individual fixed price. Prices depend on the individual effort. After a preliminary analysis we are happy to make you an individual fixed-price offer.

The following points mainly determine the effort involved:

• the number of drives, because each disk is diagnosed and cloned individually
• the type of damage, as purely logical cases are less demanding than mechanical or electronic defects
• the amount of clean-room work required, for instance when replacing read/write heads
• the complexity of the configuration, from a two-disk mirror to a nested array
• the urgency, since express handling runs around the clock and is scheduled with priority

An overview of all services is available in our price overview.

NAS Data Recovery: All Manufacturers and Systems

As a data recovery provider with its own clean-room laboratory we work independently of the manufacturer. Neither the original device nor the original controller is needed to reconstruct an array; nested arrays made up of several groups are reassembled as well. For the three most common systems there are dedicated pages with the device-specific particularities:

• Synology NAS data recovery (DiskStation, RackStation, DSM, SHR)
• QNAP NAS data recovery (Turbo Station, TS series, QTS and QuTS hero)
• Buffalo NAS data recovery (LinkStation, TeraStation, CloudStation)

Beyond those, we regularly handle devices from these vendors:

• ACER NAS data recovery (Aspire EasyStore / AC100 Micro Server)
• Asustor data recovery (e.g. AS-602T / AS-604T / AS-606T / AS-608T / AS-609RD)
• Cisco NAS data recovery (CISCO-SMB NAS Smart Storage)
• CnMemory NAS data recovery (Spaceloop / Exito NAS server)
• Digitus NAS data recovery (e.g. Mini NAS / Gigabit NAS)
• D-Link NAS data recovery (ShareCenter, Cloud ShareCenter)
• Drobo NAS data recovery (e.g. Data Robotics Drobo 5N / 5D)
• Freecom NAS data recovery (Network Drive / Silverstore)
• Fujitsu NAS data recovery (Celvin NAS Server)
• HP NAS data recovery (HP StoreEasy / X1400 Storage System / HP StorageWorks / StoreOnce Backup System)
• Inxtron RAID data recovery (e.g. MD4 eSATA)
• Iomega NAS data recovery (StoreCenter / EZ Media and Backup Center / Lenovo Iomega NAS / Lenovo EMC NAS)
• Lite-On NAS data recovery (e.g. Plextor NAS4 series)
• LevelOne NAS data recovery (e.g. GNS-4001 / GNS-2000)
• LaCie NAS data recovery (e.g. 2big NAS / 4big NAS / 5big NAS)
• LG NAS data recovery (e.g. N1T1DD1 / N4B1ND4 / N4B2N)
• NetApp FAS / DS NAS solutions
• Netgear NAS data recovery (ReadyNAS)
• Promise NAS data recovery (SmartStor / Pegasus / VTrak)
• Seagate NAS data recovery (FreeAgent GoFlex / Business Storage / BlackArmor NAS)
• Tandberg NAS data recovery (e.g. BIZNAS R400 / Tandberg 5100 NAS / BIZNAS R408)
• Thecus NAS data recovery (e.g. N4100Pro / N4200Eco / N7700Pro / N6850 / N5200 Pro)
• Toshiba NAS data recovery (StorE Cloud)
• Western Digital (WD) NAS data recovery (My Book Live / WD Sentinel)
• ZyXEL NAS data recovery (e.g. NSA 325)

All common storage media in an array are handled: SATA and SAS hard drives as well as SSDs and mixed configurations. For individual drives outside a NAS, our pages on hard drive data recovery and SSD data recovery go into more detail. If the device serves as storage for a hypervisor, our page on data recovery for virtual systems adds the evaluation of VMDK, VHDX and QCOW2 files.

Frequently Asked Questions About NAS Data Recovery

Do I have to send in the whole NAS or are the hard drives enough?

In most cases the drives are enough. What matters is that the set is complete, including supposedly defective disks, and that the bay positions are labelled. With devices using a vendor-specific array, or with unusual configurations, the enclosure can be helpful. We clarify that briefly with you before shipping and arrange collection on request.

Is NAS data recovery possible without the original device?

Yes. We reassemble the array in software from write-protected copies of the individual disks, so neither the original enclosure nor the original controller is required. What we determine in the process is the level, the order of the drives, the block size and the offsets. We then evaluate the volume manager and the file system in order to make folders and files visible again.

Can I retrieve the data myself with data recovery software?

With a NAS this route quickly reaches its limits. Such tools work at the level of individual drives and can reconstruct neither the array nor the volume manager. There is also a risk: if the software is run on the original disks, or the result is written back to them, areas needed for the reconstruction are lost. If the data matters, an analysis by specialists is the safer route.

Can data be recovered after a ransomware infection?

Often yes, although the outcome depends on the method used. Some campaigns encrypt only part of the files, or create copies and delete the originals rather than overwriting them. In those cases the original data can often be retrieved from the file system. The prerequisite is that the device was disconnected from the network immediately and has not been changed since. A ransom should not be paid under any circumstances.

How long does NAS data recovery take?

That depends on the number and condition of the drives and on the complexity of the configuration. Purely logical cases are often completed within a few days. With physical damage to several disks it takes longer, because every drive has to be repaired and cloned individually before the reconstruction begins. For time-critical systems in companies, express handling is available around the clock.